AI Risk and Governance Documentation Services
AI Governance Documentation, Written and Handed Over
AI governance documentation is the written record of how your organisation controls its AI, and Eicra Soft Limited, a Dhaka-based company, writes it for international clients at a fixed price. You get an inventory of every AI system, a risk register with owners and controls, policies for how your teams use AI, and review evidence. Our team works inside your document system, and your named owner approves every page.
Each step is a place to stop; no contract binds you to the next. We start with the AI system that would embarrass you first in an audit: the chatbot nobody registered, the vendor model with no owner, the scoring tool a customer questionnaire just asked about. What exists is inventoried, the gaps against the framework you are measured on are listed, and the first pack is defined and priced from your own figures.
You get a written verdict — an inventory first, one system’s governance pack, a policy set with owners, a law-specific pack instead of a generic one, or a quarterly review over what already exists. If nothing justifies a pack, you stop here and keep the gap review.
30 minutes 01 Scope · free call
2 weeks 02 Diagnose · $1,500 gap review, half credited
4 weeks 03 Pilot · $4,000, one system’s pack
Per system 04 Production · from $6,000 per system
Quarterly 05 Managed Ops · quarterly review, optional
What Do AI Governance Documentation Services Include?
AI governance documentation is the set of six documents that shows how your organisation controls its AI: an AI inventory, a risk register with owners and controls, a policy and procedure set, a mapping to the framework you are measured on, approval records, and a routine that keeps them true. The deliverable is files an assessor can read.
AI Inventory and Use-Case Register
Every AI system and use case is listed with purpose, users, data, vendor or model, version, owner and status. “Which AI do we use?” then takes a minute, not a meeting. Any new system or vendor tool joins the register before anyone uses it.
Risk Register With Owners and Controls
Each system’s risks are recorded with likelihood, impact, a named owner, the control against each and the review date. The language stays plain enough for your risk committee. Each entry also carries evidence that its control runs and a residual rating.
AI Policy and Procedure Set
An acceptable-use policy, a development and procurement procedure, a human-in-the-loop oversight rule and an incident and escalation procedure. Each is written for how your teams use AI, then approved and dated. Every policy names its owner and its next review date.
Mapping to Your Framework
Each document is tied to the clauses of the framework you are measured on, so a gap shows before an assessor finds it. Mapping is documentation work, not a certification. Where a law such as the EU AI Act is in scope, the mapping follows its list of required records.
Review Evidence and Approval Records
Who approved which document, when and against which version, with a change log of what changed since. This audit trail turns a policy into proof. When an assessor asks who signed off, the answer is one file, not an email search.
Maintenance and Handover
A review calendar, a change procedure and a handover session come with the pack. Your own team then keeps the files current as systems, vendors and rules change. Risks are re-rated, and approvals refreshed, whenever a system’s purpose, data or model changes.
Not included: Legal advice or legal classification · conformity assessment or certification · AI governance software or platforms; we write the documents, not the tools.
Which AI Governance Document Do You Need First?
Every AI governance documentation pack is built from four documents, and the gap review says which you lack first. The inventory says what AI exists; the risk register says what could go wrong and who owns it; the policy set says what people may do; the control record says what is in place. All four sit inside our AI assurance line, part of our wider AI services. When a system fails in use, error and incident documentation records what happened.
The National Institute of Standards and Technology (NIST) glossary states that a risk register is “a repository of risk information including the data understood about risks over time”; ours adds an owner and a control to every entry. Principles that AI governance frameworks commonly name include accountability, transparency and explainability, fairness, safety and security, privacy, and human oversight; the NIST AI Risk Management Framework sets out one such set. A pillar counts only when a document names its owner and shows how it is checked.
An AI Inventory
A register of every AI system and use case with owner, data and purpose, when nobody can say how many AI tools the company runs. It comes first because every other document refers to it, from the risk register to the policies.
A Risk Register
Risks per system with likelihood, impact, owner, control and review date, when a customer questionnaire or a board asks what could go wrong. Each entry names the harm, the owner and the control, so the answer is a signed document, not a meeting.
A Policy Set
Acceptable use, procurement, human oversight and incident procedures, when staff use AI daily and the only policy is a generic IT rule. Each policy is approved and dated by a named owner, and it then sits in your own document system.
A Control Record
Which controls exist, who runs them, and the monitoring evidence that they ran, when policies are written, but nobody can show they are followed. It turns a written policy into proof, because each control shows who runs it and when it last ran.
How Long Does an AI Governance Pilot Take?
An AI governance documentation pilot takes four weeks for one AI system and produces its full pack: scope, inventory entry, risk register, your owner’s sign-off and handover. The example is a customer-support chatbot on a vendor large language model (LLM); every item traces to a document version, an approver and a date, and yellow marks where a person signs.
| Step | Time | Price | What you receive |
|---|---|---|---|
| Scope | 30 minutes | Free | Your AI systems, owners and framework, named on a call |
| Diagnose | 2 weeks | $1,500, half credited to the pilot | An inventory, a gap review and a written pilot quote |
| Pilot | 4 weeks | $4,000, fixed | One system’s full pack, signed by your owner |
| Production | Per system | From $6,000 per system | The remaining packs, the policy set and a review calendar |
| Managed Ops | Quarterly | Optional, cancel any quarter | New systems added, risks re-rated, approvals refreshed |
Pilot log · one AI system
The pack at that step · its result
Scope signed
The system, its data and its owner, before any drafting.
| Scope item | Sample system |
|---|---|
| System | Customer-support chatbot |
| Model | Vendor LLM |
| Data sources | 3 |
| Documents | 0 existing |
| Owner | Named |
0
Existing governance documents1 system · 3 data sources · owner named
Inventory entry
The first record an assessor asks for.
PurposeRecordedUsersRecordedData3 sourcesVendor modelRecordedVersionRecordedOwnerNamed · approved
Inventory entry approvedkept in your document system
Risk register
Every risk with an owner and a control.
Logged11 risks
Rated high4 risks
Owner and controlone against each risk
11
Risks logged4 rated high · an owner and a control against each
Owner sign-off · a person signs
Your risk owner reviews the whole pack.
Inventory entryRisk registerPoliciesFramework mappingApproval records
Owner sign-off2 controls are added at review, and the approval is logged with its date.
2
Controls added at reviewapproval logged with date
Handed over
The pack stays in your own systems.
Pack approved→Your document system→Review date set→Quarterly cycle
Handed overreview date set · quarterly cycle agreed
Choose a step, or a number below, to see the pack at that stage
Every quarter the owner signs a review record, so the files stay true between audits.
Illustrative example. The yellow step is where your owner signs; each entry carries a document version, an approver and a date.
How Do AI Governance Services Work?
AI governance services with us follow five steps with an exit after each, because governance fails when it is sold as a workshop and a template: a free scoping call, a two-week inventory and gap review, a four-week pilot that writes one system’s pack, production for the remaining systems, then quarterly Managed Ops. Each step closes with signed documents.
01 30 min · free
Scope We ask which AI systems exist, who owns them, and which framework, law or customer questionnaire you are measured against. If the systems are known, a diagnostic quote follows the call.
02 2 weeks · credited
Diagnose Every AI system and use case inventoried; existing policies and records collected; gaps listed against the framework you name; the first system chosen by exposure; the pilot pack priced in writing.
03 4 weeks · fixed price
Pilot One system’s pack written: inventory entry, risk register with owners and controls, the policies that apply, framework mapping and approval records, reviewed with your owner weekly and signed on the last day.
04 Per system · quoted after pilot
Production The remaining systems in the gap review’s order, each with its own pack and approval, plus the organisation-level policy set, a review calendar and training for the people who own the files.
05 Quarterly · optional
Managed Ops A quarterly review: new systems added to the inventory, risks re-rated, policies updated as rules and vendors change, approvals refreshed, with a named documentation lead. Cancel any quarter.
Who Writes Your AI Governance Documents?
A documentation lead who owns the pack and the review calendar, an engineer who reads how each system works, and a reviewer who checks every document before your owner sees it. All three work inside your document system, and your named owner approves each version before it is final.
Communication A weekly review call and a shared Slack or Microsoft Teams channel
Delivery Drafts live in your document system and ticketing tool, not ours
Quality assurance (QA) A second reviewer on every document, with versioning and a named approver
Review calendar A review date on every file, signed by its owner each quarter
Boundary No legal advice, legal classification or certification
Ownership Every document, register and template in your name
Which AI Governance Starting Point Fits You?
The AI governance documentation that comes first depends on your situation; five questions decide it. No inventory means the inventory first; a few systems and no policies, one system’s pack as the pilot; nobody owning AI risk, owners and a policy set; a specific law, our EU AI Act documentation; everything in place, a quarterly review.
1. How many AI systems or tools are in use?
2. Is there an inventory of them?
3. Who owns AI risk today?
4. What are you being measured against?
5. Do AI-specific policies exist?
Answer Five Questions to Find Your Pack
One System’s Governance Pack as the Pilot
A few systems and no policies is the normal starting point: the most exposed system gets a full pack (inventory entry, risk register with owners and controls, the policies that apply, framework mapping and approvals) in four weeks. You then decide whether production follows.
A first estimate; the gap review confirms it.
How the verdict is decided
A specific law or standard named → the law-specific pack
No inventory → the inventory first
Nobody owns AI risk → owners and a policy set first
Complete inventory, a committee and approved policies → a quarterly review
Everything else → one system’s pack
Why Choose Us for AI Governance Documentation?
An AI governance documentation company is judged on whether its files survive the first hard question from a customer or an assessor, not on the binder’s thickness. We write registers with owners, policies with approvals and records with dates; where a law such as the EU AI Act is in scope, the files follow its list of required records.
Without Owned Documents
Staff already use AI tools daily, but the only written rule is a generic IT policy. When a customer questionnaire or an assessor asks who owns each system and which control runs, nobody can answer from a file, and the framework in the sales deck is missing from the records.
!!!!!
- A policy PDF written for another company that nobody has read
- AI tools in daily use that no register lists and nobody owns
- Risks without owners, and controls without evidence they ran
- A framework named in the sales deck and absent from the files
With Eicra Soft Limited
After the pilot, the same question has a written answer. Every AI system sits in an inventory with an owner, every risk carries a control, and every policy shows who approved which version and when. The illustrative report shows the result for one customer-support chatbot.
What the pack contains
InventoryEvery systemRisk registerOwner and control eachControlsEvidence they ranApprovalsVersion and dateReviewCalendar set
Illustrative example
- An inventory of every AI system, with owner, data and purpose
- A risk register where every entry has a control and a reviewer
- Policies written for how your teams actually use AI, approved and dated
- Approval records and review dates that answer an audit question
Is It Safe to Outsource AI Governance Documentation?
Outsourcing AI governance documentation is safe when access, approval and boundaries are settled first, because the real risk is who sees system details and who signs the documents. As a Bangladesh-based company, our writers work inside your document system under a non-disclosure agreement, read system descriptions, never production data, and give no legal advice.
Which Agreements Are Signed, and When?
Every agreement below is signed before any system description, policy draft or register reaches us. That covers a mutual NDA, a data processing agreement where personal data appears, and the transfer terms your jurisdiction names. We name a certification only when we actually hold one.
Non-disclosure agreement (NDA) — mutual, and in place before any system description, policy draft or register reaches us.
Data processing agreement (DPA) — Article 28(3) of the General Data Protection Regulation (GDPR), or your national equivalent, sets the processor terms for personal data in system records or examples.
International data transfers — personal data crosses a border only after standard contractual clauses, or the instrument your jurisdiction names, are signed.
Access — least-privilege read access to system documentation and your document system; production systems and live data stay closed to us.
Certifications — we name a certification only if we hold one; this page claims none and implies none for your organisation.
Which Ownership and Rework Terms Apply?
You own every document from the first draft, and nothing is stored on our side. A document becomes final only when your named owner approves that version. Rework is free when a document misses its agreed acceptance list within thirty days of handover.
Your accounts From the first draft, every register, policy and record sits in your document system and ticketing tool; nothing is stored on our side.
Document ownership The contract assigns you all intellectual property (IP) in documents, templates and registers; edit, reuse or hand them to another provider whenever you choose.
Boundary We draft and structure documentation; we do not give legal advice, decide legal classifications, perform conformity assessments or certify anything.
Approval A document becomes final only when your named owner approves that version, and the pack records who approved it, when and which version.
Rework Free of charge when a document fails its agreed acceptance list within thirty days of handover; new systems or frameworks are quoted first as change requests.
What AI Governance Proof Comes Before Payment?
Before you pay for AI governance documentation, you see evidence, not promises: a two-week gap review that ends in your own written plan, a pilot pack your owner approves before production is quoted, and a free 30-minute scoping call. Named client results follow once clients agree to publication.
2 weeks
For the AI inventory and gap review, ending in a written plan against the framework you name.
4 weeks
To one AI system’s full governance pack, written with your owner and signed on the last day.
30 days
After handover, any document that misses its agreed acceptance list is reworked free.
Case studies: governance results with client names appear here once each client consents. References from your industry are available on the scoping call.
What Do Buyers Ask About AI Governance Documentation?
Twelve questions buyers ask before they commission AI governance documentation, each answered in its first sentence. They cover cost, scope, framework documents, risk registers, keeping files current, the steps after you enquire, legal advice, ownership, data handling, location, switching providers and software.
What Does AI Governance Documentation Cost?
AI governance documentation services from us are priced per pack, not per hour, with every figure on the price cards above. A two-week AI inventory and gap review ends in a written plan, half credited to the pilot. One AI system’s full governance pack is then written, approved and handed over, and further systems are quoted after the pilot.
What Is AI Governance Documentation?
AI governance documentation services produce the written records that show how an organisation controls its AI: an inventory of every AI system and use case, a risk register with owners and controls, an acceptable-use and oversight policy set, a mapping to the framework you are measured on, and dated approval evidence. The deliverable is files an assessor can read.
Which Documents Make Up AI Governance?
Six, in practice. An AI inventory lists every system with owner, data and purpose, and a risk register gives likelihood, impact, owner and control per risk. Policies cover acceptable use, procurement, human oversight and incidents. A control record shows what is in place, approval records carry versions and dates, and a review calendar says when each file is re-checked.
What Should an AI Risk Register Document?
For each AI system: the risk in one sentence, the harm it could cause and to whom, a likelihood and impact rating, the named owner, the control that reduces it, evidence that the control runs, the residual rating, and the next review date. A register that lacks owners or evidence is a list of worries, not a governance record.
How Do AI Governance Files Stay Current?
Through a review calendar and a change procedure written into the pack. Any new AI system or vendor tool is added to the inventory before use, risks are re-rated when a system’s purpose, data or model changes, and policies are re-approved when rules change. Every quarter the owner signs a review record, and Managed Ops can run that cycle.
What Happens After I Book a Diagnostic?
A free 30-minute scoping call comes first, and every later step is yours to approve. No contract binds you to the next step, and if nothing justifies a pack, you stop after the gap review and keep it. The steps run in this order.
- We ask which AI systems exist, who owns them and which framework applies.
- A two-week inventory and gap review ends in a written plan and a pilot quote.
- A four-week pilot writes one system’s pack, signed by your owner.
- The remaining systems are quoted only after the pilot.
Do You Give Legal Advice?
No. We draft and structure documentation; we do not give legal advice, decide legal classifications, perform conformity assessments or certify anything. Where a law such as the EU AI Act is in scope, the files follow its list of required records, and your own counsel makes the legal calls.
Who Owns the Documents You Write?
You do, from the first draft. The contract assigns you all intellectual property in documents, templates and registers, and every file sits in your own document system and ticketing tool. Nothing is stored on our side, so you can edit, reuse or hand the files to another provider whenever you choose.
How Do You Handle Our Data?
We read system descriptions, never production data. A mutual NDA is signed before any document reaches us, a data processing agreement under Article 28(3) GDPR covers personal data in system records, and standard contractual clauses come before any transfer. Access is least-privilege read access to your documentation and document system.
Where Is Your Team Based?
Our team is based in Dhaka, Bangladesh, and works for international companies. The writers work remotely inside your own document system under a non-disclosure agreement. Personal data crosses a border only after standard contractual clauses, or the instrument your jurisdiction names, are signed, and production systems stay closed to us.
Can We Switch From Our Current Provider?
Yes. The two-week diagnostic collects the policies and records you already have and lists the gaps against your framework. The verdict may be a quarterly review over what exists rather than a rewrite. Because every file stays in your own document system, nothing has to be handed back by a provider.
Do You Sell AI Governance Software?
No. We write the documents, not the tools, so AI governance software and platforms are outside our scope, as are legal advice, conformity assessment and certification. Your documents live in the document system and ticketing tool you already use, so no new platform is needed.
Start with a free 30-minute scoping call or the two-week gap review.