AI Governance Quarterly Review Template (NIST AI RMF)

Quarterly governance reviews exist because compliance drift is gradual. A vendor quietly updates its model. A team member starts using an AI tool that wasn't in the register. A new state law passes with a 90-day effective date that nobody caught. None of these events trigger an alarm. They accumulate until the organization faces a regulatory inquiry or internal incident with no documentation to show.

The Q3 2026 review window runs from July 1 through September 30. The EU AI Act's general rules have applied since August 2, 2026, and the Annex III high-risk rules now start December 2, 2027. Texas TRAIGA and several other US state laws are also in effect. Running a rigorous Q3 review is no longer a best practice. It is the baseline for demonstrating compliance in any jurisdiction that applies to your operations.

This template gives you a 30-point checklist organized by the four NIST AI Risk Management Framework functions (Govern, Map, Measure, Manage), documentation guidance for safe harbor purposes, a decision tree for off-cycle reviews, and scaling guidance for organizations of different sizes.

What to review each quarter

Before working through the checklist, the review team needs four inputs: (1) the current AI inventory or register, (2) all vendor contracts involving AI or automated decision-making, (3) the incident log from the previous quarter, and (4) training completion records for anyone who works with AI systems in a material way.

If any of these four documents do not exist in a retrievable form, that fact itself is a finding. It should be recorded and assigned an owner before the checklist is started.

The scope of a quarterly review covers all AI systems currently in production, all AI systems that were retired or paused during the quarter, all new AI systems that were piloted even informally, and any changes to existing systems. "AI system" for this purpose means any automated process that makes or substantially influences a consequential decision, not only systems labeled "AI" by the vendor.

30-point Q3 2026 checklist

This checklist is organized by the four NIST AI RMF core functions. Each item maps to a specific governance activity. The "Owner" column should be filled in with a named individual, not a department.

Govern (organizational structures and policies)

Map (context and risk identification)

Measure (analysis and assessment)

Manage (response and improvement)

How to document the review for safe harbor purposes

Texas is the one US state law here that ties a defense to a recognized framework. Under TRAIGA Section 552.105(e), a company can't be found liable for a violation it discovers through an internal review process while substantially complying with the most recent NIST Generative AI Profile or another recognized AI risk framework (HB 149). A quarterly review that logs findings is that kind of process. Connecticut SB 5 has no safe harbor, but it lets the state commission or a court weigh anti-bias testing of a hiring tool in a discrimination case. Colorado SB 26-189, which applies to decisions from January 1, 2027, has no safe harbor and no impact assessment duty; it asks deployers for notices, an explanation after an adverse outcome, data correction, human review and three years of records.

To give the Texas defense something to stand on, and to answer a regulator elsewhere, the quarterly review documentation should include:

The review date, the names and titles of all participants, and the scope (which AI systems were covered). A copy of the completed checklist with each item marked and each owner named. A summary of findings, distinguishing between items that passed, items that failed, and items that are not applicable with a written justification for why. An action plan listing each finding that requires remediation, the assigned owner, and the target date.

For EU AI Act purposes, the quarterly review does not replace technical documentation under Article 11. It supplements it. The review should be stored alongside the technical documentation for each high-risk system and retained for as long as that documentation. If you're the provider, Article 18 sets 10 years after the system is placed on the market or put into service; a deployer's own duty is to keep the system's logs for at least six months (Article 26(6)).

Store the completed review in a location that can be produced in response to a regulatory request within a reasonable time frame. "Our files" is not an answer that satisfies a notified body or a state attorney general. A named folder in a document management system with access controls and version history is the minimum acceptable standard.

See the AI governance checklist 2026 for a parallel overview of the key annual governance requirements that sit above the quarterly cycle.

What triggers an off-cycle review

The quarterly schedule is not a ceiling. Off-cycle reviews should be triggered whenever a qualifying event occurs. The list below is concrete, not exhaustive.

A new AI system is deployed to production that was not on the inventory as of the last review. This includes systems where a team "tested" a tool that began influencing real decisions.

A vendor notifies you of a model update, a change to training data, or a change to pricing logic. Under the EU AI Act, provider obligations under Article 13 include notifying deployers of substantial modifications.

A company acquires or is acquired by another entity that operates AI systems. The surviving entity takes on the AI governance obligations of the acquired entity. A 60-day window is a reasonable target for completing a combined review.

A significant regulatory event occurs. December 2, 2027 was one such date. Others on the calendar include Colorado SB 26-189 applying to decisions from January 1, 2027, and Connecticut SB 5, whose first rules took effect October 1, 2026 and whose hiring-tool notices start October 1, 2027. If a new state law is signed that applies to your operations, that should trigger a review of whether your current documentation satisfies the new requirements.

An incident occurs involving an AI system that resulted in harm or a regulatory inquiry. Post-incident reviews should be completed within 30 days of the incident being closed.

A staff member who owns a high-risk AI system leaves the organization. Until a replacement owner is named and confirmed, the system is technically ungoverned. An off-cycle review within two weeks of the staff change is appropriate.

For ongoing guidance on the AI tool register template that feeds into the inventory section of this review, see the linked resource.

Who should conduct the review

The right structure depends on organizational size. These recommendations assume a for-profit entity operating in at least one regulated jurisdiction.

For a solo compliance officer or a team of fewer than five people: the review can be conducted by one person who interviews the owners of each AI system and fills in the checklist. A one-person review is not ideal, but it is better than no review. The risk is confirmation bias. Mitigate it by having a non-owner review the completed checklist before it is finalized.

For a team of 5 to 50 people with at least one dedicated compliance or legal staff member: designate a review lead from compliance or legal. Have each AI system owner fill in their relevant sections before a two-hour consolidation meeting. The meeting should produce a single agreed-upon action plan. For the AI governance guide for small teams, see the linked article for additional context on building the governance function at this size.

For a mid-size organization with 50 to 500 employees: form a quarterly review committee that includes compliance, legal, engineering, HR, and procurement. Assign pre-work. The meeting should review only the findings, not rehash items that passed without issue. Executive sign-off on the action plan is appropriate at this size.

For an enterprise: the quarterly review should be part of a formal risk management cycle. Internal audit should independently verify at least a sample of the checklist items. The action plan should be tracked in a GRC (governance, risk, and compliance) platform. Findings should be reported to the board-level AI committee if one exists.

In all cases, the Texas TRAIGA safe harbor guide lists the review records the Texas defense depends on. The law doesn't name specific NIST controls, and the Attorney General hasn't published guidance on what substantial compliance means.

Q3 2026-specific items to check

Several enforcement developments make Q3 2026 distinct from prior quarters.

The EU AI Act's Annex III high-risk rules apply from December 2, 2027, after Regulation (EU) 2026/1744 moved the date. If you deploy a system that falls under Annex III (biometrics, employment, credit, education, critical infrastructure, law enforcement, border control, or administration of justice), use this review to set a plan for the provider's conformity assessment and your own deployer duties before that date.

Maryland HB 895 bans dynamic pricing by food retailers and third-party delivery services from October 1, 2026; check any AI-assisted pricing you run for Maryland grocery or delivery customers. Connecticut SB 5's first rules (the hiring-tool no-defense rule, the WARN question and provenance data for large generators) take effect October 1, 2026, giving you a narrow window to prepare before Q3 closes.

The FTC's "AI and Your Business" guidance, issued in 2024, continues to be cited in enforcement actions. Q3 is a good moment to verify that marketing claims about AI capabilities are accurate, that data use disclosures for AI systems are current, and that bias testing records exist for any AI system used in consumer-facing decisions.

5 questions that reveal governance gaps faster than any audit

Checklists tell you what to verify. These five questions tell you whether the governance program is actually working. Ask them in any quarterly review before you start on the checklist items. If your team cannot answer them quickly and specifically, you have found the real gaps.

1. How many AI systems were added in the last quarter that weren't in the AI register at the time of use?

Shadow AI is a register problem, not just a policy problem. If the answer is "we don't know," the register process is not working. A register that only captures systems after someone thinks to add them is a historical document, not a governance tool. The correct answer to this question should be a specific number, ideally zero, with a short explanation of how you know.

2. What was the last time a model provider notified you of a model update, and how did you respond?

Vendors update models constantly, often without proactive notification to individual customers. If teams aren't reviewing model updates for risk impact, the risk assessment you completed six months ago may no longer reflect what the system actually does. A governance program that treats AI systems as static once assessed is already running behind. The answer here should include a specific date and a specific action taken, not "we monitor vendor announcements."

3. Which of your AI systems has never had a human review a sample of its outputs?

Human oversight requirements in the EU AI Act and multiple US state laws require meaningful human review, not just the technical ability to override. A system where the theoretical ability to intervene exists but nobody has actually looked at outputs in months is not meeting the spirit of those requirements. This question usually surfaces systems that passed their initial risk assessment and then went unmonitored.

4. What would happen if your primary AI vendor had an outage tomorrow?

Business continuity is an underweighted governance topic. AI tools have become load-bearing infrastructure for many teams faster than anyone planned for. If the answer is "everything stops," that is a risk to document and, for critical workflows, a risk to mitigate. The governance question is whether that dependency is visible, named, and tracked somewhere, not whether it is eliminated.

5. Has anyone filed a complaint or raised a concern about AI use in the last quarter?

Complaint mechanisms that don't produce complaints are usually mechanisms that nobody knows about or nobody trusts. Zero complaints may mean zero issues, or it may mean nobody feels safe reporting, nobody knows the channel exists, or complaints are being resolved informally and not recorded. Ask specifically whether the channel exists, where it is documented, whether employees were reminded of it in the last quarter, and what the last recorded complaint was and when.

Using this template across fiscal-year cycles

Most organizations run their governance year on a calendar-year basis, but the regulatory calendar does not align with fiscal quarters. Build two review schedules: one that covers the regulatory milestone calendar (when laws take effect, when certifications expire) and one that covers your internal fiscal quarters.

The Q3 review conducted in July-September should include a forward look at Q4 regulatory dates. In Q4 2026, the major milestone is October 1, when several Connecticut SB 5 rules took effect (the hiring-tool notices follow on October 1, 2027). Building Q4 preparation into the Q3 action plan prevents last-minute compliance scrambles.

Retain completed quarterly reviews for at least three years, or longer if your jurisdiction requires it. Under the EU AI Act, providers keep technical documentation for 10 years after a high-risk system is placed on the market or put into service (Article 18); deployers keep logs for at least six months (Article 26(6)). US state laws vary, but most enforcement statutes of limitations run two to four years, making three-year retention a reasonable floor.

Correction (October 13, 2026): An earlier version said Connecticut SB 5 references documented risk assessments and takes effect all at once on October 1. It references neither assessments nor a framework, and its dates run from October 1, 2026 to October 1, 2027.

Correction (October 16, 2026): Earlier versions said Colorado SB 26-189 takes effect February 1, 2027 and requires impact assessments for high-risk AI systems. It applies to decisions made from January 1, 2027, and it has no impact assessment duty or high-risk category (signed act).

Correction (October 16, 2026): Earlier versions said EU AI Act enforcement for high-risk AI was already active in Q3 2026 and that Maryland SB 571 on algorithmic pricing took effect July 1, 2026. The Annex III rules apply from December 2, 2027 (Regulation (EU) 2026/1744); the Maryland law we can confirm is HB 895, effective October 1, 2026 (Maryland General Assembly).

Correction (October 20, 2026): Earlier versions said Article 18 requires documentation for 10 years "after the system leaves the market." The 10 years run from when the system is placed on the market or put into service, and the duty is the provider's; deployers keep logs for at least six months (consolidated AI Act, Articles 18 and 26).

Correction (October 20, 2026): Earlier versions cited a "Section 541.152" of TRAIGA offering reduced liability for following NIST AI RMF, and said Texas regulators will examine specific NIST controls. The defense is in Section 552.105(e), names NIST's Generative AI Profile or another recognized framework, and covers violations found through internal review; no list of controls exists.

Related Reading

• AI governance checklist 2026
• AI governance guide for small teams
• Texas TRAIGA safe harbor NIST AI RMF checklist
• AI tool register template
• AI compliance checklist by team size: Tier 1 (1-10), Tier 2 (11-50), Tie
• AI Vendor Due Diligence in 30 Minutes (Questions + Scoring Sheet)