Example AI Scan board memo
The format of the decision paper, system register and readiness scores.
Illustrative format
This is an example of the deliverable. It is not client work or an assessment of a real organisation.
A completed memo uses the organisation's documents and interviews. Scores, costs and recommendations depend on that evidence.
The five-page memo
- 1. DecisionThe decision requested from the board, the recommended first use case and the conditions for approval. An illustrative decision: approve a limited test of an internal policy assistant, subject to documented access controls and an agreed evaluation.
- 2. Systems and dataThe systems in scope, their owners, data categories, providers and hosting regions. Open questions are assigned to an owner. A jurisdiction map records which law can reach the data.
- 3. Readiness and dutiesThe seven readiness scores, the evidence behind each score and the gaps that block the first use case. The regulatory map names applicable duties and dates, with questions for legal review.
- 4. Options and costExternal API, European cloud and client-controlled infrastructure are compared. Each cost range states its assumptions: expected use, hardware, engineering, support and licences.
- 5. First 90 daysThe first use case, accountable owner, budget decision and success measure. A sequenced plan sets review points and conditions for continuing, changing course or stopping.
Example register entry
- SystemInternal policy assistant, illustrative example.
- Owner and useA named business owner; staff search approved internal policies.
- Data and accessDocument classification, users, retention and access controls to be confirmed.
- Provider and regionProvider, contracting entity, hosting region and sub-processors to be verified.
- Jurisdiction and dutiesApplicable law, AI Act role and risk class, GDPR basis and sector duties to be assessed.
- Evidence and next stepLinks to source documents; unanswered questions, owner and due date.
Readiness scoring method
Each of seven dimensions receives a score with evidence: strategy, data, infrastructure, jurisdiction, regulation, security and people.
- 0. UnknownEvidence is missing. The score is not treated as a pass.
- 1. IdentifiedThe issue and responsible owner are documented.
- 2. PlannedThere is an agreed action, owner and target date.
- 3. EvidencedThe requirement has supporting evidence and a review date.
This is Lindstead's assessment rubric. A score is a planning aid. It does not certify legal compliance or system safety.
Discuss the decision your board needs.
€6,500 excluding VAT. 1 legal entity, up to 10 current or planned AI systems and 4 stakeholder interviews. 10 working days from kick-off and receipt of the agreed documents.