Make the work visible
Start with an inventory of systems, owners, dependencies and intended uses. An inventory is useful when it informs a decision, so keep its fields focused and assign responsibility for updates.
Match the review to the risk
A low-impact internal assistant and a system affecting access to essential services deserve different levels of scrutiny. Use impact, exposure and reversibility to decide the depth of review. Involve qualified legal specialists when interpreting applicable obligations.
Build controls into delivery
Put review checkpoints where teams already work: design reviews, procurement, release approvals and incident processes. Give people examples and templates rather than a policy they need to interpret alone.
Review outcomes
Measure whether decisions are clearer and issues are identified earlier. Update controls when evidence shows they are ineffective or unnecessarily burdensome. Governance needs maintenance just like the systems it governs.