AI Governance

AI governance is the set of decisions, roles and records an organisation uses to control where AI is applied, on what data, with what oversight, and who is answerable when it goes wrong. It is not a document. A policy is one artefact inside it, alongside an inventory of the systems in use, a way of grading them by risk, a review step before something new goes live, and evidence afterwards that all of that actually happened. The reason it exists at this scale is that AI capability entered most companies sideways. Software procurement has decades of controls around it; a team pasting customer records into a chat interface has none, and the same team can ship a feature built on a model in an afternoon. Governance is the attempt to give that activity the same accountability that a database migration or a payment integration already has, without stopping it. The pieces that make it real are unglamorous. Someone owns the programme. There is a list of the AI systems in use, both bought and built, that is maintained rather than compiled once. Uses are graded so that low-stakes drafting is not treated like automated decisions about people. High-risk uses get a named human accountable for their outputs. Changes to models and prompts are versioned, and there is a route for reporting when something produces a wrong or harmful result. The common failure is governance that only exists on paper. A policy nobody can find, an inventory that stopped being updated after the first pass, an approval process slow enough that teams route around it. Each of those converts governance into shadow AI, because the work does not stop when the process is inconvenient — it just stops being visible. The test of whether a programme is working is whether it can answer specific questions quickly. Where is AI used in the customer-facing product? What data reaches which vendor? Which prompt version was live when this complaint was raised? Who signed off on this use case? An organisation that can answer those from records rather than from memory has governance; one that cannot has a policy.