Full implementation of an enterprise AI governance programme at Vondel Finance Group (fictional reference organisation, 2,400 employees, NL/EU, regulated financial services). The programme ran for 12 months, covered the entire AI estate, and reached EU AI Act conformity for all high-risk systems ahead of the August 2026 deadline.

• Start with the inventory, not the policy. The discovery sweep found 6 unregistered systems, including 3 vendor-embedded; classification followed immediately.
• SLAs kept governance credible. Minimal-risk clearance in <1 day; high-risk end-to-end in 22 working days against a 25-day SLA. No shadow-AI growth after month 4.
• Champions made it scale. 12 certified champions absorbed 70% of intake work; the hub focused on the 9 high-risk systems.
• Evidence drills expose the gaps. The first 24-hour drill failed on training records (LMS export missing); fixed before the real test.

A dedicated Microsoft 365 SharePoint architecture that stores every AI governance artefact with immutable versioning, retention labels and audit trails, so that any supervisory request ("show me the file for system X") is answered in hours, not weeks. Built on standard M365: SharePoint Online, Purview retention, sensitivity labels and audit (Standard/Premium).

Every artefact carries managed metadata, enabling per-system evidence retrieval in seconds:

# Retention label applied to libraries 01–08 (PowerShell, Purview)
New-RetentionCompliancePolicy -Name "AI-Governance-10Y" `
  -SharePointLocation "https://esp.sharepoint.com/sites/AI-Evidence-Vault" `
  -Enabled $true

New-RetentionComplianceRule -Policy "AI-Governance-10Y" `
  -RetentionDuration 3650 `                      # 10 years, Art. 18 / Annex IV alignment
  -RetentionComplianceAction Keep `
  -ExpirationDateOption ModificationAgeInDays

# Sensitivity label: Highly Confidential, no external sharing, audit on
Set-LabelPolicy -Identity "AI-Vault-HighlyConfidential" `
  -Settings @{BlockSend=$true; AuditEnabled=$true}

Quarterly drill: pick one random system, produce the full supervisory file. Measured result (Q2):

Extract from the enterprise AI Register (master inventory). Every row is a governed system with its classification, role, owner and lifecycle status. This register is the single source of truth referenced by intake, assessments, monitoring and board reporting.

Register extract: 10 of 47 rows shown. Fields abbreviated; production register carries 24 columns incl. data categories, affected persons, oversight owner, model version, and links to all evidence artefacts.

The system ranks external job applicants for corporate vacancies (approx. 6,500 applications/year) based on CV-text similarity to role criteria, producing a ranked shortlist for recruiter review. No automated rejection: all decisions are taken by human recruiters; the ranking is advisory input. Affected persons are job applicants (external natural persons), including potentially vulnerable groups (career starters, career switchers, international applicants with non-NL CV conventions).

• Oversight owner: Head of Talent Acquisition (named, certified); deputy: HR Ops Lead.
• Intervention rights: recruiters may re-rank, discard or override any suggestion; overrides logged with reason codes and reviewed monthly.
• Competence: all 14 recruiters completed practitioner training incl. bias awareness; refresh annually.
• Monitoring: override rate, cohort fairness metrics, and rank-outcome correlation reviewed monthly by HR + quarterly by 2nd line.

• Fairness alert > threshold → system throttled to "advisory-hidden" mode within 24h; hiring continues manually.
• Suspected discriminatory impact → incident runbook AI-IR-01; DPO + Compliance notified same day; candidate remediation path (re-review by independent recruiter).
• Serious incident determination → provider notification and regulatory reporting clocks as per AI Act Art. 73 (2/10/15 days).

Signed: AI Compliance Manager · DPO · CHRO, countersigned by CAIO, 21 May 2026. Evidence filed: Vault / 04_Assessments-FRIA-DPIA / AI-014-FRIA-v1.0.

Weighted result: 3.8 / 5 · approve with conditions

• Annex IV technical documentation package for CV Screening Assist v3.2, incl. data-governance and human-oversight sections
• EU declaration of conformity + EU-database registration extract
• GPAI provider documentation and training-data summary (per AI Act Art. 53)
• DPA + subprocessor list (all EU); ISO 27001 certificate; penetration-test executive summary
• Quarterly fairness report sample (cohort bias metrics); model-change release notes history
• Financial statements FY2024–FY2025; reference calls with 2 existing clients

1. Substantial-modification notification ≥ 30 days before deployment of model changes, with regression evidence;
2. Serious-incident reporting to deployer within 24 hours, aligned with Art. 73 clocks;
3. Quarterly fairness reports + annual independent bias audit shared in full;
4. No CV enrichment or external data scraping; audit right exercised annually;
5. Source-code/model escrow + standardised data export (CSV/JSON) within 30 days of exit;
6. EU data residency maintained; new subprocessors require prior written consent.

Next full re-assessment: April 2027, or upon any major model version, ownership change, or serious incident.

Board Audit & Risk Committee · AI governance report Q2 2026. Traffic-light view across portfolio, risk, compliance and operations.

1. Approve updated AI risk appetite (concentration threshold lowered from 4 to 3 critical processes per GPAI backend);
2. Approve budget for independent fairness audits of 2 high-risk systems (annual);
3. Note the AI-036 remediation plan and the August 2026 conformity trajectory.

Microsoft Purview configuration that protects data used by AI systems and AI governance evidence: discover sensitive data, apply sensitivity labels automatically, enforce retention on governance artefacts, and keep a defensible audit trail. Mapped to EU AI Act Art. 10 (data governance) and GDPR.

# Auto-apply "Highly Confidential - AI" on sensitive info types in AI workspaces
New-AutoSensitivityLabelPolicy -Name "AI-HC-AutoLabel" `
  -ApplySensitivityLabel "Highly Confidential - AI" `
  -SharePointLocation "https://esp.sharepoint.com/sites/AI-Evidence-Vault", `
                      "https://esp.sharepoint.com/sites/AI-TrainingData" `
  -Mode Enable

# DLP: block egress of labelled training data outside approved locations
New-DlpCompliancePolicy -Name "AI-Data-Egress-Block" `
  -SharePointLocation All -OneDriveLocation All -ExchangeLocation All -TeamsLocation All

New-DlpComplianceRule -Name "Block HC-AI external" -Policy "AI-Data-Egress-Block" `
  -ContentContainsSensitiveInformation @{Name="Highly Confidential - AI"} `
  -BlockAccess $true -NotifyUser $true `
  -GenerateAlert @("AICompliance@esp.example","DPO@esp.example")

# Who accessed Annex IV documentation for AI-014 in the last 90 days?
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) `
  -Operations FileAccessed,FileModified,FileDownloaded `
  -ObjectIds "*AI-Evidence-Vault/03_Technical-Documentation/AI-014*"

# eDiscovery case: supervisory request, full file for AI-014
New-ComplianceCase -Name "MSA-Request-AI-014" -CaseType eDiscovery
New-ComplianceSearch -Name "AI-014-FullFile" -Case "MSA-Request-AI-014" `
  -SharePointLocation "https://esp.sharepoint.com/sites/AI-Evidence-Vault" `
  -ContentMatchQuery "AI-System-ID:'AI-014'"

The end-to-end approval and operating workflow for Microsoft 365 Copilot and custom Copilot agents across the organisation: who may request one, how it is classified and approved, which controls are switched on, and how usage is monitored. Copilot deployments are registered as AI systems in the AI Register (role: deployer) with transparency measures and workspace-level data controls.