AI Governance Readiness Map: Evidence Records, Roles and Missing Work

AI Governance Readiness Map version 1.0.0 preserves an evidence worksheet for one AI system. Twelve controls connect ownership, artifact references and review records. The output identifies missing work and exports every control, including exclusions. Pharos Production AI engineering developed the worksheet to make those record requirements inspectable before a team treats a governance plan as implemented.

A complete worksheet still returns DRAFT_REQUIRES_REVIEW. The counts describe entered records. They do not establish that an artifact exists, supports the declared control or has received a valid independent review.

Evidence records and roles

Catalog entries cover inventory, jurisdiction and use-case review, risk acceptance, accountability, training, suppliers, data provenance, validation, oversight, traceability, monitoring and incident triage. Controls carry editorial references to the GOVERN, MAP, MEASURE and MANAGE functions of NIST AI RMF, alongside prompts for a separate EU applicability review. The 12-control selection is original planning guidance.

Each row records a status and eight text fields: responsible, accountable, consulted, informed, evidenceRef, reviewer, reviewedOn and rationale. The five statuses are unknown, planned, evidence-recorded, review-recorded and not-applicable. Responsible and accountable are required for ordinary rows. Evidence-recorded also needs an evidence reference. A reviewed row needs the owners, evidence reference, reviewer and review date. An exclusion instead needs an accountable owner, reviewer, review date and rationale. Consulted and informed stay optional.

Only complete review-recorded rows increment reviewed. Only complete not-applicable rows increment excluded. Every other row needs attention, including a planned row with all its fields filled. Missing-field lists and next actions explain what remains. Scope warnings separately flag missing system purpose, jurisdiction review or an unresolved EU role. They do not determine a legal risk class or notification deadline.

Six reproducible synthetic scenarios

Six scenarios provide a blank worksheet, the unchanged original mixed example, an all-review-recorded worksheet and three boundary variants. The blank worksheet reports 12 rows needing attention and three scope warnings. The original example records two reviewed rows, one exclusion and nine rows needing attention, with one unresolved scope warning.

All-review-recorded reports 12 reviewed rows while retaining the draft status. The remaining variants remove an exclusion rationale, omit the responsible owner of an evidence record or change a complete row to planned. Each reports 11 reviewed rows and one needing attention. The planned row has an empty missing-field list. Its status still requires evidence collection or review.

Each scenario includes its inputs and expected JSON, Markdown and CSV exports. All names, memos and dates used as review records are fictional. The original example retains September 11, 2026 inputs. Added examples use October 12, 2026 as a fixed assessment label. These are contract demonstrations, not client assessments or sampled deployment data.

Archive and reproduction

The ZIP preserves all 28 tracked source files from commit 2691dacd9318e15aa97a6bb6cb2a89327f773228, unchanged, plus a reproduction script, expected exports, citation metadata, a license manifest and SHA-256 checksums. With Node.js 22 or newer, run npm run verify in source/, then node reproduce.mjs from the package root. The ten original behavioral tests and release checks pass. The reproduction command checks six scenarios and writes 25 files for comparison. No package dependencies, model calls or credentials are needed.

JSON preserves exact entered values. Markdown escapes entered markup and CSV defuses potentially executable spreadsheet cells. Every export keeps all 12 controls. The interface filter changes visibility only.

Application inputs remain in memory and are lost on reload. Entered evidence references are inert text. The application does not fetch or validate their contents.

Scope and companion resources

Use the AI governance framework engineering guide for background on inventory, validation, monitoring and accountability. Its broader legal timelines and outcome claims are not validation of this deposit. The archived source registry keeps its September 11, 2026 verification dates. This release is neither an official NIST checklist nor a legal compliance assessment.

Try the interactive AI governance evidence worksheet or inspect the versioned governance worksheet source repository. A team missing an evaluation plan, monitoring boundary or operating owner can review the AI agent development services from Pharos Production before defining the implementation work behind those records.

Code, original control wording and the added reproduction materials use MIT. Referenced external works retain their own rights. Research, implementation and packaging were AI-assisted. No independent human or legal sign-off is claimed.