TL;DR
The most useful AI governance examples are working documents from real organizations, such as Microsoft’s Responsible AI Standard, Duke Health’s algorithm registry and DBS Bank’s PURE questions. US federal agencies also add a public model, with Chief AI Officers, governance boards and signed risk acceptance under OMB memo M-25-21. Three public failures then show the other side, at Air Canada, Rite Aid and iTutorGroup. Each failure traces back to one missing control, such as an owner for chatbot answers, accuracy testing or a review of a screening rule. The documents behind good programs are plain and reusable, such as an acceptable-use policy and intake form, a register, a charter, review tiers, model cards and post-mortems. Copy the structure of these documents, then set your own thresholds, owners and review dates.
Key Takeaways Real AI governance examples are documents and decisions you can inspect, not principles posted on a values page. Microsoft, Duke Health, US federal agencies and DBS Bank each publish how they review AI before and after launch. Duke’s registry sends every clinical algorithm to Full, Fast-track or Registration-only review, with four possible decisions. Air Canada, Rite Aid and iTutorGroup each lacked one specific control, and regulators or a tribunal said so in writing. Seven artifacts carry most programs, from the intake form and use-case register to the committee charter and post-mortem. Borrow the structure of an example, then set thresholds, owners and review dates that fit your own risk. Watch on YouTube
AI Guardrails Explained: 4 Types, 5 Building Blocks & Agent Guardrails for Enterprise
A Kanerika walkthrough of the guardrail types and building blocks that turn an AI policy into controls, including the extra limits AI agents need before they act.
Before and After One Chatbot Answer Nobody Owned
Here is the before picture. In November 2022, a grieving passenger asked Air Canada’s website chatbot about bereavement fares and was told the discount could be claimed retroactively. The passenger booked on that advice, then learned from Air Canada staff that retroactive claims were not allowed. Before the tribunal, the airline argued it was not liable for what its chatbot said.
Then the after picture arrived in February 2024. A British Columbia tribunal dismissed what it called “a remarkable submission” from the airline. It ruled that Air Canada “did not take reasonable care to ensure its chatbot was accurate.”
So the gap between those two moments is where the best AI governance examples live. They are the registers, owners, review tiers and post-mortems that make sure a confident wrong answer never reaches a customer in the first place.
What Counts as a Real AI Governance Example
A real example is something an outsider can check. Published principles alone do not qualify, though. A value statement says what an organization hopes for. But it does not show what happens when a team wants to ship a model on a Tuesday afternoon.
Instead, three kinds of evidence pass the test. First comes a published policy or standard with requirements that a reviewer can tick off. Next is a documented operating structure, such as a registry, a review committee or a set of risk tiers. Last is a regulator’s or tribunal’s finding after something went wrong, since it names the control that was missing. For example, Microsoft’s Responsible AI Standard of June 2022, Duke Health’s algorithm registry and the EEOC’s $365,000 iTutorGroup settlement are one of each.
For that reason, each example below goes through the same lens. What decision does it govern, who owns that decision, which control applies, what evidence is kept, and what stays unknown from the outside? That last question matters because public material shows the design of a program, while its day-to-day quality stays private.
For definitions, first read the guide to what AI governance is , and for the building blocks of a program, see the AI governance framework guide .
AI Governance Examples at a Glance
Seven organizations made the cut. Four run programs in public, while three failed and ended up in a regulator’s or tribunal’s record. Every row is dated and linked to its primary source further down.
Organization Sector Date What is public Artifact it illustrates Microsoft Technology June 2022 (Standard v2) Standard, Sensitive Uses review, Transparency Notes Acceptable-use policy, model documentation Duke Health (ABCDS Oversight) Healthcare Current program page Registry, risk-based review pathways Use-case register, tiered approval flow US federal agencies (OMB M-25-21) Public sector April 2025 Chief AI Officers, governance boards, impact assessments Intake form, committee charter DBS Bank (PURE) Financial services In use since 2019 PURE questions, a data use committee Acceptable-use questions, committee charter Air Canada Travel February 2024 Tribunal decision on a website chatbot’s answer Incident post-mortem Rite Aid Retail December 2023 FTC order banning facial recognition for surveillance for five years Pre-deployment testing, monitoring iTutorGroup Hiring September 2023 EEOC settlement over automated age screening Review of decision rules before go-live
One caveat applies to the whole table, though. Only organizations that chose to publish, or that a regulator acted against, are visible at all. So treat these as patterns to test rather than a ranking.
Four Programs That Show AI Governance Working
These four AI governance examples come from four sectors. Each one turns a principle into something a team has to do before launch, and each publishes enough detail to copy the shape of it.
Microsoft: A Standard With Goals, Requirements and a Sensitive Uses Review
Microsoft published the second version of its Responsible AI Standard on 21 June 2022, after an internal first version in fall 2019. The Standard breaks each principle into Goals and each Goal into Requirements. Accountability, for example, becomes impact assessments, data governance and human oversight.
The part worth studying is the Sensitive Uses review. It led Microsoft to put Azure AI Custom Neural Voice behind layered controls. Those controls were restricted customer access, technical guardrails and acceptable use cases set out in a Transparency Note and Code of Conduct. Microsoft also said it would apply similar limits to facial recognition, so access would go to managed customers and partners for pre-defined uses.
The same review also retired features, as Microsoft said it would remove Azure Face capabilities that infer emotional states and attributes such as gender and age. It also published its Impact Assessment template and a set of Transparency Notes. As of November 2026, its Responsible AI page links a 2026 Transparency Report.
What to copy, then, is the translation step. Turn each principle into a requirement someone can check. Then give sensitive uses their own named review path, because a general policy alone will not stop a risky product decision.
Duke Health: A Registry and Risk-Tiered Review for Clinical Algorithms
Duke Health runs ABCDS Oversight for algorithm-based clinical decision support, including AI, intended for patient care. It also covers tools Duke buys as well as tools it builds. One guiding principle is that every tool must have clearly defined clinical and technical ownership.
The process starts with a registry of every algorithm under consideration for patient care. After a team submits a registration form, an Implementation Subcommittee assesses risk and assigns one of three pathways. High-risk tools get Full review, while moderate-risk tools get Fast-track review. Low-risk tools are Registration only, so the clinical and model owners do their own validation and testing.
An independent Review Committee then checks tools at lifecycle checkpoints, from Impact Potential through Real-World Readiness and Real-World Impact to Sustained Impact. Each review then ends in one of four outcomes, which are Approval, Approval with contingencies, Re-Review or Decline. When a tool is not approved, the team gets the gaps and a timeline to fix them.
Two habits stand out here. There is a single front door, so nothing reaches patients without a registry entry, and decisions carry conditions instead of a bare yes or no. The guide to AI governance in healthcare covers the rest of the sector picture.
US Federal Agencies: Chief AI Officers, Governance Boards and a Public Inventory
In the public sector, OMB issued memorandum M-25-21 on April 3, 2025. As issued, it gave each agency 60 days to name a Chief AI Officer. Each CFO Act agency also had 90 days to convene an AI Governance Board, while the annual AI use case inventory continued.
For high-impact AI, the memo also set minimum practices. Agencies had to test before deployment and complete an AI impact assessment before launch, then update it through the lifecycle. They also had to monitor systems after deployment with testing and periodic human review.
Two details make this a strong model for private companies, even though it was written for agencies. First, a Chief AI Officer could waive a practice only through a written, system-specific determination, and agencies had to publish a summary of each waiver. The impact assessment also ended with a risk acceptance signed by a named individual. Before that signature, an independent reviewer with no part in development had to add comments.
What to copy, therefore, is the accountability chain: one named executive owns the program, a board meets on a schedule, and every high-impact system ends with a person’s signature on the risk they accepted.
DBS Bank: Four PURE Questions Every Data and AI Use Case Answers
DBS Bank has used its PURE framework since 2019, and it asks whether a use of data is Purposeful, Unsurprising, Respectful and Explainable. DBS’s Singapore FinTech Festival 2025 update names the oversight body, a Group Responsible Data Use Committee. Meanwhile, the Chief Data Office owns the PURE and AI governance frameworks. A cross-functional Responsible AI Taskforce also adds controls as generative AI use cases scale, and PURE is part of training for new joiners. For the regulatory side, see the guides on AI governance in banking and AI governance in financial services .
Taken together, these four programs share one design choice. Each one asks its questions before launch and keeps asking after it, which is the core idea behind responsible AI put into working practice.
AI Assessment
See Where Your AI Governance Program Stands
Score your organization’s AI maturity across data, governance and security to find which of these practices you already run and which to build next.
Start Your AI Assessment → Three AI Governance Failures and the Control That Was Missing
Failures teach faster than success stories because a regulator or tribunal writes down exactly what went wrong. Each case below quotes that public record, then names the control that would have caught the problem and the document that holds it.
Air Canada’s Chatbot Gave a Policy Answer Nobody Owned
In Moffatt v. Air Canada, 2024 BCCRT 149 , decided on February 14, 2024, the customer had relied on a chatbot answer about bereavement fares. Air Canada then argued that it was not liable for information from its agents, chatbot included. But the tribunal disagreed in plain terms.
“It should be obvious to Air Canada that it is responsible for all the information on its website,” the decision reads. “It makes no difference whether the information comes from a static page or a chatbot,” it added. As a result, the tribunal ordered the airline to pay CAD $812.02 in damages, interest and fees.
This is a Canadian small-claims decision, so it sets no precedent in the US. Even so, the reasoning is hard to argue with. The control the ruling points to is ownership. Someone needed to own the chatbot’s answers, tie them to the authoritative fare policy and update them whenever that policy page changed. For the technical side, the guides on LLM hallucination and AI chatbots for businesses cover how to keep answers grounded.
Rite Aid’s Facial Recognition Skipped Accuracy Testing
On December 19, 2023, the FTC announced that Rite Aid would be banned from using facial recognition for surveillance for five years. According to the FTC, the retailer used AI-based facial recognition in stores from 2012 to 2020, and the system generated thousands of false-positive matches.
The FTC also alleged a chain of gaps. Rite Aid, it said, failed to test or document accuracy before deployment and to prevent the use of low-quality images. It also failed to track false positives afterwards or to train the employees who acted on matches. Rite Aid agreed to settle the charges, and the order also required it to delete the images and any algorithms built from them.
Each alleged gap lines up with a standard control. Pre-deployment accuracy and bias testing, input quality rules, post-launch monitoring and operator training are all things a tiered review would ask for before sign-off.
Kanerika Service
AI Governance Consulting Services
Kanerika’s AI governance services include model impact assessments before deployment, pre-deployment validation for regulated AI systems and bias testing before launch with monitoring after it.
Explore AI Governance Services iTutorGroup’s Screening Rule Rejected Older Applicants Automatically
The third case involves no machine learning at all. According to the EEOC , iTutorGroup programmed its tutor application software to reject applicants by age automatically. Specifically, women aged 55 or older and men aged 60 or older were screened out. More than 200 qualified US applicants were turned away.
Eventually, the company agreed in September 2023 to pay $365,000. The consent decree also required hiring training, a new anti-discrimination policy and an end to requests for birth dates. In addition, the EEOC monitors compliance for at least five years.
The lesson, then, is about scope. AI governance has to cover automated decision rules as well as models, because a hard-coded filter can do as much harm as a biased one. The missing control was a review of the screening logic itself against protected attributes before it went live.
Incident Year What went wrong Control that would have caught it Artifact that holds the control Air Canada chatbot 2022 answer, 2024 ruling Wrong policy answer given to a customer Named owner for answers, sync with the policy source Use-case register, post-mortem Rite Aid facial recognition 2012-2020 use, 2023 order Thousands of false-positive matches (as alleged) Accuracy testing, image quality rules, monitoring, training Tiered approval flow, model card iTutorGroup screening 2023 settlement Automatic rejection by age Review of decision rules for protected attributes Intake form, acceptable-use policy
None of these controls is exotic, either. Each one sits in a document that a mid-sized company can draft in a week, and the next section shows what those documents look like.
Seven AI Governance Artifacts You Can Adapt
The artifacts below are templates written for this post, rather than documents any organization published. Each one is labelled as illustrative and modelled on a real program from the examples above, so you can see where its structure came from.
1. Acceptable-Use Policy Excerpt
Template (illustrative). This excerpt borrows both Microsoft’s idea of pre-defined acceptable uses and DBS Bank’s habit of asking four questions of every use case.
Allowed. Drafting internal text, summarizing public documents and coding help, with no customer or employee personal data in the prompt.Allowed with approval. Any tool that answers customers, touches personal data or feeds a decision about a person, once it has a register entry and a named owner.Prohibited. Inferring emotion or protected attributes, automated rejection of applicants, and any use the governance committee has not reviewed.Exceptions. Granted in writing by the AI governance lead, logged with a reason and an expiry date.The policy works because each tier points to a process instead of a value. For drafting help, the generative AI policy guide goes deeper. Also, the roundup of AI policy management software shows how teams keep policies, attestations and exceptions in one place.
2. AI Intake Form
Template (illustrative). The fields follow the minimum that M-25-21 set for a federal AI impact assessment, plus the registration step Duke uses.
Field What the requester writes Modelled on Purpose and expected benefit The problem, the metric it should move, the process it would replace M-25-21 item A Data and model fitness Data sources, a data summary, protected classes involved M-25-21 item B Impacts and mitigations Effects on privacy, civil rights and the people affected M-25-21 item C Reassessment schedule Review date, plus what change triggers a new review M-25-21 item D Costs and savings Build, run and oversight costs M-25-21 item E Independent review Reviewer not involved in the build, with comments M-25-21 item F Risk acceptance Name and signature of the person accepting the risk M-25-21 item G Clinical or business owner One named owner and one technical owner Duke registration form
Keep the form short so that people fill it in honestly. The AI risk assessment template shows how to score the answers once a request arrives.
Checklist
Generative AI Checklist: Secure Adoption and Governance
A practical checklist for rolling out generative AI with clear usage rules, data protections and approval steps behind each allowed use.
Get the Checklist → 3. Use-Case Register Entry, Including an AI Agent
Template (illustrative). Two sample rows show how a register reads in practice, one for a model and one for an agent that can take actions.
ID Use case Owner Risk tier Controls Status Next review UC-014 Customer FAQ assistant answering fare and refund questions from the policy library Head of customer care Medium Answers grounded in approved policy pages, weekly sync, sampled answer review Approved with conditions Next policy change or 90 days UC-021 Refund agent that reads orders and issues refunds up to a set limit Finance operations lead High Read-only order access, refunds above the limit need human approval, full action log Pilot only 30 days
The agent row adds two fields that a model row rarely needs. These are the actions it may take and the point when a human steps in. For more detail, the guides on agentic AI governance and human-in-the-loop AI agents show how to set those limits.
Checklist
Enterprise Agentic AI Checklist
The permissions, approval thresholds and monitoring an AI agent needs before it can act on real systems, in one working checklist.
Get the Checklist → 4. Governance Committee Charter
Template (illustrative). The charter draws on three real bodies: DBS Bank’s Group Responsible Data Use Committee, Duke’s Review Committee and the federal AI Governance Boards.
Purpose. Approve, condition, pause or decline AI use cases rated Medium or High.Members. A business sponsor, risk or compliance, legal, security, data, and the model owner for the item under review.Quorum. Four members, including risk and one business sponsor.Decision rights. The committee may pause a live system pending review.Cadence. Monthly, with an urgent session within five working days after a serious incident.Escalation. Unresolved decisions go to the executive who owns the AI program.The authority to pause is the clause most charters leave out, and it is the one that matters most during an incident. The guide to AI governance, risk and compliance covers how the committee fits next to existing risk functions.
5. Tiered Approval Flow
Template (illustrative). The tiers below are ours, but the shape follows Duke’s three review pathways and four possible decisions.
Tier Trigger Reviewer Evidence required Possible decisions Register only Internal use, no personal data, no decisions about people Use-case owner Register entry, owner’s own test notes Approve or decline Fast-track Customer-facing or uses personal data AI governance lead plus one specialist Intake form, test results, monitoring plan Approve, approve with conditions, re-review Full review Decisions about people, regulated use or agents that act Governance committee All of the above plus independent review and signed risk acceptance Approve, approve with conditions, re-review, decline
In practice, “Approve with conditions” does most of the work. It lets a team ship a pilot while the committee keeps the right to check the evidence it asked for.
6. Model Card With a Deployment Supplement
Template (illustrative). The base fields come from Model Cards for Model Reporting by Mitchell and colleagues. The paper also asks that models ship with notes on intended use and performance. It also asks for evaluation across conditions such as demographic groups.
A model card describes the model, though, not your deployment of it. So add a short local supplement with five fields. Specifically, these are the business owner, data boundary, human review point, monitoring metric and the event that triggers a re-review. Microsoft’s Transparency Notes play the same role on the vendor side, and the guide to explainable AI covers what to write in the performance section.
7. Incident Post-Mortem
Author reconstruction, not Air Canada’s internal document. It uses only the public tribunal findings, to show the format.
Section Entry Timeline November 2022 chatbot answer, customer claim, February 2024 tribunal decision Impact CAD $812.02 ordered, plus a public ruling on chatbot accountability Finding The tribunal found the company did not take reasonable care to ensure its chatbot was accurate Control to add A named owner for chatbot answers on fare policy Corrective actions Assign an owner, ground answers in the policy library, add a sync check when policy pages change Artifact updates Acceptable-use policy, register entry UC-014, approval conditions
The last row is the one teams skip. After all, a post-mortem that does not change the policy, the register and the approval conditions will be written again for the next incident.
What the Strongest Examples Have in Common
When you set the four programs side by side, six patterns repeat. None of them depends on a particular tool. Each one also maps to an artifact from the previous section.
Pattern Where it shows up Artifact that carries it One entry point Duke’s registry, the federal use case inventory Use-case register Review sized to risk Duke’s three pathways, high-impact practices in M-25-21 Tiered approval flow Named owners Duke’s ownership principle, federal Chief AI Officers, DBS Bank’s Chief Data Office Register, committee charter Decisions with conditions Duke’s four outcomes, Microsoft’s limited access for sensitive uses Tiered approval flow Monitoring after launch Federal ongoing monitoring, Duke’s Sustained Impact checkpoint Model card supplement Published evidence Microsoft’s Transparency Notes, federal waiver summaries Model card, transparency note
Two large AI vendors also publish the same building blocks. As of November 2026, IBM’s Responsible Technology Board sets governance and standards for how the company develops and deploys AI and other emerging technologies. Google’s AI Principles , as of November 2026, likewise pair bold innovation with responsible deployment and describe governance running from model development to post-launch monitoring.
The examples also map cleanly onto the main frameworks. NIST released the voluntary AI Risk Management Framework 1.0 in January 2023 and a Generative AI Profile in July 2024. Similarly, ISO/IEC 42001:2023 sets requirements for an AI management system. For each one, the NIST AI RMF playbook and the ISO 42001 certification guide go deeper.
In Europe, Regulation (EU) 2026/1744 moved the AI Act’s high-risk obligations. Annex III systems face them from 2 December 2027, and Annex I systems from 2 August 2028. The EU AI Act compliance guide explains what that shift means for planning.
How to Adapt These Examples Without Copying Them
Another organization’s program is a starting point, since its thresholds were set for its own risks and its own regulators. So these five steps borrow the structure and leave the numbers to you.
Start with the register. List every AI use case you already run, including bought tools and automated decision rules, before you write a single policy.Size the review tiers to your risk. A retailer and a hospital will draw the Full review line in different places, so decide what triggers each tier.Write the acceptable-use policy from your own data. Build the tiers around the data classes you hold, then add the uses you will never allow.Give every decision an owner and a re-review trigger. A named person, a date and a change event keep an approval from going stale.Rehearse one post-mortem. Walk a past incident, or a public one such as Air Canada’s, through your template and see which documents would change.Four mistakes undo most programs: a policy with no owner, a register nobody updates, approvals without monitoring and thresholds copied from another company. All four look like governance on paper while catching nothing.
Checklist
AI Governance Checklist
The policies, owners, reviews and evidence an AI governance program needs, in one list you can work through with your committee.
Get the Checklist → The AI governance maturity model helps you judge which of these steps to take first. For the data side of the same work, the data governance examples post follows the same format. Then the overview of AI governance tools covers the software that keeps a register current. Once the documents exist, an AI auditing framework tells you whether they are being followed.
How Kanerika Puts AI Governance Into Practice
Kanerika’s AI governance services follow a model called IMPACT, which stands for Identify, Map, Prove, Analyze, Create and Transform. Here is how the service page sums up four of them.
Identify surfaces governance gaps before they become audit findings. Prove tests governance controls on highest-risk systems first. Analyze quantifies the cost of governance failures against the cost of prevention. Transform embeds governance into ongoing AI operations. Several service lines map onto the artifacts in this post. For example, acceptable use policy drafting for AI systems produces the policy. Risk tiering with clear ownership, plus model impact assessments before deployment, cover the intake form and tiers. Likewise, a model registry with a full audit trail across production is the register. Pre-deployment validation and post-change audits after model updates make up the tiered review. Finally, defined escalation procedures with periodic review cadences form the charter.
The evidence trail also matters inside the AI systems Kanerika builds. For a global luxury goods retailer, Kanerika delivered AI vision for product authentication, with blockchain-based provenance tracking and real-time verification during returns and resale. As a result, the retailer reached 95% accuracy in counterfeit detection, 68% faster product verification and 100% product traceability.
Case Study
95% Accuracy in Counterfeit Detection With AI Vision
A global luxury goods retailer used Kanerika’s AI vision and provenance tracking to reach 95% counterfeit-detection accuracy, 68% faster verification and 100% product traceability.
Read the Case Study → That project was an AI delivery rather than a governance engagement. Even so, its provenance record gives each product a secure and transparent history. That is the kind of evidence a register entry or a post-mortem depends on. Separately, Kanerika holds ISO 27001, ISO 27701:2019 and SOC 2 Type II certifications.
The AI Governance Examples Worth Copying
Microsoft, Duke Health, the federal agencies and DBS Bank all publish principles. But what makes them useful AI governance examples is what sits underneath. That means a registry with one front door, review sized to risk, a named owner and a signature on the risk accepted.
The three failures show the same thing from the other side, because each lacked one document a small team could have written. So copy the working documents, the register, tiers, charter and post-mortem, and treat the principles as the reason they exist.
Frequently Asked Questions
What are some real-world examples of AI governance?
Microsoft’s Responsible AI Standard turns principles into checkable requirements and a Sensitive Uses review. Duke Health registers every clinical algorithm and routes it to Full, Fast-track or Registration-only review. US federal agencies name Chief AI Officers and governance boards under OMB memo M-25-21, and DBS Bank asks four PURE questions of every data use.
What does an AI governance policy example include?
A practical acceptable-use policy sorts AI uses into allowed, allowed with approval and prohibited tiers. Each tier points to a process, such as a register entry and a named owner for approved uses. It also names who can grant exceptions, how they are logged and when each exception expires, so the policy stays enforceable.
Who should sit on an AI governance committee?
Most committees combine a business sponsor, risk or compliance, legal, security and data leads, plus the model owner for the item under review. The charter should set a quorum, a meeting cadence and an escalation path. It should also give the committee authority to pause a live system, which many charters forget.
What is an example of an AI governance failure?
In Moffatt v. Air Canada, decided in February 2024, a British Columbia tribunal held the airline responsible for a wrong bereavement-fare answer from its website chatbot. It found Air Canada did not take reasonable care to ensure the chatbot was accurate. Rite Aid’s facial recognition order and iTutorGroup’s age-screening settlement are two more.
What should an AI use-case register contain?
Each entry needs an ID, the use case, a named owner, the data involved, a risk tier, the controls in place, the approval status and a next review date. Entries for AI agents should also list the actions the agent may take and the threshold at which a human must approve the action.
Is a model card enough to approve an AI system?
No. A model card describes the model’s intended use, performance and evaluation, but not how your organization deploys it. Add a short deployment supplement with the business owner, data boundary, human review point, monitoring metric and the event that triggers a re-review, then approve the system against both documents together.
Are companies responsible when their AI chatbot gives wrong information?
In the Air Canada case, the tribunal said a company is responsible for all information on its website, whether it comes from a static page or a chatbot. That was a Canadian small-claims decision rather than US precedent, but it shows why chatbot answers need an owner and a link to the authoritative policy.
How do you start an AI governance program from these examples?
Start by listing every AI use case you already run, including purchased tools and automated decision rules, in one register. Then define review tiers sized to your own risk, write an acceptable-use policy around your data classes, give each approval an owner and a re-review trigger, and rehearse one incident post-mortem.
Does AI governance cover simple automated rules as well as machine learning?
It should. iTutorGroup’s tutor application software was programmed to reject older applicants automatically, with no machine learning involved, and the company agreed in 2023 to pay $365,000 to settle an EEOC suit. Any automated rule that affects people deserves the same pre-launch review for protected attributes that a model receives.
