AI governance documentation is the written record of how your organisation controls its AI, and Eicra Soft Limited, a Dhaka-based company, writes it for international clients at a fixed price. You get an inventory of every AI system, a risk register with owners and controls, policies for how your teams use AI, and review evidence. Our team works inside your document system, and your named owner approves every page.
Each step is a place to stop; no contract binds you to the next. We start with the AI system that would embarrass you first in an audit: the chatbot nobody registered, the vendor model with no owner, the scoring tool a customer questionnaire just asked about. What exists is inventoried, the gaps against the framework you are measured on are listed, and the first pack is defined and priced from your own figures.
You get a written verdict — an inventory first, one system’s governance pack, a policy set with owners, a law-specific pack instead of a generic one, or a quarterly review over what already exists. If nothing justifies a pack, you stop here and keep the gap review.
AI governance documentation is the set of six documents that shows how your organisation controls its AI: an AI inventory, a risk register with owners and controls, a policy and procedure set, a mapping to the framework you are measured on, approval records, and a routine that keeps them true. The deliverable is files an assessor can read.
Every AI system and use case is listed with purpose, users, data, vendor or model, version, owner and status. “Which AI do we use?” then takes a minute, not a meeting. Any new system or vendor tool joins the register before anyone uses it.
Each system’s risks are recorded with likelihood, impact, a named owner, the control against each and the review date. The language stays plain enough for your risk committee. Each entry also carries evidence that its control runs and a residual rating.
An acceptable-use policy, a development and procurement procedure, a human-in-the-loop oversight rule and an incident and escalation procedure. Each is written for how your teams use AI, then approved and dated. Every policy names its owner and its next review date.
Each document is tied to the clauses of the framework you are measured on, so a gap shows before an assessor finds it. Mapping is documentation work, not a certification. Where a law such as the EU AI Act is in scope, the mapping follows its list of required records.
Who approved which document, when and against which version, with a change log of what changed since. This audit trail turns a policy into proof. When an assessor asks who signed off, the answer is one file, not an email search.
A review calendar, a change procedure and a handover session come with the pack. Your own team then keeps the files current as systems, vendors and rules change. Risks are re-rated, and approvals refreshed, whenever a system’s purpose, data or model changes.
Every AI governance documentation pack is built from four documents, and the gap review says which you lack first. The inventory says what AI exists; the risk register says what could go wrong and who owns it; the policy set says what people may do; the control record says what is in place. All four sit inside our AI assurance line, part of our wider AI services. When a system fails in use, error and incident documentation records what happened.
The National Institute of Standards and Technology (NIST) glossary states that a risk register is “a repository of risk information including the data understood about risks over time”; ours adds an owner and a control to every entry. Principles that AI governance frameworks commonly name include accountability, transparency and explainability, fairness, safety and security, privacy, and human oversight; the NIST AI Risk Management Framework sets out one such set. A pillar counts only when a document names its owner and shows how it is checked.
A register of every AI system and use case with owner, data and purpose, when nobody can say how many AI tools the company runs. It comes first because every other document refers to it, from the risk register to the policies.
Risks per system with likelihood, impact, owner, control and review date, when a customer questionnaire or a board asks what could go wrong. Each entry names the harm, the owner and the control, so the answer is a signed document, not a meeting.
Acceptable use, procurement, human oversight and incident procedures, when staff use AI daily and the only policy is a generic IT rule. Each policy is approved and dated by a named owner, and it then sits in your own document system.
Which controls exist, who runs them, and the monitoring evidence that they ran, when policies are written, but nobody can show they are followed. It turns a written policy into proof, because each control shows who runs it and when it last ran.
An AI governance documentation pilot takes four weeks for one AI system and produces its full pack: scope, inventory entry, risk register, your owner’s sign-off and handover. The example is a customer-support chatbot on a vendor large language model (LLM); every item traces to a document version, an approver and a date, and yellow marks where a person signs.
| Step | Time | Price | What you receive |
|---|---|---|---|
| Scope | 30 minutes | Free | Your AI systems, owners and framework, named on a call |
| Diagnose | 2 weeks | $1,500, half credited to the pilot | An inventory, a gap review and a written pilot quote |
| Pilot | 4 weeks | $4,000, fixed | One system’s full pack, signed by your owner |
| Production | Per system | From $6,000 per system | The remaining packs, the policy set and a review calendar |
| Managed Ops | Quarterly | Optional, cancel any quarter | New systems added, risks re-rated, approvals refreshed |
Pilot log · one AI system
The pack at that step · its result
Scope signed
The system, its data and its owner, before any drafting.
| Scope item | Sample system |
|---|---|
| System | Customer-support chatbot |
| Model | Vendor LLM |
| Data sources | 3 |
| Documents | 0 existing |
| Owner | Named |
Inventory entry
The first record an assessor asks for.
Risk register
Every risk with an owner and a control.
Owner sign-off · a person signs
Your risk owner reviews the whole pack.
Handed over
The pack stays in your own systems.
Choose a step, or a number below, to see the pack at that stage
Every quarter the owner signs a review record, so the files stay true between audits.
Illustrative example. The yellow step is where your owner signs; each entry carries a document version, an approver and a date.
AI governance services with us follow five steps with an exit after each, because governance fails when it is sold as a workshop and a template: a free scoping call, a two-week inventory and gap review, a four-week pilot that writes one system’s pack, production for the remaining systems, then quarterly Managed Ops. Each step closes with signed documents.
A documentation lead who owns the pack and the review calendar, an engineer who reads how each system works, and a reviewer who checks every document before your owner sees it. All three work inside your document system, and your named owner approves each version before it is final.
The AI governance documentation that comes first depends on your situation; five questions decide it. No inventory means the inventory first; a few systems and no policies, one system’s pack as the pilot; nobody owning AI risk, owners and a policy set; a specific law, our EU AI Act documentation; everything in place, a quarterly review.
1. How many AI systems or tools are in use?
2. Is there an inventory of them?
3. Who owns AI risk today?
4. What are you being measured against?
5. Do AI-specific policies exist?
A few systems and no policies is the normal starting point: the most exposed system gets a full pack (inventory entry, risk register with owners and controls, the policies that apply, framework mapping and approvals) in four weeks. You then decide whether production follows.
A first estimate; the gap review confirms it.
How the verdict is decided
An AI governance documentation company is judged on whether its files survive the first hard question from a customer or an assessor, not on the binder’s thickness. We write registers with owners, policies with approvals and records with dates; where a law such as the EU AI Act is in scope, the files follow its list of required records.
Staff already use AI tools daily, but the only written rule is a generic IT policy. When a customer questionnaire or an assessor asks who owns each system and which control runs, nobody can answer from a file, and the framework in the sales deck is missing from the records.
After the pilot, the same question has a written answer. Every AI system sits in an inventory with an owner, every risk carries a control, and every policy shows who approved which version and when. The illustrative report shows the result for one customer-support chatbot.
Outsourcing AI governance documentation is safe when access, approval and boundaries are settled first, because the real risk is who sees system details and who signs the documents. As a Bangladesh-based company, our writers work inside your document system under a non-disclosure agreement, read system descriptions, never production data, and give no legal advice.
Every agreement below is signed before any system description, policy draft or register reaches us. That covers a mutual NDA, a data processing agreement where personal data appears, and the transfer terms your jurisdiction names. We name a certification only when we actually hold one.
You own every document from the first draft, and nothing is stored on our side. A document becomes final only when your named owner approves that version. Rework is free when a document misses its agreed acceptance list within thirty days of handover.
Before you pay for AI governance documentation, you see evidence, not promises: a two-week gap review that ends in your own written plan, a pilot pack your owner approves before production is quoted, and a free 30-minute scoping call. Named client results follow once clients agree to publication.
For the AI inventory and gap review, ending in a written plan against the framework you name.
To one AI system’s full governance pack, written with your owner and signed on the last day.
After handover, any document that misses its agreed acceptance list is reworked free.
Twelve questions buyers ask before they commission AI governance documentation, each answered in its first sentence. They cover cost, scope, framework documents, risk registers, keeping files current, the steps after you enquire, legal advice, ownership, data handling, location, switching providers and software.
More answersAI governance documentation services from us are priced per pack, not per hour, with every figure on the price cards above. A two-week AI inventory and gap review ends in a written plan, half credited to the pilot. One AI system’s full governance pack is then written, approved and handed over, and further systems are quoted after the pilot.
AI governance documentation services produce the written records that show how an organisation controls its AI: an inventory of every AI system and use case, a risk register with owners and controls, an acceptable-use and oversight policy set, a mapping to the framework you are measured on, and dated approval evidence. The deliverable is files an assessor can read.
Six, in practice. An AI inventory lists every system with owner, data and purpose, and a risk register gives likelihood, impact, owner and control per risk. Policies cover acceptable use, procurement, human oversight and incidents. A control record shows what is in place, approval records carry versions and dates, and a review calendar says when each file is re-checked.
For each AI system: the risk in one sentence, the harm it could cause and to whom, a likelihood and impact rating, the named owner, the control that reduces it, evidence that the control runs, the residual rating, and the next review date. A register that lacks owners or evidence is a list of worries, not a governance record.
Through a review calendar and a change procedure written into the pack. Any new AI system or vendor tool is added to the inventory before use, risks are re-rated when a system’s purpose, data or model changes, and policies are re-approved when rules change. Every quarter the owner signs a review record, and Managed Ops can run that cycle.
A free 30-minute scoping call comes first, and every later step is yours to approve. No contract binds you to the next step, and if nothing justifies a pack, you stop after the gap review and keep it. The steps run in this order.
No. We draft and structure documentation; we do not give legal advice, decide legal classifications, perform conformity assessments or certify anything. Where a law such as the EU AI Act is in scope, the files follow its list of required records, and your own counsel makes the legal calls.
You do, from the first draft. The contract assigns you all intellectual property in documents, templates and registers, and every file sits in your own document system and ticketing tool. Nothing is stored on our side, so you can edit, reuse or hand the files to another provider whenever you choose.
We read system descriptions, never production data. A mutual NDA is signed before any document reaches us, a data processing agreement under Article 28(3) GDPR covers personal data in system records, and standard contractual clauses come before any transfer. Access is least-privilege read access to your documentation and document system.
Our team is based in Dhaka, Bangladesh, and works for international companies. The writers work remotely inside your own document system under a non-disclosure agreement. Personal data crosses a border only after standard contractual clauses, or the instrument your jurisdiction names, are signed, and production systems stay closed to us.
Yes. The two-week diagnostic collects the policies and records you already have and lists the gaps against your framework. The verdict may be a quarterly review over what exists rather than a rewrite. Because every file stays in your own document system, nothing has to be handed back by a provider.
No. We write the documents, not the tools, so AI governance software and platforms are outside our scope, as are legal advice, conformity assessment and certification. Your documents live in the document system and ticketing tool you already use, so no new platform is needed.
Start with a free 30-minute scoping call or the two-week gap review.
Request A QuoteBook a DiagnosticYour request is subject to our Terms and Privacy Policy.
