A pragmatic framework for AI governance

Most conversations about AI governance start in the wrong place. They start with a policy document, a committee and a list of things nobody is allowed to do. Six months later the policy exists, the committee meets, and staff are pasting customer data into whatever chatbot is open in their browser, because that was the only way to get their work done.

Governance that works does the opposite. It makes the safe path the easy path. The aim is not to slow AI down. The aim is to let the organisation say yes to more of it, with confidence.

Start with an inventory, not a policy

You cannot govern what you cannot see. Before writing rules, find out where AI is already being used: the tools people have signed up for, the features switched on inside software you already pay for, and the experiments running in individual teams. In almost every organisation the list is longer than leadership expects.

For each use, write down four things: what it does, what data it touches, who relies on the output, and what happens if the output is wrong. That last question does most of the work in deciding how much control a use case needs.

Tier by consequence

Not every use of AI deserves the same scrutiny. A model that drafts internal meeting notes and a model that decides which loan applications get reviewed are different animals. Treating them the same either smothers the first or under-protects the second.

• Low consequence: drafting, summarising and searching internal material. Approved tools, basic training, and a clear rule on what data may go in.
• Medium consequence: outputs customers see, or that feed decisions. A named owner, human review before anything goes out, and a way to trace what the model produced.
• High consequence: outputs that decide something about a person, money or safety. Documented testing, monitoring for drift and bias, a fallback when the system is down, and sign-off from someone accountable.

Make three decisions once

Much of the friction in AI projects comes from re-litigating the same questions on every project. Settle these three centrally and every team moves faster.

• Data: which categories of data may be sent to which kinds of model, and under what contract terms.
• Tools: a short list of approved platforms, with the configuration that makes them safe to use.
• Accountability: who owns an AI system in production, and what they are expected to watch.

Keep a human where judgement lives

Human-in-the-loop is often added as a box to tick. It is more useful to be precise about where judgement is actually needed. Put people at the points where a wrong answer is expensive or irreversible, and let the system run unattended where mistakes are cheap and easy to catch. That is how you get both safety and speed.

Review what happened, not just what was planned

Governance is not finished at launch. Look at real outputs on a schedule. Keep a simple log of incidents and near misses, and treat each one as information about where the controls need to change. The organisations that do this well are not the ones with the longest policy. They are the ones that learn fastest from what their systems actually do.

Start small: an inventory, three tiers, three central decisions, and a monthly look at real outputs. That is enough governance to say yes to AI with your eyes open, and it can grow as your use of AI grows.