Governance means knowing what you have
Most businesses cannot list where AI is in use across their operations. Something in the support tool, something a marketer subscribes to, something a developer added, something a vendor turned on.
You cannot govern what you have not listed, and the list is usually the entire first phase.
A register with five columns
| Column | Why |
|---|---|
| Where it is used | The process, not the tool name |
| What it does | Suggests, drafts, decides, or acts |
| Owner | A person, not a department |
| Data involved | Personal data, confidential, or neither |
| Human review | What a person checks before it takes effect |
One row per use. Most businesses find between five and fifteen rows, several of which nobody had thought about as AI.
Classify by consequence, not by technology
- Suggests to a person. Low risk. Light oversight.
- Drafts something a person sends. Requires review before it leaves.
- Decides something internal. Needs logging and periodic sampling.
- Affects a customer or employee directly. Needs documented review, an appeal route and careful legal consideration.
The classification that matters is what happens if it is wrong, not how sophisticated it is. A simple rule engine that rejects applications deserves more scrutiny than an elaborate model that suggests article headlines.
Require a named owner
Every use gets a person accountable for whether it still works and still makes sense. AI systems drift as the world changes around them, and an unowned one degrades invisibly.
The owner should be in the business, not in IT. They own the outcome; someone else can own the technology.
Review twice a year
Go through the register: is each use still needed, still accurate, still appropriately reviewed? Has anything been added that is not on the list?
Two hours, twice a year. That is proportionate for most businesses and it is dramatically better than nothing, which is where most currently are.
Keep the paperwork minimal
The failure mode of governance is a process so heavy that people route around it. If getting a new AI use approved takes three weeks, someone will just start using something.
Make registering a use take ten minutes and approval take days rather than weeks, and the register will actually reflect reality.