AI Governance & Risk
Know what AI you run, how risky each system is and who owns it, and apply controls in proportion, so the answer is usually yes, with conditions.
AI governance & risk
AI governance answers four questions at any moment: what AI systems do we run, how risky is each one, who is accountable for it, and are its controls working?
A practical governance programme has six parts:
Widely used frameworks can shape this: the NIST AI Risk Management Framework (organised around Govern, Map, Measure and Manage), the ISO/IEC 42001 standard for AI management systems, and in Australia the Voluntary AI Safety Standard. The EU AI Act takes a risk-based approach with obligations that phase in over several years. Check which apply to you, and their current requirements, with legal counsel.
Why it matters
When governance is missing or slow, AI does not stop; it goes underground. People paste customer data into consumer tools, teams sign vendor contracts nobody reviewed, and leaders find out after an incident. This is often called shadow AI.
Customers, auditors and regulators increasingly ask the same questions: which AI do you use, on what data, with what controls? An organisation that can answer quickly wins deals and passes audits; one that cannot loses both.
Good governance also speeds delivery. When low-risk uses are approved in days and high-risk ones have a clear path, teams stop guessing and stop waiting.
Tiering systems and matching controls
Classify each system on a few questions:
Then match controls to the tier:
Keep the process proportionate. Most systems should be low or medium risk, and treating everything as high risk is how governance becomes the bottleneck that drives shadow AI.
Risk tiering as a simple rule set
from dataclasses import dataclass
@dataclass
class AISystem:
name: str
owner: str
affects_people: bool # money, health, rights, employment or safety
acts_autonomously: bool # takes actions without a person checking
personal_data: bool
customer_facing: bool
reversible: bool
def tier(s: AISystem) -> str:
if s.affects_people and (s.acts_autonomously or s.customer_facing):
return "high"
if s.affects_people or s.acts_autonomously or (s.personal_data and not s.reversible):
return "high" if not s.reversible else "medium"
if s.personal_data or s.customer_facing:
return "medium"
return "low"
CONTROLS = {
"low": ["register entry", "acceptable use policy"],
"medium": ["register entry", "pre-launch evaluation", "logging", "named owner", "6-monthly review"],
"high": ["register entry", "impact assessment", "pre-launch evaluation", "human oversight",
"security review", "ongoing monitoring", "executive sign-off", "quarterly review"],
}
examples = [
AISystem("Meeting notes summariser", "IT", False, False, False, False, True),
AISystem("Support reply drafting", "Support", False, False, True, False, True),
AISystem("Loan pre-assessment", "Lending", True, False, True, True, False),
]
for s in examples:
t = tier(s)
print(f"{s.name:<28} {t:<7} {', '.join(CONTROLS[t])}")Worked example: replacing a ban with a fast lane
A professional services firm banned generative AI tools, and an internal survey later showed most staff using them anyway, often with client data.
The firm replaced the ban with three things:
Within a quarter, the register listed 64 systems instead of the 9 anyone knew about, use of unapproved tools fell sharply, and two high-risk proposals were redesigned before launch rather than discovered after an incident.
In a real organisation
Measure governance by time to decision as well as by risk prevented. If a low-risk request takes six weeks, people route around the process.
Include vendor tools and features in the register. Many AI risks arrive inside software the organisation already buys, when a vendor switches on an AI feature.
Give every system an accountable owner in the business, not only in IT or a central AI team.
Treat AI incidents like security incidents: an easy way to report them, a blameless review, and changes to controls as a result. Near misses are the cheapest lessons.
Revisit tiers when systems change. A drafting tool that starts sending emails on its own has become a different system.
Challenge
Your organisation has no AI register, one blanket policy written last year, and a backlog of 30 requests waiting for approval. Design a governance process you could launch in six weeks: the register fields, the tiering questions, the controls per tier, the review path and the target time to decision for each tier.
Checklist
Production checklist
0 of 9 checked
Knowledge check
Staff are using unapproved AI tools with customer data. What usually reduces this most effectively?
Complete
You can now set up AI governance that is proportionate, fast for low-risk uses and thorough where it matters. Next: scale AI across teams and measure the value.
Mark this chapter as complete
Track your progress and unlock the next chapter.