- Template version
- AGK-001 v1.0
- Format
- Word · 23 KB
- Used by
- AI sponsor, AI Governance Lead
- When
- Week 1, before anything else
- Document type
- Framework (Reference)
- Owner
- [AI Governance Lead]
- Approved by
- [AI Governance Committee]
- Review cycle
- Annual
- Parent document(s)
- AGK-000
- Adoption tier
- Lite: Required · Standard: Optional · Regulated: Optional
1. Who this is for
The Lite tier gives a small or mid-sized organisation a safe, credible start with AI in about [90 days], without a governance team. It covers the things that cause most early problems: staff using personal AI accounts, sensitive data pasted into AI tools, AI features switched on without anyone deciding, and nobody knowing what to do when something goes wrong.
| You are probably Lite if… | Move to Standard when… |
|---|---|
|
Up to about [250] staff Using vendor AI assistants and AI features in existing software No AI systems built in-house, or only simple internal assistants Not regulated by BNM, MAS or a health regulator |
You enable AI agents that act (write connectors, browser agents) for many users You build AI agents or customer-facing AI You are regulated, or a major customer asks for ISO/IEC 42001 alignment You have more than [250] staff using AI |
2. The Lite set
Lite adopters implement 53 controls in total: 39 that apply from day one, and 14 that apply once connectors, browser agents or shared skills are switched on. All of them are listed in Section 6.
| Status | Documents |
|---|---|
| Adopt now | AGK-000 Framework · AGK-001 (this guide) · AGK-POL-02 Acceptable Use Policy + AGK-TPL-07 acknowledgement · AGK-STD-A02 Data Handling · AGK-GDL-A01 Safe AI Use Guide (English and Bahasa Malaysia) · AGK-PRC-07 AI Discovery · AGK-GDL-C02 Adoption Roadmap + AGK-TPL-12 Use-Case Tracker · AGK-TPL-01 AI System Register · AGK-TPL-03 Intake Form · AGK-TPL-06 Incident Log |
| Adopt now, condensed | AGK-POL-01 Charter · AGK-POL-03 Risk & Data Policy · AGK-PRC-01 Intake · AGK-PRC-04 Incident Response · AGK-STD-C01 Training · AGK-STD-A01 Platform Baseline · AGK-GDL-C03 Change & Communication |
| When the feature is switched on | AGK-STD-A03 Connectors · AGK-STD-A04 Browser & Computer Use · AGK-STD-A05 Skills & Instructions · AGK-PRC-A01 Connector Requests · AGK-TPL-02 Connector Registry |
| One per platform used | Vendor Annex (AGK-ANX-C, O, M or G) |
| Later or optional | Risk & vendor assessment in full, periodic review, red-teaming, transparency, platform selection, Track B, and the remaining templates |
3. Roles for a small organisation
| Role | Who it usually is | Time |
|---|---|---|
| AI sponsor | CEO, COO or another executive who owns the AI agenda | [1 hour / month] |
| AI Governance Lead | Operations, IT or risk manager | [0.5–1 day / week] in the first 90 days, then [0.5 day / week] |
| AI Platform Administrator | IT administrator for the AI platform | [0.5 day / week] |
| Data Protection Officer | Existing DPO under PDPA | [2 hours / month], more during incidents |
| AI Governance Committee | CEO or AI sponsor, AI Governance Lead (or tech lead) and DPO (3 people), per AGK-POL-01 | [1 hour / month] in the first 90 days, then [quarterly] |
| AI champions | One volunteer per team (see AGK-GDL-C03) | [2 hours / month] |
4. First 90 days
| When | Step | Output |
|---|---|---|
| Week 1 | Name the AI sponsor, AI Governance Lead and committee. Agree the risk appetite in one paragraph. | Condensed AGK-POL-01 |
| Weeks 1–2 | Find the AI already in use: survey, expense data, network and SaaS discovery. Announce a [30-day] amnesty. | AGK-PRC-07; AGK-TPL-01 populated |
| Week 2 | Approve the Acceptable Use Policy and data rules. Launch the safe-use guide; every user acknowledges before access. | AGK-POL-02; AGK-STD-A02; AGK-GDL-A01; AGK-TPL-07 |
| Weeks 2–3 | Configure the approved AI platform to the baseline using its Vendor Annex. Block personal accounts on company devices. | AGK-STD-A01; AGK-ANX-* |
| Weeks 3–4 | Communicate: key messages, FAQ, champions, the channel for concerns. | AGK-GDL-C03 |
| Weeks 3–4 | Fundamentals training for all users. | AGK-STD-C01 |
| Weeks 4–6 | Run a use-case workshop; score ideas; pick [2–3] quick wins to pilot. | AGK-GDL-C02; AGK-TPL-12 |
| Weeks 4–6 | Set up intake and the incident log; agree who to call and the 72-hour breach clock. | AGK-PRC-01; AGK-PRC-04; AGK-TPL-03; AGK-TPL-06 |
| Weeks 6–12 | Pilot, measure benefits, decide what to scale. Adopt connector or browser standards before enabling those features. | AGK-TPL-12; AGK-STD-A03 / A04 if needed |
| Day 90 | Committee review: what is in use, incidents, benefits, next quarter. | Minutes; updated register |
The remaining 2 sections are in the download
You have read about 26% of this document. The editable Word file comes with the free Lite pack.
Get the full document