Capstone: build an AI governance pack for an SME

0:00 Capstone: SME governance pack

This is where everything comes together. You're going to build a complete AI governance pack for a small business: the kind of pack that answers a demanding enterprise client's AI questionnaire, meets the EU AI Act duties that apply, and still gets read by the people who have to follow it. Use your own organization, a client, or our case company, Crescent Digital, a thirty-person agency in Lahore and Dubai with clients across the Gulf, the UK and Germany.

0:34 Why build the pack

Why build a full pack instead of just reading about governance? Because the pack is what you'll actually use: to answer client questionnaires in hours instead of weeks, to onboard staff, to respond calmly to an incident, and to show regulators and partners that you take AI seriously. Building it once, properly, turns everything in this course into a reusable asset for your business or your clients.

1:03 Crescent Digital's six AI uses

Crescent Digital uses AI in six ways: generative text and images for content; a client-branded chatbot for a dental clinic group with patients in the UAE and UK; AI voice-overs, including a cloned voice of one client's founder; meeting transcription; lead scoring in its own CRM; and a pilot tool that pre-screens job applicants for its own hiring. Pause for a second and guess which of these carries the heaviest obligations. If you said the hiring pilot, you're right. It's an Annex three high-risk use.

1:40 Analogy: a fire safety file

An analogy for the capstone: think of this pack like a building's fire safety file. There's a floor plan showing where everything is, which is your inventory. There are rules for occupants, your policy and acceptable use. There are inspection records, your assessments and vendor checks. There are signs on the walls, your disclosures. There's an evacuation plan, your incident runbook. And there's a calendar of drills and inspections. An inspector expects all of it, but the real goal is that people know what to do.

2:17 Thirteen artifacts

Your pack has thirteen artifacts, and you've already built drafts of most of them in earlier lessons. A signed AI policy. A traffic-light acceptable-use page and approved tools list. A RACI. The AI inventory with classifications and risk scores. A jurisdiction register. Impact assessments for anything above your threshold. Vendor due diligence records. A disclosure procedure and synthetic asset register. A data protection addendum. An AI literacy plan. An incident runbook. A compliance calendar. And a framework mapping to NIST, ISO and the AI Act.

2:54 Steps 1 and 2

Step one, inventory and classify. For Crescent, the dental chatbot needs chatbot disclosure for UK and EU exposure and careful data protection, because patients may mention health details. The founder's voice clone is a deepfake wherever EU audiences see it, so disclose it and keep written consent. The hiring pre-screen is high-risk, with deployer duties from December twenty twenty-seven and automated decision rules already in force. Step two: decide what's out of bounds. And here's a mature governance move: a small agency might decide the hiring pilot isn't worth the governance cost and stop it. That's a legitimate outcome.

3:37 Steps 3 to 6

Steps three to six. Draft the policy, acceptable use and RACI with AI help, edit them to match reality, and get leadership to sign. Complete combined impact assessments for the dental chatbot and, if you continue it, the hiring tool, including data protection modules. Send questionnaires to the chatbot platform, transcription, voice and hiring vendors. Then write the disclosure procedure with approved wording in English and Arabic, set up the synthetic asset register, document lawful bases and retention, and finalize the literacy plan.

4:13 Step 7: incident runbook

Step seven is the incident runbook and calendar. The runbook defines what counts as an AI incident: harmful or false output reaching a client or the public, data exposed through an AI tool, an AI system acting outside its permissions, a missing disclosure, a bias or deception complaint, or a vendor security incident. Then five moves: contain within an hour, assess within four, notify the right people, including the privacy lead and, where required, the data protection authority within seventy-two hours, fix the root cause with a regression test, and learn within ten working days.

4:54 Quality checklist

Before you submit, run the quality checklist. Every inventory entry has an owner, a reasoned classification, and a review date. Any Annex three use has a plan dated before December twenty twenty-seven, or a documented decision to stop. Every chatbot and voice agent has tested disclosure wording. Every real-person likeness has a consent record. Every significant vendor has a questionnaire and processing agreement. The pack says clearly it isn't legal advice and lists items to confirm with counsel. And it's short enough that leadership will actually read it: aim for under thirty pages plus registers.

5:35 Common mistakes

Common mistakes in capstone packs. Writing for an imaginary company instead of documenting what actually happens. Producing sixty pages that leadership will never read, when twenty focused pages plus registers is better. Skipping the decisions: a pack that lists risks but asks leadership for nothing hasn't done its job. And forgetting the maintenance plan: without owners, review dates and a calendar, the pack is out of date within a quarter.

6:05 Presenting to leadership

A final tip for presenting: lead with the heat map and one sentence per risk, not with the law. Leaders respond to: here's what we use, here's where the real risk is, here's what we're doing, and here's what we need from you. Keep the legal detail in the appendix for anyone who wants it. Then ask for one or two clear decisions, and schedule the next review before you leave the room.

6:37 Watch me do it: the pack front page

Watch me do it. I open the governance pack folder for Crescent Digital and assemble the front page, which is the only page most leaders will read. At the top: a heat map built from the register's risk scores. The hiring pre-screen sits top right, the dental chatbot and the founder voice clone sit in the middle, content tools bottom left. Below it, three risk sentences. One: the hiring pilot is high-risk, with deployer duties from December twenty twenty-seven and automated-decision rules already live. Two: the dental chatbot may receive health details, so it needs disclosure, minimization and a no clinical advice rule. Three: the voice clone needs signed consent and a disclosure line, both now done. Then the decisions box: continue or stop the hiring pilot, and approve the literacy plan budget. Then the next three calendar dates. Finally, the index: thirteen artifacts, each with a link, an owner and a review date, and one line stating that this pack is not legal advice, with two items listed for counsel. One page, and every claim on it links to evidence behind it.

7:57 Present and decide

Finally, present it. Prepare a ten-minute leadership briefing: the inventory heat map, the three biggest risks and what you're doing about them, the decisions you need from leadership, like whether to continue the hiring pilot, and the calendar. Governance succeeds when leaders make informed decisions, not when documents exist. That's the course. You can now read the EU AI Act with confidence, use NIST and ISO frameworks, navigate the UK, US, Gulf and Pakistan, and build a practical governance pack. Go build yours.