Your team started using AI tools months ago. Does anyone actually know what data is going where?If you're a founder or small SaaS team, ChatGPT, Claude, or some AI-powered plugin is probably already touching your code, your customer data, or both — without anyone formally reviewing it. This checklist gives you a structured way to find out what's actually happening, before it becomes a problem in a customer security questionnaire or a data incident.WHAT'S INCLUDED (Editable .docx checklist)Instructions section — plain-English walkthrough of how to use the checklist, no security background required20 checklist items across 5 categories: Data Handling & Vendor Terms, Access Control & Approved Tool List, Sensitive Data Exposure Prevention, Output Verification & Hallucination Risk, and Contracts, Compliance & Incident ResponseAction Plan table — turn every unchecked item into an owner and a target dateHOW IT WORKSWork through each category, checking off items only once you've verified them directly — not from memory or assumptionUse the Action Plan table to assign an owner and date to every gap you findSmall fixes (enabling a setting, writing a one-page policy) are usually same-day; bigger gaps get scoped as their own taskWHO IT'S FORStartup founders who've never formally reviewed which AI tools touch company or customer dataSaaS teams that need a real answer when a customer or investor asks about AI usageAnyone who suspects "shadow AI" tools are already in use but has no visibility into itSolo builders who want a lightweight governance pass without hiring a consultantWHY THIS TEMPLATE Built by a 20+ year IT auditor and GRC consultant who has run vendor risk and compliance reviews for Fortune 500 and healthcare clients. This is a practical starting point for structuring AI governance conversations — it is not a substitute for legal review or a formal compliance audit, and should be adapted to your organization's actual risk tolerance.FORMAT & DELIVERY Instant digital download (.docx, works in Word, Google Docs, or Pages). No physical item will be shipped. File is available immediately after purchase under "Purchases and Reviews."Due to the nature of digital products, all sales are final. If you have trouble opening or using the file, message me — happy to help.