In most governance meetings I chair, there is a point where I ask to see the document: the approved policy pack, the inventory register with a last-updated date, the incident playbook someone has rehearsed. In more than 100 board-level engagements across the Caribbean, that request has told me more about an organisation's AI governance than any assessment I could run.
It works because everyone who tests your governance from the outside asks for documents. A regulator working through the EU AI Act asks for evidence of risk management and human oversight. An ISO/IEC 42001 certification audit follows a list of required artefacts. An insurer pricing AI exposure wants the incident playbook and the vendor assessments. An enterprise customer's procurement questionnaire asks you to attach a file for every row.
The 25 documents, in five rows of five
Each row of the board is a theme, and each theme is a question an outsider will eventually ask.
Foundations
Risk & Data
Oversight
Operations
The Outside
Each column crosses all five themes. A complete column means the programme has a foundation, a risk artefact, an oversight mechanism, an operational system and an outward-facing control for one slice of the work. The two diagonals test the same spread.
Why complete lines count for more than a total
Fourteen documents scattered across the board usually mean an organisation answered fourteen separate requests: an auditor asked for one, a customer demanded another, a conference prompted a third. Fourteen documents that include two full rows mean it finished each theme it started. The count is the same; the organisations are different.
Outside scrutiny follows lines. A regulator examining risk will ask for the framework, then the inventory it depends on, then the impact assessments the framework requires, then the fairness reviews behind them. That is row two in order, and the conversation turns uncomfortable at the first gap.
The interactive board scores both. Each tile takes one of four ratings: not started, started, underway or complete. Maturity across the 24 rateable tiles carries 70 of the 100 points. Each fully complete line, out of 12 across rows, columns and both diagonals, adds 2.5 more. The centre square is free and links to the AI Boss Assessment instead of asking for paperwork.
Play AI Governance Bingo →A 3D board of all 25 governance documents. Click each tile, rate how far along you are, and get a governance score from your maturity and your completed lines. Free, no signup, a few minutes.What counts as complete
A document is complete when it is approved by someone with authority, in use and kept current. A file with roughly the right name does not qualify. The policy pack drafted in 2024 and never taken to the board is not complete, and neither is the inventory register that was accurate the week it was built.
The scoring reflects this. Turning one drafted document into an approved one moves your score more than starting two new drafts, which matches the advice I give every board asking where to spend the next quarter: finish before you start.
Completed tiles also decay. Registers go stale, trained staff leave and are replaced by untrained hires, and a review report from two years ago no longer describes the programme. Treat any tile untouched for 12 months as underway, and re-rate the whole board each quarter.
How the board data is used
Selections are stored anonymously. The Caribbean has no regional dataset showing which governance documents organisations have and where the common gaps are, and each play adds a data point to one. That feeds the training and policy work I do through StarApple AI and the Caribbean AI Risk Management Council. An email address is optional, and the board state is never tied to your name unless you give it.
Boards that want more than a score have two options. The Board AI Audit checks whether your board can oversee the programme these documents make up. The Board AI Programme is the full engagement: curriculum, scorecard and a build session that assigns a named owner to each gap.
I have not yet tested whether the 70/30 weighting between maturity and lines is right for small organisations. A ten-person firm can complete a line with short documents that a bank could not get away with, and the scoring does not adjust for size.
What to do next
- The executive accountable for AI: play the board this week with your risk or compliance lead in the room, and rate a tile complete only if you can open the approved document during the session. It takes about ten minutes.
- The same executive: pick the row closest to complete and name one owner for each missing tile, with a 90-day deadline. One finished line is worth more than five new drafts.
- Whoever owns technology: if the AI inventory register is not complete, build it first. List every AI system and tool in use, its owner, its data and its purpose, in a single spreadsheet.
- The board secretary: put approval of any drafted-but-unapproved documents on the next board agenda. Approval is the cheapest step on the board.
- Risk and compliance: set a calendar reminder to re-rate the board every quarter, and mark any tile not reviewed in 12 months as underway.
Adrian Dunkley has led more than 100 board-level AI engagements through StarApple AI. Play AI Governance Bingo, see the Board AI Programme, or write to insights@starapple.ai to talk about closing the gaps on your board.
Frequently Asked Questions
Which of the 25 documents should an organisation produce first?
Start with the AI inventory register, because every other document refers to the systems it lists. Then produce the approved policy pack and the governance RACI, so there is an owner for each system in the register. The risk management framework and the impact assessment template come next. Organisations that start with the principles statement often end up with a good paragraph and nothing it applies to.
Which documents does an ISO/IEC 42001 certification audit expect?
ISO/IEC 42001:2023 requires, among other things, a documented AI policy, an AI risk assessment and risk treatment process, a statement of applicability for its Annex A controls, and AI system impact assessments. On the board, those map mainly to the policy pack in row one and the risk framework and impact assessment template in row two. Certification is carried out by accredited certification bodies, so ask any auditor you engage which accreditation body recognises them.
Does a small organisation need all 25?
It needs something in each of the five themes, but the documents can be short. A 30-person firm using two AI tools can hold its inventory, policy and RACI on three pages and its incident playbook on one. What does not shrink is the approval and review step: someone with authority signs each one and a date is set to check it again.
How does the board relate to the NIST AI Risk Management Framework?
NIST's AI RMF 1.0, published in January 2023, is voluntary and organised around four functions: Govern, Map, Measure and Manage. Row one of the board is mostly Govern, row two is mostly Map, and rows three and four cover Measure and Manage. The board is a checklist of evidence; the NIST framework describes the activities that produce that evidence, and its companion Playbook gives suggested actions for each function.
What is the most common mistake people make when rating the board?
Marking a tile complete because a file with the right name exists. Complete means approved by someone with authority, in use and reviewed in the past year. A policy drafted in 2024 and never taken to the board is Underway at best, and rating it honestly usually drops a first score by a band.