Module 7: Building a Responsible AI Framework
Documentation templates
Description
Reviews and decisions produce documents. Without templates, everyone writes differently, critical info gets lost, and audits are a nightmare. Templates standardize.
This capsule gives you the 4-5 most critical templates for your Responsible AI Framework.
By the end you'll have:
- An Application Record template (per review)
- An Architecture Decision Record (ADR) template for ethics decisions
- A Risk acceptance template for documenting accepted risks
- An Incident report template for when AI ethics incidents happen
- A Change log template for system evolution
Template 1: Application Record
(From M7-05, refined)
# Ethics Checklist Application — [System] [Release/Date]
## Metadata
- **Date**: YYYY-MM-DD
- **System**: [name + version]
- **Trigger**: pre-release | model-change | use-case | post-incident | periodic
- **Reviewers**: [names + roles]
- **Checklist version**: v1.x
## Application
- **Duration**: X hours
- **Items reviewed**: 25-30
- **Status summary**: Yes / No / N/A counts
## Items by status
### Pass (Yes)
[List of items with a brief evidence link]
### Failures (No)
| Item | Critical | Reason | Owner | Target |
### N/A (skipped)
| Item | Justification |
## Decision
- [ ] APPROVED for deployment/operation
- [ ] CONDITIONALLY APPROVED (with the conditions below)
- [ ] BLOCKED until the specified items reach Yes
## Conditions (if conditional)
[List of specific items + targets]
## Sign-offs
| Role | Name | Date |
## Next review
- Triggered: [the next trigger]
- Periodic: [date]Template 2: Ethics ADR
For decisions with ethical implications:
# Ethics ADR-XXX: [Title]
## Status
- Proposed | Accepted | Rejected | Superseded by XXX
- Date: YYYY-MM-DD
## Context
[2-3 paragraphs: what decision are we making and why does it have
ethical implications?]
## Decision
[A clear statement of the decision made]
## Rationale
- **Values considered**: [from your value framework]
- **Stakeholder impact**:
- Users: [impact]
- Indirectly affected: [impact]
- Societal: [impact]
- **Alternatives considered**:
- Alt 1: [why it was rejected]
- Alt 2: [why it was rejected]
- **Trade-offs accepted**:
- We gain: [benefit]
- We sacrifice: [downside]
## Compliance check
- EU AI Act implications: [...]
- GDPR implications: [...]
- Other regulations: [...]
## Implementation
- [ ] Action 1
- [ ] Action 2
- [ ] Monitoring plan
## Reconsider if
- Condition 1
- Condition 2
## Author + reviewers
- Author: [name + role]
- Reviewers: [names + roles]
- DPO consulted: [yes/no]Example use cases
- "Should we train our model on user feedback data?"
- "Should we expand to a new demographic without separate testing?"
- "Should we implement feature X knowing it could be misused?"
Template 3: Risk Acceptance
For when risks are acknowledged but NOT mitigated:
# Risk Acceptance — [Risk Name]
## Status: ACCEPTED
- Date: YYYY-MM-DD
- Review: annual
## The risk
**Description**: [The specific risk]
**Source**: [How it was identified — the Map function, an audit, an incident]
**Severity**: Critical | High | Medium | Low
**Likelihood**: Low | Medium | High
## Why it was accepted (not mitigated)
- [Reason 1: e.g., the mitigation costs are disproportionate to the risk]
- [Reason 2: e.g., it's outside our direct control]
- [Reason 3: e.g., a trade-off with another priority]
## Compensating controls
[What we DO to reduce it — even if not fully mitigating]
- Monitoring
- A quick response plan
- Insurance / transfer
## Approval
- Risk Owner: [role + name]
- Approver: [must be senior — Tech Lead minimum, often the CTO]
- Date: YYYY-MM-DD
## Annual review
- Next review date:
- Has the likelihood/impact changed?
- Are the compensating controls still valid?
## Communication
- Communicated to: [who needs to know]
- Communicated when: [date]Template 4: AI Incident Report
For when something goes wrong:
# AI Incident Report — [Title]
## Metadata
- **Date occurred**: YYYY-MM-DD HH:MM
- **Date discovered**: YYYY-MM-DD HH:MM
- **Date resolved**: YYYY-MM-DD HH:MM
- **Severity**: P0 (critical) | P1 (high) | P2 (medium) | P3 (low)
- **Affected systems**: [list]
- **Affected users**: [count + tenants]
## Summary
[2-3 sentences: what happened]
## Timeline
| Time | Event |
|------|-------|
| HH:MM | Anomaly first detected by [monitoring/a user] |
| HH:MM | On-call paged |
| HH:MM | Incident commander assigned |
| HH:MM | Mitigation implemented |
| HH:MM | Verified resolved |
## Root cause analysis
**What went wrong**: [technical detail]
**Why it went wrong**: [a 5-whys analysis]
**Contributing factors**: [process, training, monitoring, etc.]
## Impact
- **Users affected**: number + tenants
- **Data exposed/affected**: type + scope
- **Decisions affected**: count + nature
- **Reputational impact**: an assessment
- **Legal/regulatory implications**: [A GDPR breach? An Art. 22 violation?]
## Actions taken
- Immediate (during the incident)
- Short-term (next sprint)
- Long-term (architectural changes)
## Communications
- Internal (team, leadership)
- External (affected users, regulators if required)
- Regulator notification timeline: GDPR 72h if applicable
## Lessons learned
- [Process improvements identified]
- [Monitoring gaps]
- [Training needs]
## Follow-up tickets
| Ticket | Type | Owner | Status |
## Post-mortem date
[Schedule a blameless post-mortem]Template 5: System Change Log
For tracking the AI system's evolution:
# Change Log — [System Name]
## v1.5.0 — 2026-05-15
### Changes
- Updated the LLM model from gpt-4o-mini to a new gpt-4o-mini snapshot
- Added a Linear MCP integration
- Improved bias mitigation in response generation
### Ethics review
- Checklist applied: ethics-reviews/2026-05-11.md
- Status: APPROVED with conditions
- Conditions met: ✅ 2026-05-14
### Risk register updates
- R007: status changed from "Active" to "Mitigated"
- R012: added (a new risk from the Linear integration)
### Compliance updates
- RoPA updated: 2026-05-13
- DPIA reviewed: no significant changes
- New processor (Linear): a DPA is in place
---
## v1.4.0 — 2026-04-20
[similar structure]How to use these templates in practice
Storage
/responsible-ai/
├── framework/
│ ├── checklist-v1.1.md
│ ├── policies.md
│ └── governance.md
├── reviews/
│ ├── 2026-05-11-pre-release-v1.5.md
│ ├── 2026-04-15-quarterly.md
│ └── ...
├── adrs/
│ ├── ADR-001-llm-routing.md
│ ├── ADR-002-anonymization.md
│ └── ...
├── risk-acceptances/
│ ├── RA-001-worker-displacement.md
│ └── ...
├── incidents/
│ ├── INC-2026-05-08-hallucination-billing.md
│ └── ...
└── changelog.md
Version controlled (Git). Reviews + ADRs + RAs are first-class citizens in your repo.
Discoverability
# Responsible AI Framework — Index
- [Latest checklist](framework/checklist-v1.1.md)
- [Policies](framework/policies.md)
- [All reviews](reviews/)
- [All ADRs](adrs/)
- [Risk register](framework/risk-register.md)
- [Change log](changelog.md)
- [Incidents](incidents/)One link, see everything.
Common traps
Trap 1 — Templates that are too complex. A 5-page template nobody fills in. Keep it simple — 1-2 pages per document.
Trap 2 — Templates with no enforcement. The templates exist but don't get used. CI checks, PR templates, and a definition of done help enforce them.
Trap 3 — Information silos. Reviews in Notion, ADRs in Confluence, incidents in Jira. Hard to cross-reference. Consolidate where you can.
Trap 4 — No search/discoverability. 3 years of documents and nobody can find the right one. An index + search are critical.
Trap 5 — Outdated templates. v1 templates, never updated. The regulation changed, the templates didn't.
Exercise
For your Capstone:
- Customize each template (5 templates) to your context
- Set up the file structure (paths)
- Create the first ADR for an ethical decision you've made
- Create one Risk Acceptance for a risk you've accepted
Summary
You learned:
- ✅ 5 critical templates: Application Record, ADR, Risk Acceptance, Incident Report, Change Log
- ✅ A file structure for organization
- ✅ Discoverability via an index
- ✅ Storage in Git (version controlled)
- ✅ The traps: too complex, no enforcement, silos
Checkpoint: if your team can generate these documents consistently by following the templates, you're set.
Next capsule
07 — Lightweight governance. The module's closer: how to apply all of this at a small startup without enterprise overhead.