The main AI governance frameworks (NIST's AI Risk Management Framework, ISO/IEC 42001, OSFI Guideline E-23, the EU AI Act) are long, and they overlap. A mid-size organization mostly needs one answer from them: what does a single well-governed AI use case look like?

This guide puts that answer on one page. There are 6 elements, each with the rule or case behind it, so you can hold your own use cases up against it.

Key takeaways

• Every AI use case needs one named person who answers for its outputs. In February 2024 a BC tribunal held Air Canada responsible for what its website chatbot told a customer.

• Each use case belongs on an inventory with its purpose, data sources, approved uses, limitations, and next review date written down.

• A risk rating based on what a wrong output costs decides how much control the use case gets.

• A named human decision point and a tested off switch are in place before launch.

• Monitoring and logs let you rebuild any single decision after the fact.

• What you say publicly about your AI matches what the system does. In March 2024 the SEC settled with 2 investment advisers for a combined $400,000 over AI claims they could not support.

Example record for a fictional mid-size P&C insurer. Names and dates are illustrative.

The 6 elements

Each element maps to a dimension in Meninge’s 10-dimension governance scorecard, so you can see which part of your program it tests.

1. A named owner

Scorecard: Dim 6, Human Oversight & Accountability

One person, by name and title, answers for what the system produces. Write the name on the record.

In Moffatt v. Air Canada (February 14, 2024), the BC Civil Resolution Tribunal rejected Air Canada’s argument that its chatbot was responsible for its own statements and held the airline responsible for all information on its website. NIST’s AI Risk Management Framework asks for the same clarity in GOVERN 2.1: documented roles and responsibilities for AI risk.

Sources: ABA Business Law Today, NIST AI 100-1

2. An inventory entry

Scorecard: Dim 1, AI Inventory & System Transparency

The use case sits on a register with its purpose, data sources, approved uses, known limitations, and next review date. Include vendor tools. A Copilot rollout is a use case.

OSFI Guideline E-23 (published September 11, 2025, effective May 1, 2027) lists these fields in Appendix 1 and expects the inventory to stay current. It binds federally regulated banks and insurers. Outside that group, it is still the most detailed public checklist for an inventory entry in Canada.

Source: OSFI Guideline E-23

3. A risk rating

Scorecard: Dim 2, Risk Classification & Prioritisation

Rate the use case by what a wrong output costs: a customer payout, a credit decision, a hiring decision, a regulatory finding. The rating sets the controls: how often it gets reviewed, how deeply it gets tested, who signs off.

E-23 Principle 2.2 bases ratings on model vulnerabilities and the materiality of impacts. The EU AI Act’s Annex III high-risk list, which covers hiring, credit scoring, and life and health insurance pricing, now applies from December 2, 2027. Regulation (EU) 2026/1744 moved that date from August 2, 2026.

Sources: OSFI Guideline E-23, White & Case on Regulation (EU) 2026/1744

4. A human decision point and an off switch

Scorecard: Dim 6, Human Oversight & Accountability

Name the step where a person reviews, overrides, or stops the output, and name who can switch the system off. Test the off switch before launch and write down the date.

EU AI Act Article 14 requires high-risk systems to support effective human oversight, including the ability to interrupt the system. NIST AI RMF MANAGE 2.4 asks for mechanisms, with assigned responsibility, to supersede, disengage, or deactivate systems that perform outside their intended use.

Sources: Regulation (EU) 2024/1689, Art. 14, NIST AI 100-1

5. Monitoring and a decision trail

Scorecard: Dim 7, Incident Response & Monitoring

Track performance, input data quality, and drift on a schedule set by the risk rating. Keep inputs, outputs, and human overrides long enough to rebuild any single decision when a customer, auditor, or regulator asks.

E-23 Principle 3.6 calls for defined monitoring standards, including drift detection. EU AI Act Article 26(6) requires deployers of high-risk systems to keep automatically generated logs for at least 6 months.

Sources: OSFI Guideline E-23, Regulation (EU) 2024/1689, Art. 26

6. Public claims that match the system

Scorecard: Dim 8, Regulatory Compliance & Legal Readiness

Your website, sales deck, and investor materials describe what the system does today. Check public AI claims against the inventory entry before they go out.

On March 18, 2024, the SEC settled its first AI-washing cases: Delphia (USA) Inc. paid $225,000 and Global Predictions Inc. paid $175,000 over AI capability claims the firms could not support.

Source: Mayer Brown

Check one of your own use cases

Pick your most-used AI tool and ask for each item below. Time how long each one takes to produce. That number is a finding on its own.

• Named owner: a name and title on the record (NIST GOVERN 2.1; Moffatt v. Air Canada)

• Inventory entry: a register row with purpose, data, uses, limits, and review date (OSFI E-23 Appendix 1)

• Risk rating: the rating plus the reason for it (OSFI E-23 Principle 2.2; EU AI Act Annex III)

• Human decision point: a named step, a named person, and a dated off-switch test (EU AI Act Art. 14; NIST MANAGE 2.4)

• Monitoring and logs: the last monitoring report and one rebuilt decision (OSFI E-23 Principle 3.6; EU AI Act Art. 26(6))

• Claims match: public AI wording checked against the record (SEC settlements, March 18, 2024)

Frequently asked questions

Does this apply if we only use off-the-shelf tools like Copilot or ChatGPT?

Yes. A vendor tool used in your business is your use case. It needs an owner, an inventory entry, and a rating like anything you build. The vendor’s contract terms on data use and model changes become part of the record.

We are a Canadian company outside federally regulated finance. Which of these rules apply to us?

It depends on your sector and on where your customers and employees are. The EU AI Act reaches organizations outside the EU when a system’s output is used in the EU (Article 2). E-23 binds federally regulated financial institutions only, though its inventory fields are a sound template for anyone.

Where do we start if we have none of this?

Start with element 2. List every AI tool in use, including the ones staff adopted on their own, and put one owner’s name next to each. Ratings and controls come after you can see the full list.