An employee uses an AI assistant to summarise a meeting. A product team adds AI to a customer-facing application. Another department considers an AI tool to shortlist job applicants.

All three involve artificial intelligence, but they do not create the same risks or require the same decisions. The meeting summary might expose confidential information. The customer-facing tool might provide misleading answers. The recruitment tool could affect someone’s opportunity to get a job.

This is where AI governance begins: understanding how AI is used, who is responsible for it, and what needs to happen before and after it is introduced.

If your organisation is starting its AI governance journey, you do not need to build a complex programme on day one. Start by finding your AI use cases, assigning ownership and establishing a practical way to assess and manage risks.

What does starting AI governance involve?

AI governance is the set of responsibilities, processes and controls an organisation uses to guide how AI is selected, developed, deployed and monitored.

It applies whether you build an AI system yourself, purchase an AI-enabled product or allow employees to use external AI tools. In each case, someone needs to make decisions about appropriate use, data, risk, oversight and accountability.

My earlier article, What Is AI Governance?, introduces the leading frameworks. Here, I want to focus on a more practical question: where should an organisation actually begin?

1. Find out where AI is being used

You cannot govern what you do not know about. Start with a simple AI inventory: a list of AI systems, tools and use cases across the organisation.

Ask departments, IT, procurement and product teams about AI that is already in use, being tested or under consideration. Include AI features embedded in existing software, as well as tools employees access directly.

For each use case, record:

• What the tool does and why it is used.
• Who owns the use case and who supplies the tool.
• What data it uses, including personal or confidential data.
• Who may be affected by its outputs or decisions.
• Whether a person reviews the output or the system can take action.
• Whether it is proposed, being tested, in use or retired.

A spreadsheet is enough to start. The important part is having an owner who keeps it current and a process that captures new uses.

For example, a customer service chatbot and an AI feature in a recruitment platform should be separate entries, even if both come from the same vendor. Their purposes and potential impacts are different.

2. Assign responsibility for AI decisions

An AI policy cannot make decisions on its own. People need to know who can approve a use case, who assesses risks, who monitors performance and who can suspend a system when something goes wrong.

Responsibilities will vary by organisation, but a starting point might look like this:

• Leadership: Set expectations, provide resources and accept significant organisational risks.
• Business or product owner: Define the purpose, manage the use case and remain accountable for its day-to-day use.
• IT and security: Review access, integration, cybersecurity and technical safeguards.
• Data protection, legal and risk teams: Assess privacy, legal obligations and potential impacts.
• Users and affected teams: Follow guidance, review outputs where required and report issues.

One person may perform several roles in a smaller organisation. What matters is that responsibility is clear. A vendor can support your organisation, but buying a tool does not remove the need to understand and manage how you use it.

3. Assess AI risks according to the use case

Not every AI use needs the same level of review. Consider what could go wrong, how serious the impact would be, who could be affected and how much control people have over the outcome.

For example:

AI use	Questions to consider	Possible starting control
Drafting an internal email	Could confidential information be exposed? Could the draft contain errors?	Use an approved tool and review the draft before sending.
Answering customer questions	Could incorrect advice cause harm or complaints? Can customers reach a person?	Test common scenarios, monitor errors and provide escalation.
Screening job applicants	Could people be unfairly excluded? Can a decision be explained and challenged?	Conduct a more detailed assessment, test for potential bias and establish meaningful human review.

These are examples, not a complete risk classification. The same tool can present different risks depending on its data, users, setting and intended purpose. AI regulations may also impose specific obligations depending on the jurisdiction and use case.

Record the assessment, agreed controls, owner and decision. Where risks cannot be adequately managed, an organisation may need to change the use or decide not to proceed.

4. Put an AI policy and minimum controls in place

An AI governance policy should give staff clear direction. It does not need to anticipate every future AI technology, but it should explain what employees need to do now.

At a minimum, consider covering:

• Which AI tools are approved and how new uses are proposed.
• What information must not be entered into unapproved tools.
• When risk, privacy, security or legal reviews are needed.
• When people must check outputs or approve actions.
• How staff should report errors, incidents or unexpected behaviour.
• Who can approve exceptions and how they are recorded.

Support the policy with usable guidance. For instance, show staff what to do before uploading a document to an AI assistant, not just that they must use AI responsibly.

Connect these requirements to existing procurement, information security and data governance processes. An AI-enabled product should enter the same organisational processes as other technology, with additional questions where its AI features create new risks.

5. Review data, vendors and human oversight

AI governance and data governance are closely connected. Ask whether the data used is appropriate for the purpose, whether the organisation has the right to use it, and how personal or confidential information will be protected. Depending on the use, data quality, representation and access controls may also affect the result.

For third-party tools, review what the vendor says about data storage, retention, access, model training, security incidents and changes to the service. Check the contract and available evidence; a marketing statement alone may not answer the questions your organisation needs to ask.

Human oversight should also be meaningful. Telling an employee to approve an AI recommendation is not enough if they lack the information, time or authority to question it. Decide what the person needs to see, when they can intervene and what happens if they disagree with the output.

For AI agents that can take actions, consider what they are permitted to do, which systems they can access and which actions need approval. An agent that drafts a purchase request needs different controls from one authorised to place an order.

6. Understand the regulations and frameworks that apply

AI regulations depend on where an organisation operates, what it does and its role in relation to the system. For example, the EU AI Act creates binding obligations for certain AI systems and actors, with requirements and application dates that vary. Data protection, consumer, employment and sector-specific laws may also be relevant.

Alongside legal requirements, voluntary frameworks and standards can help organise your approach:

• The NIST AI Risk Management Framework helps organisations manage AI risks.
• ISO/IEC 42001 sets out requirements for an AI management system.
• Singapore’s Model AI Governance Framework offers practical, voluntary guidance.

You do not need to adopt every framework at once. Choose resources that fit your organisation, and use them to strengthen your own processes. A voluntary framework does not replace the need to identify applicable legal obligations.

7. Train people and keep reviewing

Responsible AI governance depends on the people who use and manage the technology. Staff need practical training on approved tools, data handling, limitations, checking outputs and reporting concerns. Product owners and reviewers may need additional training for their specific responsibilities.

Governance also continues after a tool is deployed. Monitor complaints, errors, incidents and changes in vendor services or use. Reassess when the system’s purpose changes, new groups are affected or an AI agent receives new permissions.

Useful measures could include the number of use cases with an identified owner, the proportion assessed before deployment, overdue reviews and reported incidents. Numbers are a starting point: they should lead to action when they reveal a gap.

A practical starting plan

When	Action	Expected result
First 30 days	Identify key stakeholders, agree a lead and begin an AI inventory.	A first view of AI use and responsibilities.
Days 31-60	Prioritise use cases by impact; assess existing controls and urgent gaps.	A shortlist of risks and decisions requiring attention.
Days 61-90	Introduce minimum guidance, clarify review routes and train relevant staff.	A repeatable starting process for new and existing uses.
After 90 days	Monitor use, review incidents and improve the approach.	Evidence of what works and what needs to change.

The timing is illustrative. Some organisations will need to act sooner, especially where sensitive data or consequential decisions are already involved.

Your AI governance journey starts with a decision

You do not need a perfect framework before taking the first step. Identify one use case, bring the right people together and ask: what is the AI doing, who is affected, who is accountable and how will we know if it is working as intended?

From there, build an approach that connects people, processes and the products they use. As your organisation’s AI use grows, your governance can grow with it.

This article provides general information. Legal requirements depend on the organisation, use case and jurisdiction.