AI governance articles

Governance has a bad name in small companies because most of what is sold under that name is written for a bank. A three hundred person company does not need a committee, a maturity model or a consultant to run a workshop. It needs four things that fit on a shared drive and get updated when something changes.

The first is a register: every AI system in use, who owns it, what data reaches it. It also records whether a person checks its output before a customer sees it. Companies usually find more AI in the building than they expected, because someone signed up for a tool with a credit card and nobody wrote it down.

The second is an acceptable-use policy short enough that people read it. One page. What you may paste into a chat window, what you may not, and who to ask when the answer is unclear. A policy that requires a training course to understand is a policy that gets ignored by the people whose behaviour it was written to change.

The third is a data classification table. Three or four tiers, each with a rule about which vendors may see that tier. This is the document that answers most of a customer security questionnaire. It is also the one companies most often skip, because it requires a decision rather than a description.

The fourth is a named owner: one person whose job description says they own AI risk and who has the authority to stop a launch. Frameworks like ISO/IEC 42001 and the NIST AI Risk Management Framework both assume this person exists. Without them, every answer in a questionnaire is a guess, and every incident becomes a search for who should have been watching.

That is the whole set. It takes about two weeks to produce honestly, and the honest version is worth more than a thorough version that describes a company you are not. A customer may ask who owns AI risk. A board may ask what happens if a model leaks a document. Either way, you want to answer from a document that was true last week, not one that was impressive last year.