Sample AI Governance Packet for a fictional dental practice, Northgate Family Dental. Every number, tool and person here is invented to show the shape of a finished packet. Order yours.
AI Tool Inventory
Business: Northgate Family Dental (Northgate Family Dental PLLC) Address: 4200 Example Avenue N, Suite 210, Seattle, WA 98125 Industry: Dental practice · Staff: 14 AI Governance Owner: Dr. Priya Raman, Practice Owner Inventory date: October 22, 2026 · Next review: every quarter
1. AI tools in use
Every AI tool the business uses, including AI assistants inside other software. One row per tool. The "Vendor terms" column records what the vendor's published terms say about training on the business's data; "unknown" means the business has asked or will ask the vendor and will update the row.
| Tool | Vendor | Purpose | Data it receives | Owner | Access control | Retention | Vendor terms: trains on our data? | Status |
|---|---|---|---|---|---|---|---|---|
| ChatGPT Team | OpenAI | Drafting patient letters, recall reminders and website copy | business documents; no patient health information | Office manager | SSO with multi-factor authentication | chat history cleared every 30 days | no (Team plan terms) | Approved |
| Weave | Weave Communications | Phone system with AI call summaries and missed-call texting | patient names and phone numbers; call recordings | Front desk lead | individual logins with multi-factor authentication | per vendor contract (BAA in place) | unknown (to confirm with vendor) | Approved |
| Dentrix Ascend | Henry Schein One | Practice management with AI-assisted insurance eligibility and claim scrubbing | patient records; insurance information | Practice Owner | role-based logins with multi-factor authentication | per vendor contract (BAA in place) | no (contract) | Approved |
| Otter.ai | Otter.ai | Transcribing internal staff meetings | staff meeting audio; no patient information | Office manager | individual logins | transcripts deleted after 90 days | unknown (to confirm with vendor) | Approved |
2. Embedded AI features
Third-party software with embedded AI features that the business relies on (also listed above, marked here so they are not overlooked when a vendor adds AI to an existing product):
- Weave (Weave Communications): Phone system with AI call summaries and missed-call texting
- Dentrix Ascend (Henry Schein One): Practice management with AI-assisted insurance eligibility and claim scrubbing
3. Review schedule and change control
- This inventory is reviewed every quarter by the AI Governance Owner and whenever a tool is added, removed or changes purpose.
- A new AI tool, or an existing product that adds AI features, is added to this inventory and approved by the AI Governance Owner before staff use it for business information.
- Each review is recorded in the Human Review Evidence Log (section 4).
4. Change log
| Date | Change | By |
|---|---|---|
| October 22, 2026 | Inventory compiled and adopted | Dr. Priya Raman, Practice Owner |
AI Tool Inventory for Northgate Family Dental, prepared October 22, 2026 by Addison Workshop Media Co. from the information the business supplied. This is documentation of the business's own practices, not legal advice; the jurisdiction notes carry the official source to verify. Questions: reply to the delivery email.
AI Acceptable Use Policy
Business: Northgate Family Dental (Northgate Family Dental PLLC) Adopted: October 22, 2026 · AI Governance Owner: Dr. Priya Raman, Practice Owner Applies to: every employee, contractor and vendor who uses AI tools for Northgate Family Dental's work or on its behalf.
1. Purpose and ownership
This policy sets how Northgate Family Dental uses artificial intelligence tools. Dr. Priya Raman is the AI Governance Owner: accountable for this policy, the AI Tool Inventory, the Human Review Evidence Log, and for answering insurer and regulator questions about them. The policy is reviewed at least every quarter and after any AI incident.
2. Approved tools and prohibited uses
- Approved tools: ChatGPT Team, Weave, Dentrix Ascend, Otter.ai. The AI Tool Inventory is the current list; a tool not on it is not approved for business information.
- Prohibited uses: entering information the business has no right to share; generating content that impersonates a person or organisation; using AI to make a decision this policy reserves to a person; disabling security settings or logging on an AI tool; using personal AI accounts for business information.
- Contractors and vendors who use AI on Northgate Family Dental's behalf follow this policy; the AI Governance Owner confirms that before the work starts.
3. Information rules
- Confidential information (contracts, pricing, financials, trade secrets, anything under a non-disclosure agreement) goes only into approved tools whose vendor terms say the data is not used for training.
- Personal information about customers, patients, employees or applicants is entered only into approved tools that the inventory lists as receiving that data, under the contract or agreement that covers it. Protected health information goes only into tools covered by a business associate agreement.
- Retention: prompts, uploads and outputs are kept no longer than the retention noted for each tool in the inventory; a tool with no retention control is used only for information the business could publish.
4. Human review
- A person reviews AI output before it affects a customer, an employee, money or a legal position ("human review"). This is how the business operates today.
- Decisions never fully automated: dismissing or disciplining staff; refusing service; quoting or changing a price; sending money; signing anything; giving medical, legal, financial or safety advice; and anything the law reserves to a person.
- Reviews that matter are recorded in the Human Review Evidence Log.
5. Decisions about people
- AI is not used in hiring, promotion, discipline or termination (employment decisions). If that changes, this section is rewritten before first use.
- AI is not used in consequential decisions about individuals (credit, insurance, housing, healthcare, education or legal services). If that changes, this section is rewritten before first use.
- Individuals are given notice of automated decision-making where applicable law requires it, using the wording in Appendix A for their jurisdiction.
- Any AI tool used in a decision about a person is reviewed for bias and discriminatory effect before first use and after material changes, and the review is recorded in the evidence log.
6. Customers and AI
- Where a customer interacts with a chatbot or AI agent of Northgate Family Dental, the first message makes clear ("disclose") that it is AI, and the customer can reach a person by replying, calling the office, or asking for a person at any time.
- AI never gives a customer medical, legal, financial or safety advice on the business's behalf; such questions are handed to a person.
7. AI incidents
- An AI incident is: an AI output that reached a customer or the public with a material error; confidential or personal information entered into a tool that was not approved for it; an AI agent taking an action nobody intended; a suspected impersonation using AI; or a vendor notice that the business's data was exposed.
- Anyone who suspects an incident tells the AI Governance Owner at office@northgatefamilydental.example the same day. The owner records it in the evidence log, contains it, tells affected people where required, tells the insurer where the policy requires it, and reviews the policy afterwards.
8. Security
- Every AI account uses multi-factor authentication and is limited to the staff who need it; shared logins are not used.
- API keys and credentials for AI services are stored in a password manager or secrets store, never in documents, chats or code, and are rotated when a person with access leaves.
- AI spending is monitored and every pay-per-use account has a limit or alert.
- AI vendors are included in the business's vendor risk review.
- Staff verify unusual requests for money, credentials or data by a second channel, because AI can imitate a voice, face or writing style (impersonation).
- Northgate Family Dental does not run AI agents with tool access (agents that send email, change records or spend money on their own). Before any such agent is used, this section is rewritten to limit its permissions and log its actions.
9. AI-generated content and intellectual property
- AI-generated content (text, images, audio, video) published or sent by Northgate Family Dental is reviewed by a person for accuracy, tone and intellectual property before use, and labelled as AI-generated where a platform or law requires it.
- Staff do not instruct AI tools to reproduce copyrighted material, a competitor's branding, or a real person's likeness or voice.
- The business does not train or fine-tune AI models.
10. Continuity
- No AI tool is a single point of failure: the business keeps the ability to do its core work by other means if a tool fails or is withdrawn, and the inventory records what depends on each tool.
11. Review, training and applicable AI laws
- Staff receive training on this policy within 30 days of adoption and at least yearly after that. Each person acknowledges the policy in writing; acknowledgments are kept in the evidence log.
- The AI Governance Owner monitors the applicable AI laws listed in Appendix A and reviews this policy at least every quarter, after any incident, and when a listed law changes.
12. Jurisdiction commitments
The commitments below apply in the places Northgate Family Dental operates or serves. They are written as what the business does, not as legal advice; Appendix A gives the research summary and the official source to verify each one.
United States (federal baseline)
- The Company does not make claims about its AI tools or AI-assisted services that it cannot support with evidence.
- The Company treats state AI laws that apply to it as in force until a court or the legislature changes them, whatever the status of federal preemption efforts.
Appendix A: applicable AI laws (summary, confidence, where to verify)
United States (federal baseline) (research confidence: high)
As of October 2026 there is no comprehensive federal AI statute. The Federal Trade Commission applies Section 5 of the FTC Act to unfair or deceptive practices involving AI, including unsupported claims about what an AI product does. A December 2025 executive order directed federal agencies to work on a national framework and to challenge some state AI laws; state laws remain enforceable until a court or Congress changes them.
Verify: https://www.ftc.gov/business-guidance, https://www.whitehouse.gov/presidential-actions/
Appendix B: NIST AI Risk Management Framework crosswalk
Oct 2026: insurers and the Texas Responsible AI Governance Act both point at the NIST AI RMF (January 2023, with the 2024 generative-AI profile). This table shows where each of its four functions is met by this packet, so a reviewer can check conformance without reading all three documents.
| NIST AI RMF function | What it asks | Where this packet meets it |
|---|---|---|
| GOVERN | Accountable owner, written policy, roles, training, review cadence | This policy, section 1 (purpose and ownership) and section 11 (review and training); the Acknowledgment below; the adoption and training rows of the Human Review Evidence Log |
| MAP | Know every AI system in use, its purpose, the data it touches and who it affects | The AI Tool Inventory (vendor, purpose, data, owner, access, retention, vendor training on data); the approved and prohibited uses in this policy; the jurisdiction commitments in section 12 |
| MEASURE | Check outputs before they count, track incidents, keep evidence | The human-review rules in this policy; the review log, decision register and incident log in the Human Review Evidence Log |
| MANAGE | Act on what is found: fix, retire, re-approve, tell affected people | The incident process in this policy; the remediation table and decision register in the Evidence Log; the vendor approval status in the Inventory; the review triggers in section 11 |
Conformance is self-assessed by Northgate Family Dental and recorded at each policy review; NIST does not certify conformance.
Acknowledgment
I have read the AI Acceptable Use Policy of Northgate Family Dental dated October 22, 2026 and will follow it.
Name: ______________________ Signature: ______________________ Date: ____________
AI Acceptable Use Policy for Northgate Family Dental, prepared October 22, 2026 by Addison Workshop Media Co. from the information the business supplied. This is documentation of the business's own practices, not legal advice; the jurisdiction notes carry the official source to verify. Questions: reply to the delivery email.
Human Review Evidence Log
Business: Northgate Family Dental (Northgate Family Dental PLLC) · AI Governance Owner: Dr. Priya Raman, Practice Owner · Opened: October 22, 2026
This log is the evidence behind the AI Acceptable Use Policy. It is kept by the AI Governance Owner, reviewed every quarter, and made available on request to the business's insurer, broker or a regulator.
1. Governance record
| Date | Record | By |
|---|---|---|
| October 22, 2026 | AI Acceptable Use Policy adopted | Dr. Priya Raman, Practice Owner |
| October 22, 2026 | AI Tool Inventory compiled | Dr. Priya Raman, Practice Owner |
| October 22, 2026 | Next policy and inventory review due in one quarter | Dr. Priya Raman, Practice Owner |
2. Policy acknowledgments
Each person acknowledges the policy in writing within 30 days of adoption ("acknowledge"); one row per person.
| Name | Role | Acknowledged on |
|---|---|---|
3. Training
| Date | Training | Attendees | Led by |
|---|---|---|---|
| (within 30 days) | AI policy training: first session (scheduled) | all staff | Dr. Priya Raman, Practice Owner |
4. Human review log
Reviews that matter: an AI output that would otherwise have gone to a customer, affected an employee, moved money or taken a legal position. One row per review, or a weekly summary row where reviews are routine.
| Date | Tool | What was reviewed | Outcome (approved / corrected / rejected) | Reviewer |
|---|---|---|---|---|
5. Incident log
Opened October 22, 2026. No incidents recorded at opening. One row per AI incident as defined in section 7 of the policy.
| Date | Incident | Contained by | Affected people told | Insurer told | Policy change |
|---|---|---|---|---|---|
6. Decision register
Decisions that are never fully automated at Northgate Family Dental:
- Dismissing or disciplining staff
- Refusing service
- Quoting or changing a price
- Sending money
- Signing anything
- Medical, legal, financial or safety advice
- Anything the law reserves to a person
7. Open remediation items
| Item | Due | Owner |
|---|---|---|
| None at adoption |
Human Review Evidence Log for Northgate Family Dental, prepared October 22, 2026 by Addison Workshop Media Co. from the information the business supplied. This is documentation of the business's own practices, not legal advice; the jurisdiction notes carry the official source to verify. Questions: reply to the delivery email.
Renewal Crosswalk
Business: Northgate Family Dental · Prepared: October 22, 2026 · Renewal date: 2026-12-01
Each question an AI supplemental application commonly asks, the answer Northgate Family Dental can give today from its own records, and where the evidence sits. "Partial" means the document adopts the control and the evidence log shows it being completed; "No" means the control is not in place yet and the remediation is scheduled. Carriers word these questions differently; match the carrier's wording to the closest row.
| # | Question | Answer | Evidence | Note |
|---|---|---|---|---|
| Q01 | Does the business maintain an inventory of the AI tools and AI-enabled features in use? | Yes | Inventory, section 1 | |
| Q02 | For each AI tool, is the vendor, purpose, data it receives, and an accountable owner recorded? | Yes | Inventory, section 1 (one row per tool) | |
| Q03 | Are third-party software products with embedded AI features (CRM assistants, note-takers, email drafting) included in the inventory? | Yes | Inventory, section 2 | 2 embedded feature(s) listed |
| Q04 | Is the inventory reviewed on a set schedule and updated when tools are added or removed? | Yes | Inventory, section 3 | reviewed every quarter |
| Q05 | Does the business have a written AI acceptable-use policy? | Yes | Policy, section 1 | |
| Q06 | Does the policy name approved tools and prohibited uses? | Yes | Policy, section 2 | |
| Q07 | Does the policy restrict entering confidential, personal, or client information into AI tools? | Yes | Policy, section 3 | |
| Q08 | Has the policy been communicated to staff, and do staff acknowledge it? | Partial | Evidence log, section 2 | acknowledgments are collected within 30 days of adoption; the log records each one |
| Q09 | Have staff received training on the safe use of AI tools? | Partial | Evidence log, section 3 | first session scheduled within 30 days of adoption; the log records attendance |
| Q10 | Has the business reviewed whether each AI vendor trains its models on the business's data, and the vendor's terms? | Partial | Inventory, section 1 (vendor terms column) | to confirm with: Weave, Otter.ai |
| Q11 | Is there a retention rule for AI prompts, uploads and outputs? | Yes | Policy, section 3 | |
| Q12 | Are AI accounts protected with multi-factor authentication and access limited to the people who need them? | Yes | Policy, section 8 | |
| Q13 | Are AI outputs reviewed by a person before they affect customers, employees, finances or legal positions? | Yes | Policy, section 4 | |
| Q14 | Which decisions must never be fully automated? | Yes | Policy, section 4 | |
| Q15 | Is human review recorded so it can be shown on request? | Yes | Evidence log, section 4 | |
| Q16 | Is AI used in hiring, promotion, discipline or termination decisions? | No | Policy, section 5 | not used for employment decisions |
| Q17 | Is AI used in decisions about lending, insurance, housing, healthcare, education or legal services for individuals? | No | Policy, section 5 | not used for consequential decisions |
| Q18 | Are individuals given notice when an automated decision affects them, where the law requires it? | Not applicable | Policy, section 5 and appendix A | |
| Q19 | Are AI tools used in decisions about people checked for bias or discriminatory effect? | Not applicable | Policy, section 5 | no AI in decisions about people |
| Q20 | Where customers interact with a chatbot or AI agent, is it disclosed as AI? | Yes | Policy, section 6 | |
| Q21 | Can a customer interacting with AI reach a person? | Yes | Policy, section 6 | |
| Q22 | Is AI-generated content reviewed for accuracy and intellectual-property risk, and labelled where required? | Yes | Policy, section 9 | |
| Q23 | Is there a defined AI incident process: what counts as an incident and who is told? | Yes | Policy, section 7 | |
| Q24 | Are AI incidents logged? | Yes | Evidence log, section 5 | log opened at adoption; no incidents recorded at intake |
| Q25 | Where AI agents can take actions (send email, change records, spend money), are their permissions limited and their actions logged? | Not applicable | Policy, section 8 | no AI agents with tool access in use |
| Q26 | Are AI vendors included in vendor risk review? | Yes | Policy, section 8 | |
| Q27 | Are API keys and credentials for AI services stored securely and rotated? | Yes | Policy, section 8 | |
| Q28 | Is AI spending monitored with limits? | Yes | Policy, section 8 | |
| Q29 | Is a named person accountable for AI governance? | Yes | Policy, section 1 | |
| Q30 | How often is the policy reviewed? | Yes | Policy, section 11 | |
| Q31 | Does the business monitor the AI laws that apply to it? | Yes | Policy, section 11 | |
| Q32 | Are governance records retained and available to insurers or regulators on request? | Yes | Evidence log, section 1 | |
| Q33 | Does the policy cover contractors and vendors who use AI on the business's behalf? | Yes | Policy, section 2 | |
| Q34 | Can the business keep operating if an AI tool fails or is withdrawn? | Yes | Policy, section 10 | |
| Q35 | If the business trains or fine-tunes models, is the data it uses lawfully obtained and documented? | Not applicable | Policy, section 9 | no model training or fine-tuning |
| Q36 | Are there controls against impersonation through AI-generated voice, video or messages? | Yes | Policy, section 8 |
Renewal Crosswalk for Northgate Family Dental, prepared October 22, 2026 by Addison Workshop Media Co. from the information the business supplied. This is documentation of the business's own practices, not legal advice; the jurisdiction notes carry the official source to verify. Questions: reply to the delivery email.