A practical guide / AI governance
AI Governance.
A practical starting point.
Start with a few clear questions: what will you use AI for, what information can people share with it, and who checks its work? This guide helps you turn those answers into rules your team can follow.
The terms explained. Everyday examples. Practical first steps.
The idea
Make responsible AI part of how work gets done.
AI governance means deciding how your organization will use AI, what rules people should follow, and who is responsible when something goes wrong.
An AI governance policy puts shared rules in writing for the whole organization. It explains how tools are approved, which uses are prohibited, what information people can share, when a person must check the results, and who reviews the rules. A plan for one tool shows how those shared rules apply to a particular job.
My starting point: choose one job AI could help with and write down the rules for it. Then put those rules into practice through staff guidance, tool settings, and regular checks.
These safeguards are often called controls. For example, if AI drafts a response to a customer complaint, your policy might require an employee to check it before it is sent. You put that control into practice by setting up the tool so it cannot send the response until someone approves it.
- Clear ownership
- Name the person responsible and explain who can approve changes or stop the tool.
- Useful boundaries
- Explain what people and AI are allowed to do. Set up the tool so those limits actually work.
- Evidence before trust
- Try real tasks and compare the answers with information you know is correct.
- A way to respond
- Tell people how to report a mistake and name the person who will fix it.
The foundations
Seven components to get right.
These are seven parts of planning and managing AI use. Each one explains the industry term, why it matters, and a first step you can take.
Throughout this guide, we'll use an internal policy assistant as our example: an AI tool that answers employees' questions using approved company policies.
01Ownership & accountabilityWho is responsible?
Choose a person responsible for how the AI tool is used and what happens when it makes a mistake. Write down who keeps it working, who checks the company rules it uses, and who can approve changes or stop it in an emergency. This applies whether you build a tool or buy one.
Why it matters
If an employee gets a wrong answer, they need to know who to tell. The person responsible also needs permission to fix the problem. Naming someone without giving them the ability to act leaves the problem unresolved.
A common failure
An employee reports a wrong answer. HR assumes IT will fix it, and IT assumes HR will. The same wrong answer keeps appearing.
What good looks like
- A named owner: the person responsible for the tool and for making sure problems are addressed.
- Clear decision rights: who can approve new AI tools, changes to how they are used, or a pause in an emergency. For example, the policy owner reviews a proposed new task before the assistant starts doing it.
- An AI inventory: a list of the tools your organization uses. Record the purpose, responsible person, supplier, approval status, and next review date. Ask the relevant privacy, security, or legal specialist to review uses that need their expertise.
In practice / Policy assistant
The human resources (HR) team, which handles employee policies, checks the answers and keeps the policies current. The information technology (IT) team, which supports company technology, keeps the tool running. A named HR manager can stop it if employees receive incorrect guidance.
Write down the names of the people who maintain the tool, check its answers, approve changes, and can stop it. Share that list with the people using it, and agree on which changes need approval before they happen.
02Use cases & riskWhat will you use AI for, and what could go wrong?
A use case is a specific job you want AI to help with, such as answering questions about vacation rules. Risk means what could go wrong, how likely it is to happen, and how serious the consequences could be. Start by describing the job, what AI must not do, and who could be affected by a mistake. Ask whether AI is useful for this job at all; a clear policy page or a person may be the better option.
Why it matters
A mistake in a draft email may be easy to fix. A mistake that affects someone's pay or job could cause much more harm. The greater the possible harm, the more carefully you need to check the tool and involve people in decisions.
A common failure
Employees start treating the assistant's explanations as official decisions, even though it was only intended to help them find information.
What good looks like
- A clear use case: "Help employees find and understand current company policies."
- Written limits: "The tool may explain vacation rules, but it may not approve or reject vacation requests."
- A risk assessment: write down possible problems, how likely they are, and who they could hurt. Include fairness: could the tool give less useful answers to people asking in different languages or using assistive technology, such as a screen reader?
In practice / Policy assistant
The policy assistant can explain how to request vacation. It cannot decide whether a particular employee gets the time off. Questions about a person's pay, benefits, or disciplinary action go to the human resources team for a decision.
Finish this sentence: "We will use AI to help with ___." Then list what it must not do, who a mistake could affect, how likely each problem seems, and whether the benefit is worth the risk.
03Data & privacyWhat information can AI use, and how is it protected?
Data means the information an AI tool receives or uses, such as documents, questions, and customer records. Decide which information it is allowed to use and what must stay private. Check what the company providing the tool does with that information, including whether it stores it, shares it, or uses it to improve its AI. Also review third-party risk: problems involving a supplier you depend on. For example, check whether its terms allow your intended use and what you will do if it changes the service or has an outage.
Why it matters
An old policy can lead to a wrong answer. Employee or customer information can also be exposed if people put it into a tool that has not been approved for that information. You need to understand both the information going in and what happens to it afterward.
A common failure
An employee pastes someone's medical details into the assistant, or the assistant answers using a policy the company replaced last year.
What good looks like
- Approved sources: documents someone has checked and allowed the tool to use. Record who keeps each source up to date.
- Privacy rules: examples of information people must not enter, such as employee medical details or confidential customer records.
- Data retention rules: how long questions, uploaded files, and saved records stay in the tool's databases or other storage, and when they are deleted. Check this with the supplier and the person responsible for privacy.
In practice / Policy assistant
The assistant uses the company's current policy documents, but not individual employee files. Before anyone uses it, the team checks whether the supplier saves conversations, who can see them, how long they stay saved, and how they can be deleted.
List the information the tool needs and what people must not share. Ask the supplier what it saves, who can access it, and when it is deleted. Check that its terms allow your intended use and agree on what happens if the service changes or becomes unavailable.
04Access & securityWho can use the tool, and what can it see or do?
Access means who is allowed to use the tool or see particular information. Permissions are the settings that allow or block those actions. Security means protecting the tool and information from people who should not have access. Give people and the AI tool only the access they need for the job.
Why it matters
A tool that searches company documents could accidentally make private information easier to find. Writing "do not share private information" in an instruction is not enough. The tool's settings and connected systems also need to prevent access.
A common failure
The assistant connects through an account that can see everything, so an employee receives information that should be private.
What good looks like
- Separate access for different jobs: for example, employees can read general policies, while only approved HR staff can read private employee records.
- Protected credentials: passwords and digital keys that let the tool connect to other systems. Keep them out of shared documents and give them only the access needed.
- Checks that restrictions work: try to retrieve a document the test user is not allowed to see, and confirm the tool blocks it.
In practice / Policy assistant
Employees sign in with their company account. The assistant searches only policies that the signed-in employee is allowed to read. It cannot change employee records, approve expenses, or send messages on someone's behalf.
List who can use the tool, what each group can see, and what the tool can change. Ask the person setting it up to test that forbidden information and actions are blocked.
05Human oversightWhen should a person check the work?
Human oversight means deciding where a person needs to check, approve, or correct what AI does. Set clear rules for when the tool must ask for help. Tell users how to question an answer and who can make the final decision.
Why it matters
AI can sound certain even when it is wrong. A reviewer needs time and the original information to check an answer properly. Clicking "approve" without checking does not protect the people who rely on it.
A common failure
An employee assumes a confident AI answer means their request has been approved. Nobody checks the actual policy.
What good looks like
- Human review rules: specify which answers or actions need a person's approval, such as advice affecting an employee's pay.
- An escalation process: when to ask for help and who to contact. For example, send questions with conflicting policy guidance to HR.
- A fallback: what to do if AI cannot help. For example, show the employee the HR contact instead of making up an answer.
In practice / Policy assistant
The assistant shows the policy behind its answer so the employee can check it. A source link does not prove the answer is correct; someone still needs to compare the answer with the document. If no answer is found or two policies disagree, the assistant directs the employee to human resources. A person checks questions about individual pay or benefits before a decision is made.
Write down which questions need a person's review, who will review them, and how employees can ask for help or report a wrong answer.
06Testing & rolloutHow will you check that it works before people use it?
Testing means trying the tool on realistic tasks and checking the results. Rollout means introducing it to the people who will use it. Before that happens, agree on acceptance criteria: specific checks the tool must pass, such as answering from the current policy, showing its source, and blocking access to private records.
Why it matters
A tool might answer an easy question correctly and still fail when information is missing, two documents disagree, or someone asks for private information. Testing these situations helps you find problems before employees depend on the tool. Passing the checks gives you evidence about the situations tested, not a guarantee that every future answer will be correct. Keep checking after people start using it.
A common failure
The team tries a few easy questions, decides the tool looks good, and gives everyone access without checking whether it protects private information or knows when to ask for help.
What good looks like
- Acceptance criteria with clear tests: check a vacation answer against the current policy, and ask an unsupported question to see if the tool asks for help. Where relevant, try the same task in different languages and with assistive technology to check that it works for the people who will use it.
- A pilot: a trial with a small group before wider use. Name who approves it. Train users on what the tool can do, what information not to share, when to check an answer, and how to report a mistake.
- A rollback plan: how to return to a previous working version or stop the tool if a change causes problems. For a purchased tool, this might mean switching it off and returning to the usual help desk.
In practice / Policy assistant
The team asks realistic policy questions and checks both the source links and the answers against the documents. It uses made-up private records to test that an ordinary employee account cannot access them. It checks tasks with different users and shows trial participants how to use the tool and report problems. Required checks must pass before a small trial starts. Problems are fixed and tested again before more employees use it.
Write down questions the tool should answer, questions it should send to a person, and information it must never reveal. Record the expected result for each test, then compare it with what the tool actually does.
07Monitoring & improvementHow will you keep checking it and fix problems?
Monitoring means regularly checking how the tool behaves after people start using it. Improvement means using what you learn to fix answers, update information, and adjust the rules. Decide who does those checks and what happens when someone reports a problem.
Why it matters
Company policies change, and people ask questions you may not have tested. A tool that worked last month can give outdated advice today. Someone needs to notice those changes and take responsibility for correcting them.
A common failure
Employees keep reporting outdated answers, but nobody reviews the reports or updates the documents the assistant uses.
What good looks like
- A review cadence: how often someone checks the tool. For example, review reported mistakes each week and check answers again when a policy changes.
- Appropriate logs: saved records of what happened, such as errors or reported answers. Decide what to record, who can read it, and how long it stays saved; avoid collecting private details you do not need.
- An incident response plan: what to do when something goes wrong. Name who investigates, who can pause the tool, and who tells affected people. Set change-control rules too: who reviews updates to the AI model, instructions, source documents, or allowed actions before they reach users.
In practice / Policy assistant
Human resources reviews reported wrong answers and checks a selection of answers against current policies. If a policy or supplier service changes, the responsible person reviews the change and the team repeats the relevant tests before relying on the updated tool. A regression test means checking that the change has not broken something that worked before, such as keeping private records hidden.
Choose a person and schedule for reviewing answers and reported problems. Write down how to report a mistake, when to pause the tool, and who will fix it and check the fix.
Governance in practice
From policy to practice.
Here are three example rules for the policy assistant and the practical steps that make them work. These are a few rules to build on, not a complete AI policy.
- What your policy saysThe assistant may explain company rules, but cannot approve purchases.
- How you put it into practiceGive it access to read policies, but no ability to approve expenses. Tell employees who makes the decision.
- What your policy saysThe assistant must use current, approved documents.
- How you put it into practiceName someone responsible for updating those documents. Check its answers again whenever a policy changes.
- What your policy saysEmployees must have a way to report incorrect answers.
- How you put it into practiceProvide a reporting option, name the person who reviews reports, and explain when they should pause the tool.
For your own tool, write down the rule, who is responsible, and how you will check that it is being followed. The checklist below helps you get started.
Your first move
Start with one use case.
A use case is one job AI will help with. For example: "Help employees find answers about vacation rules." Choose a job, then work through this checklist with the people who will use and support the tool.
Write down your answers as a starting plan for this tool. For each item, agree on the rule and who will put it into practice. Use that plan to help develop or apply your organization-wide AI policy; it is not a complete company policy on its own.
Checked items are saved in this browser. Your checklist selections are not sent to a server.
This checklist helps you start writing your rules. Before people use the tool, the right people in your organization still need to review it and check that the safeguards work. Uses that could affect someone's health, pay, or rights need more careful review.
Keep going
A starting point, with a path deeper.
Once the basics feel familiar, these resources can help you develop more detailed rules and checks for your organization.
NIST AI RMF
NIST is the U.S. National Institute of Standards and Technology. Its AI Risk Management Framework (AI RMF) is a voluntary guide for understanding what could go wrong with AI and deciding how to address it.
More detailed actionsNIST AI RMF Playbook
A companion to the NIST framework with suggested actions. Useful when you want to turn broad goals, such as protecting people from harm, into more detailed tasks for your team.
For technical teamsAI Controls Framework
AI Squared's guide to the systems and safeguards behind AI used at work. It goes deeper into connecting tools, controlling information access, and checking how AI behaves.
This independent educational guide draws on AI Squared's AI Controls Framework and NIST resources. The seven components are a way to organize the basics, not an official standard or proof that you meet legal requirements. Adapt your policy to the work you do and ask the relevant specialists to review it.
This is not the official AI Squared framework or a certification.