AI is already in the work. The governance usually isn’t.
Most organisations have let AI into real work faster than they've decided how to govern it.
It likely started off to the side, answering questions. Now it's drafting in live documents, working with client material and quietly becoming part of how things get done. In most places nobody has said what it's allowed to change or who keeps an eye on it, and there's no record of what it did.
Boards can feel the exposure. The usual responses are to ban it or let it run, and neither holds for long. There's a middle path, and I've been running my own practice on it.
How I run it
I work alongside an AI assistant every day in the same files I use. My terms of engagement say so up front, and they're clear that using AI doesn't change who's responsible for accuracy or confidentiality. That's still me. I wanted to be able to explain how I use it to a client or a board, so the governance went in at the start rather than after something went wrong.
But none of it is heavy. The conventions for naming and filing are written down so the AI and I work to the same standard. The AI proposes and I approve: it can read and search freely, but nothing gets restructured, moved or deleted without a yes from me. Every structural change goes in a decision log with the reason and the approval. Then there's a rhythm. A weekly check flags drift without fixing anything itself, and once a month I step back and ask whether the whole setup is still earning its keep.
Very little of that is technical. It comes down to who makes decisions, what is recorded, and how often someone looks. This is what makes it an operating model question, and that was my point back in April about AI more generally.
The real test
The real test of governance isn't whether it stops every failure. It's whether you'd know.
Earlier this year a configuration change quietly broke my automated weekly maintenance. For about three weeks it ran against an empty folder, did nothing and didn't complain. However, it was the log and the weekly rhythm that picked it up. It got traced and fixed, and the job now fails loudly if it can't see what it's meant to check. Without that rhythm it could have happily ran incorrectly for months.
What it buys you
Mostly confidence. AI stops being a leap of faith. People get the productivity, gains, the organisation keeps its guardrails in place, and when someone asks what the AI touched and why, the answer's already written down.
It's also right-sized. It lines up with a fair bit of ISO/IEC 42001 (the international standard for managing AI in an organisation): clear roles, controlled change, records, regular review, and fixing things properly when they break. That's not certification and it doesn't need to be. It's a version a single team can actually run, for about ten minutes a week (plus a short monthly look).
Where to start
Not with a forty-page AI policy. I'd start with three questions.
Where is AI already touching real work?
Who approves what it changes?
If it went quiet tomorrow, would anyone notice?
If those are hard to answer, the governance is behind the adoption.
This is a small practice, not a large enterprise, so treat it as a pattern rather than a blueprint.
If AI is already in your organisation ahead of the governance, let's talk.