AI Governance Basics for Business Teams

Information only — not legal advice.

AI governance makes responsibility clear when a team uses AI to produce information, support decisions or automate work. The useful unit of review is the actual use case: the same tool may be suitable for rewriting public text and unsuitable for making an unreviewed safety decision.

Begin with the decision being supported, the information supplied and the consequence of a plausible error.

Describe the use before approving it

Keep a short record of the purpose, accountable owner, intended users, input data, output, human review and prohibited uses. Identify the provider and service configuration, including relevant retention, training-use and access arrangements. Verify those terms for the account and feature being used; do not assume all versions of a product behave alike.

Check rights and confidentiality before submitting material. Customer information, personal data, source code and unpublished designs may require controls or permissions that a convenient upload interface does not supply.

Example: drafting inspection summaries

A fictional facilities team wants AI to turn inspectors' notes into readable summaries. It first tests an approved set of synthetic or appropriately de-identified examples, including incomplete notes, contradictory readings and unusual equipment names.

The reviewer compares every draft with its source notes, checking omissions, invented facts, units, dates and whether uncertainty has been preserved. The team prohibits the system from marking an inspection as passed. The responsible inspector makes that decision through the existing process.

Before introducing real records, the organisation assesses the proposed data flow and provider terms. Removing a person's name alone may not make a record anonymous if other details still identify them.

Evaluate the task, not the demonstration

Choose representative cases and define acceptable performance before testing. Record failure types and their consequences, not just whether a sample sounds fluent. Include difficult cases and a route to decline or escalate when evidence is insufficient.

For retrieval or summarisation, test whether cited sources exist and support the output. For calculations or classifications, compare results against an independently established reference. A second AI response agreeing with the first is not independent verification.

Make human review workable

A reviewer needs the source evidence, enough time, relevant competence and authority to reject the result. A mandatory confirmation button does little if the reviewer cannot see what was changed.

Keep an appropriate record of the service or model version, important settings, input references, output and final decision, while avoiding unnecessary retention of sensitive prompts. Define what happens when the provider changes the model or the workflow begins producing new error patterns.

Monitor and retire uses

Collect user feedback and incidents, sample outputs, and re-evaluate after material changes. Establish an owner who can suspend the use and restore a manual process. Consider whether the benefit still justifies the review effort and risk.

The NIST AI Risk Management Framework is a voluntary risk-management resource. It is not a substitute for assessing applicable law, contracts or professional duties. The controls and inspection example above are suggested practices, not a universal legal approval checklist.

Continue with data classification, vendor management and quality management.

Important information

This article provides general information and does not constitute legal advice or replace a qualified professional's assessment of your circumstances. Laws, official guidance, standards and product features can change. Check current primary sources and the requirements applicable to your jurisdiction, contract and project before making decisions. Examples illustrate the discussion; they are not official rulings or instructions for a particular case. For legal decisions, consult a qualified lawyer; for technical or other specialist matters, consult the responsible professional.