Minimum pack
- Policy that applied (and the version).
- Records of use: who, which system, when, what happened downstream.
- Exceptions, including shadow AI, labelled, not omitted.
- Integrity: identifiers and a hash chain, not a freely edited sheet.
- Scope statement: which tools were in the environment.
What fails
A Copilot licence list. A ChatGPT Enterprise invoice. A screenshot of Purview. A training attendance sheet. Useful context; not evidence of use.
Where Taigris sits
The product is proof those packs are missing: customer-owned. It is not a legal opinion that the pack is sufficient in your jurisdiction.
Related