Insights / Guide / AI governance, risk and compliance
GuideAI governance, risk and compliance: the complete guide
Governance is not a brake on AI. It is the set of rules, owners and checks that lets you use it at scale and defend what it does. A practical 90-day plan.
You need to trust AI to get value from it. Without trust, every new use case becomes an argument between enthusiasts who want to move fast and risk owners who want to stop everything until they understand it. Both have a point, and neither position scales.
Governance resolves that tension. It is not a brake on AI but the set of rules, owners and checks that lets you use it widely, with confidence that you can explain and defend what it does. This guide brings together the briefings in our governance series and sets out a practical 90-day plan that a mid-sized organisation can follow without building a large new function.
Why governance matters now
Three pressures make AI governance urgent rather than optional. The first is shadow AI. Staff adopt AI tools faster than policies appear, often for good reasons: they want to draft faster, summarise long documents or analyse data. Without guidance and approved options, sensitive data such as customer records, contracts or source code leaves the company unnoticed.
The second is regulation. The EU AI Act applies to organisations that develop or deploy AI affecting people in the EU, wherever they are based, and other jurisdictions are developing their own rules. The third is customers. Larger clients increasingly ask suppliers how they govern AI, in tenders and security questionnaires, and expect evidence rather than reassurance.
Governance enables speed
A clear, routine approval path for low-risk use cases lets teams move faster than they can when every request is treated as a special case.
Weeks 1 to 4: see what you have and set the rules
Start by finding out what is already in use. Ask teams what AI tools they use and why, without blame; you want an honest picture, not a list of confessions. Check software subscriptions, browser extensions and features newly switched on inside existing products, since many business applications now include AI capabilities by default.
- Build an inventory of AI systems, models, vendors and the data each one uses.
- Name an owner for every AI system, accountable for how it is used and what it produces.
- Offer approved alternatives that meet the needs behind shadow use, so people have a sanctioned option.
- Write a short acceptable-use policy, two pages at most, that people will actually read.
What the acceptable-use policy should cover
- Which tools are approved, and for what purposes.
- What data may never be entered into which tools, such as personal data, confidential contracts or client information.
- Who must review AI output before it reaches a customer or informs a significant decision.
- How use is recorded for higher-risk applications.
- How to request approval for a new tool or use case.
- Who to contact with questions or to report a problem.
People follow rules they understand. Explain the reasons behind each rule in a sentence, and give examples of what is and is not acceptable. A policy written only in legal language will be ignored by the people it most needs to reach.
Weeks 5 to 8: tier the risk
Not every AI use needs the same level of control. Treating a tool that drafts internal meeting notes the same way as one that screens job applicants wastes effort on the first and may under-protect the second. Tiers keep effort proportionate.
- Low risk: drafting internal text, summarising documents for personal use, brainstorming. Light controls: approved tools, data rules and human review of the output.
- Medium risk: customer-facing content, decision support, AI that reads business data at scale. Add testing before launch, monitoring after, and a named owner who reviews quality regularly.
- High risk: decisions about people, such as hiring, credit or access to services; safety; or large sums of money. Require formal approval, documented testing for accuracy and bias, human approval of individual decisions, detailed records and regular audit.
Human oversight must be real. An approval gate reduces risk only if the reviewer has the time, the information and the authority to say no. If reviewers approve nearly everything within seconds, the gate is decorative. Show them the source and reasoning, give them enough time and check a sample of their decisions.
Weeks 9 to 13: test, monitor and report
For medium and high-risk use cases, check accuracy, bias, security and robustness before go-live. Build a test set of real examples with known correct answers, including difficult and unusual ones, and record the results. Test for security issues specific to AI, such as prompt injection, where crafted input tricks a system into ignoring its instructions, and data leakage.
After launch, monitor for drift, where performance changes as data or usage changes, along with incidents, user complaints and cost. Set thresholds that trigger a review, and agree who can suspend a system if something goes wrong.
Agree a simple quarterly report to the board covering which AI systems are in use, their risk tiers, any incidents and the actions taken. A short, consistent report builds a track record and gives directors the oversight they are increasingly expected to show.
Prepare for customer questions at the same time. Many tender documents now include a section on AI: which systems you use, what data they process, how output is checked and how incidents are handled. Drafting standard answers once, from the inventory and testing records, turns each new questionnaire into a short review rather than a fresh research exercise for the sales team.
Map your controls to recognised standards
Standards turn principles into requirements that auditors and customers recognise. Mapping your controls to them makes audits and questionnaires routine rather than a scramble.
- ISO/IEC 42001 describes an AI management system: policies, roles, risk assessment, controls and continual improvement. It suits organisations that already run ISO-style management systems for quality or information security.
- The NIST AI Risk Management Framework offers a structure for identifying, measuring and managing AI risk, organised around governing, mapping, measuring and managing.
- The EU AI Act sets legal obligations that depend on the risk category of the system, with the heaviest requirements for high-risk uses.
You do not need certification to benefit. A simple table showing which of your controls meets which requirement is often enough to answer customer questions and to show where gaps remain. Keep the inventory, testing records and board reports in one place so evidence is ready before a regulator or customer asks.
Keep governance alive
Governance is continuous. Models are updated, data changes, new tools appear and regulations evolve. Review the policy when any of these shift, and at least once a year. Run incident drills so people know what to do if an AI system produces harmful output or exposes data. Appoint a single person accountable for the programme, with enough seniority to resolve disagreements between teams.
The inventory surprised us. We expected five AI tools and found more than twenty. Most were harmless, but two were handling client data we had promised to protect.
Chief operating officer, professional services client
Done well, governance gives you defensible AI with clear records of what it does, with what data and why; faster approvals for low-risk use; lower regulatory and reputational risk; board confidence; and visible rules that customers and staff understand. A practical first step is the inventory: send a short, blame-free survey to every team leader this week asking which AI tools their teams use and for what.
Source: Intelliversal analysis, drawing on the briefings in this series.
