Worked examples

Blank templates tell you what to fill in; they do not tell you what good looks like, or how much detail is expected. These are the same templates completed for one fictional company, so you can see the level of detail that makes an artefact defensible.

Deliberately imperfect

These examples include an amber board pack, a risk being tolerated, a control that was failing in practice, and an outstanding action past its owner. A worked example where everything is green teaches nothing.

Meridian Health Analytics

Meridian Health Analytics is a fictional 340-person company selling analytics software to NHS trusts and private healthcare providers in the UK and EU.

Size	340 staff; ~£42m revenue
Sector	Health technology (B2B software)
Markets	UK, Ireland, Netherlands, Germany
AI footprint	3 systems built in-house, 4 bought, 6 embedded in existing SaaS
Regulatory exposure	EU AI Act (deployer and provider), UK & EU GDPR, NHS DSPT
Governance maturity	Level 2 — documented, inconsistently applied

Meridian is deliberately mid-size and imperfect. It has a governance committee that meets but sometimes lacks quorum, an inventory that was incomplete until a discovery sweep found six embedded AI features nobody had registered, and one high-risk system — a triage prioritisation tool — that is the reason its board started asking questions.

The examples

Worked example	Illustrates
AI System Inventory — worked example	AI System Inventory
AI Risk Assessment — worked example	AI Risk Assessment
Board Pack — worked example	Board Pack Template
RACI Matrix — worked example	RACI Matrix

Not legal advice

These templates are a head start, not a substitute for professional judgement. Adapt them to your jurisdiction, sector, and risk appetite, and have qualified counsel review anything material before you rely on it.