08 / Trust & Governance
AI governance
The policies, roles and controls an organisation uses to decide where AI is used, who is accountable, and how the risks are managed.
How you’ll hear it
“Who approves a new AI use case?”
“Nobody, yet. That is the governance gap.”
Avoid
Treating governance as a document written once rather than a process that runs.
The longer version
AI governance covers the whole life of AI use: approving use cases, assessing risk, choosing providers, monitoring quality and responding when things go wrong. Done well it speeds adoption up, because teams know what is allowed and how to get a yes.
In depth
AI governance is how an organisation decides where AI may be used, who is accountable when it is, and how risk is kept in proportion to value. It is not a policy document. It is a set of decisions that have to keep being made as tools, uses and rules change.
Most organisations start in the wrong place: with a list of forbidden tools. That tends to produce shadow AI, because people keep using what helps them and stop telling anyone. Governance works better when it starts from use cases. What is this for, what data does it touch, who is affected if it goes wrong, and how will we know?
Good governance is proportionate. Drafting internal emails and screening job applicants do not deserve the same process. A light path for low-risk uses and a thorough one for high-risk uses lets adoption move quickly where it is safe and carefully where it matters.
The organisations that do this well treat governance as a service to their teams. Clear guidance, an approved set of tools and a fast route to a yes speed adoption up rather than slowing it down.
What to do
- Keep a register of where AI is used today, including the tools people already use unofficially.
- Define two or three risk tiers, each with its own approval route, rather than one process for everything.
- Name an owner for every AI use case: one accountable person, not a committee.