Módulo 7: Building a Responsible AI Framework
Documentation templates
Descripción
Reviews y decisions producen documents. Sin templates, cada uno escribe distinto, info crítica se pierde, audit es pesadilla. Templates standardizan.
Esta cápsula te da los 4-5 templates más críticos para tu Responsible AI Framework.
Al terminar tendrás:
- Application Record template (per review)
- Architecture Decision Record (ADR) template for ethics decisions
- Risk acceptance template when documenting accepted risks
- Incident report template when AI ethics incidents happen
- Change log template for system evolution
Template 1: Application Record
(De M7-05, refinado)
# Ethics Checklist Application — [System] [Release/Date]
## Metadata
- **Date**: YYYY-MM-DD
- **System**: [name + version]
- **Trigger**: pre-release | model-change | use-case | post-incident | periodic
- **Reviewers**: [names + roles]
- **Checklist version**: v1.x
## Application
- **Duration**: X hours
- **Items reviewed**: 25-30
- **Status summary**: Yes / No / N/A counts
## Items by status
### Pass (Yes)
[List items with brief evidence link]
### Failures (No)
| Item | Critical | Reason | Owner | Target |
### N/A (skipped)
| Item | Justification |
## Decision
- [ ] APPROVED for deployment/operation
- [ ] CONDITIONALLY APPROVED (with conditions below)
- [ ] BLOCKED until specified items reach Yes
## Conditions (if conditional)
[List specific items + targets]
## Sign-offs
| Role | Name | Date |
## Next review
- Triggered: [next trigger]
- Periodic: [date]Template 2: Ethics ADR
For decisions con ethical implications:
# Ethics ADR-XXX: [Title]
## Status
- Proposed | Accepted | Rejected | Superseded by XXX
- Date: YYYY-MM-DD
## Context
[2-3 paragraphs: what decision are we making and why does it have
ethical implications?]
## Decision
[Clear statement of decision made]
## Rationale
- **Values considered**: [from your value framework]
- **Stakeholder impact**:
- Users: [impact]
- Indirect affected: [impact]
- Societal: [impact]
- **Alternatives considered**:
- Alt 1: [why rejected]
- Alt 2: [why rejected]
- **Trade-offs accepted**:
- We gain: [benefit]
- We sacrifice: [downside]
## Compliance check
- EU AI Act implications: [...]
- GDPR implications: [...]
- Other regulations: [...]
## Implementation
- [ ] Action 1
- [ ] Action 2
- [ ] Monitoring plan
## Reconsider if
- Condition 1
- Condition 2
## Author + reviewers
- Author: [name + role]
- Reviewers: [names + roles]
- DPO consulted: [yes/no]Example use cases
- "Should we train our model on user feedback data?"
- "Should we expand to a new demographic without separate testing?"
- "Should we implement feature X knowing it could be misused?"
Template 3: Risk Acceptance
When risks are acknowledged but NOT mitigated:
# Risk Acceptance — [Risk Name]
## Status: ACCEPTED
- Date: YYYY-MM-DD
- Review: annual
## The risk
**Description**: [Specific risk]
**Source**: [How identified — Map function, audit, incident]
**Severity**: Critical | High | Medium | Low
**Likelihood**: Low | Medium | High
## Why accepted (not mitigated)
- [Reason 1: e.g., mitigation costs disproportionate to risk]
- [Reason 2: e.g., outside our direct control]
- [Reason 3: e.g., trade-off with another priority]
## Compensating controls
[What we DO to reduce — even if not fully mitigating]
- Monitoring
- Quick response plan
- Insurance / transfer
## Approval
- Risk Owner: [role + name]
- Approver: [must be senior — Tech Lead minimum, often CTO]
- Date: YYYY-MM-DD
## Annual review
- Next review date:
- Has likelihood/impact changed?
- Are compensating controls still valid?
## Communication
- Communicated to: [who needs to know]
- Communicated when: [date]Template 4: AI Incident Report
When something goes wrong:
# AI Incident Report — [Title]
## Metadata
- **Date occurred**: YYYY-MM-DD HH:MM
- **Date discovered**: YYYY-MM-DD HH:MM
- **Date resolved**: YYYY-MM-DD HH:MM
- **Severity**: P0 (critical) | P1 (high) | P2 (medium) | P3 (low)
- **Affected systems**: [list]
- **Affected users**: [count + tenants]
## Summary
[2-3 sentences: what happened]
## Timeline
| Time | Event |
|------|-------|
| HH:MM | Anomaly first detected by [monitoring/user] |
| HH:MM | On-call paged |
| HH:MM | Incident commander assigned |
| HH:MM | Mitigation implemented |
| HH:MM | Verified resolved |
## Root cause analysis
**What went wrong**: [technical detail]
**Why it went wrong**: [5-whys analysis]
**Contributing factors**: [process, training, monitoring, etc.]
## Impact
- **Users affected**: number + tenants
- **Data exposed/affected**: type + scope
- **Decisions affected**: count + nature
- **Reputational impact**: assessment
- **Legal/regulatory implications**: [GDPR breach? Art. 22 violation?]
## Actions taken
- Immediate (during incident)
- Short-term (next sprint)
- Long-term (architectural changes)
## Communications
- Internal (team, leadership)
- External (affected users, regulators if required)
- Regulator notification timeline: GDPR 72h if applicable
## Lessons learned
- [Process improvements identified]
- [Monitoring gaps]
- [Training needs]
## Follow-up tickets
| Ticket | Type | Owner | Status |
## Post-mortem date
[Schedule blameless post-mortem]Template 5: System Change Log
For tracking AI system evolution:
# Change Log — [System Name]
## v1.5.0 — 2026-05-15
### Changes
- Updated LLM model from gpt-4o-mini to new gpt-4o-mini snapshot
- Added Linear MCP integration
- Improved bias mitigation in response generation
### Ethics review
- Checklist applied: ethics-reviews/2026-05-11.md
- Status: APPROVED with conditions
- Conditions met: ✅ 2026-05-14
### Risk register updates
- R007: status changed from "Active" to "Mitigated"
- R012: added (new risk from Linear integration)
### Compliance updates
- RoPA updated: 2026-05-13
- DPIA reviewed: no significant changes
- New processor (Linear): DPA in place
---
## v1.4.0 — 2026-04-20
[similar structure]Cómo usar estos templates en practice
Storage
/responsible-ai/
├── framework/
│ ├── checklist-v1.1.md
│ ├── policies.md
│ └── governance.md
├── reviews/
│ ├── 2026-05-11-pre-release-v1.5.md
│ ├── 2026-04-15-quarterly.md
│ └── ...
├── adrs/
│ ├── ADR-001-llm-routing.md
│ ├── ADR-002-anonymization.md
│ └── ...
├── risk-acceptances/
│ ├── RA-001-worker-displacement.md
│ └── ...
├── incidents/
│ ├── INC-2026-05-08-hallucination-billing.md
│ └── ...
└── changelog.md
Version controlled (Git). Reviews + ADRs + RAs are first-class citizens en your repo.
Discoverability
# Responsible AI Framework — Index
- [Latest checklist](framework/checklist-v1.1.md)
- [Policies](framework/policies.md)
- [All reviews](reviews/)
- [All ADRs](adrs/)
- [Risk register](framework/risk-register.md)
- [Change log](changelog.md)
- [Incidents](incidents/)One link, see everything.
Trampas comunes
Trampa 1 — Templates demasiado complejos. Template de 5 pages que nadie llena. Mantén simple — 1-2 pages per document.
Trampa 2 — Templates sin enforcement. Templates existen but no se usan. CI checks, PR templates, definition of done help enforce.
Trampa 3 — Information silos. Reviews en Notion, ADRs en Confluence, incidents en Jira. Hard to cross-reference. Consolidá donde posible.
Trampa 4 — Sin search/discoverability. 3 años de documents, nadie encuentra el correcto. Index + search críticos.
Trampa 5 — Templates outdated. v1 templates, never updated. Regulation changed, templates didn't.
Ejercicio
Para tu Capstone:
- Customize cada template (5 templates) a your context
- Setup file structure (paths)
- Create the first ADR for an ethical decision you've made
- Create one Risk Acceptance for a risk you've accepted
Resumen
Aprendiste:
- ✅ 5 templates críticos: Application Record, ADR, Risk Acceptance, Incident Report, Change Log
- ✅ File structure for organization
- ✅ Discoverability via index
- ✅ Storage en Git (version controlled)
- ✅ Trampas: too complex, no enforcement, silos
Checkpoint: si tu team puede generar these documents consistently siguiendo templates, listo.
Siguiente cápsula
07 — Governance light. Cierre del module: cómo aplicar todo esto en startup pequeño sin enterprise overhead.