Start with the decision the report supports.
A board may need to understand significant exposure and unresolved decisions, while an operational manager needs to know which actions are blocked. Define the audience, reporting period and questions before selecting metrics. Avoid presenting every available field simply because it can be counted.
Use a consistent distinction between information supplied, information reviewed and use approved. Those states describe different levels of assurance.
Explain the boundaries behind the numbers.
State which entities, departments and information sources are covered. Show important unknowns and unowned systems alongside reviewed records. A small inventory with good review coverage may still omit significant areas of AI use.
Keep definitions stable across reporting periods or explain changes. If new discovery expands the inventory, an apparent fall in completion may reflect better visibility rather than poorer governance.
Present issues with owners and next steps.
For each significant concern, explain the use case, potential consequence, current restriction and decision required. Identify the owner, dependency and evidence needed to resolve it. Separate overdue routine work from an issue that prevents responsible continued use.
- Unresolved classifications or approval conditions.
- Important supplier and evidence gaps.
- Exceptions approaching review or expiry.
- Material changes, incidents and corrective actions.
Make the summary traceable to its source.
A reviewer should be able to follow a reported issue to the underlying system record and understand when it was last updated. Use appropriate access controls when the supporting evidence is sensitive. Record decisions taken at management review and feed them back into the action process.
EUAIC can help scope the reporting structure and its supporting records. A readiness percentage is not a legal compliance score, and a polished dashboard does not replace the evidence or judgement behind the position reported.