AI governance: where to start without stalling innovation | Blog

The problem is not AI, it is the lack of an owner

When an AI agent approves a payment, classifies a ticket or denies a request, someone needs to be accountable for it. If that is not defined beforehand, the question only comes up after the mistake, at the worst possible moment, and the answer is usually an apology followed by the suspension of the project.

That is why governance does not slow adoption down: it is the condition for adoption to survive the first incident. Organizations that skip this step usually move faster in the first three months and stop everything in the fourth.

Four questions that define the essentials

Before frameworks, policies and committees, four questions take care of most of the risk:

Who decides what? What the agent's authority level is, and from what point a decision goes up to a person.
What gets recorded? Not just the result, but the criterion, the model version and the data used.
Where is the stop button? Who can switch it off, how quickly, and what happens to whatever was in progress.
What data can the AI see? The minimum data needed, and what never leaves the environment.

An organization that answers these four in writing, for each use case, is already ahead of most.

Start with a use case, not a general policy

A corporate AI policy written before the first real case usually ages without ever being applied, because it was drafted on assumptions. The approach that works is the reverse: pick a concrete use case, define its rules, run it, and turn what you learned into policy.

This also avoids the most common trap, which is treating every use of AI with the same rigor. An agent that suggests a reply to an analyst does not need the same control as an agent that executes a financial transaction. Classifying by risk is what keeps governance from turning into uniform bureaucracy.

Traceability is what supports the audit

An automated decision needs to be explainable long after it was made, sometimes years later, when no one remembers the context. That means recording enough to reconstruct the reasoning: the input, the criterion applied, the version of the model or rule, the authority level in force and the result.

Without that record, the organization is in a weak position in an audit: it knows what happened, but cannot show why it happened. And in a regulated sector, not being able to show it is the same as not having done it.

Human in the loop, but in the right place

Putting a person in to approve everything cancels out the gain and creates a rubber stamp. Putting no one in creates risk with no owner. The useful design sits in between: human approval where the error is costly or irreversible, autonomy where the error is cheap and reversible.

A good test: if the reviewer approves more than 95% of cases without changing anything, they are not reviewing, they are delaying. That point should become autonomy, and the review effort should move to where there is real disagreement.

Frameworks help, but they do not decide for you

But none of them tells you what authority level your purchasing agent should have. A framework organizes the conversation; the decision is still the organization's, and it needs to be made by the people who know the process, not just by the technology area.

How to build it in stages

A path that usually works, without stopping the operation:

Inventory: which uses of AI already exist, including those no one formally approved.
Classification by risk, with a simple criterion: the impact of an error and its reversibility.
Rules per use case, answering the four questions from the beginning.
Recording and monitoring, with periodic review of what the automation decided.
Corporate policy, written from what is already in operation.

Note that the policy comes last. It is the opposite of what is usually done, and that is precisely why it usually works.

FAQ

What is AI governance?

It is the set of rules, roles and records that lets you use artificial intelligence knowing who is accountable for each automated decision. It defines authority levels, traceability, the stop point and what data the AI can access. It is not a brake on innovation: it is what makes it possible to put AI into a critical process without betting the operation.

Where should you start governing the use of AI?

With a concrete use case, not a general policy. For that case, define who decides what, what gets recorded, who can switch it off and what data the AI can see. Run it, learn, and only then turn what you learned into corporate policy. A policy written on assumptions ages without ever being applied.

Does every AI decision need human approval?

No, and requiring it cancels out the gain and creates a rubber stamp. Human approval makes sense where the error is costly or irreversible; where it is cheap and reversible, autonomy fits. A good test: if the reviewer approves more than 95% of cases without changing anything, they are not reviewing, they are delaying.

What frameworks exist for AI governance?

ISO 42001 provides a management system for AI, the NIST AI RMF organizes risk analysis, and the LGPD already imposes requirements when personal data is involved, including the right to have an automated decision reviewed. They organize the conversation, but they do not define the authority level for your process: that decision still belongs to the people who know the business.

What needs to be recorded in an automated decision?

Enough to reconstruct the reasoning long afterward: the input, the criterion applied, the version of the model or rule, the authority level in force and the result. Without it, the organization knows what happened but cannot show why, and in a regulated sector not being able to show it is the same as not having done it.