Organisations have an AI strategy – but do they have AI governance?

The question leaders should be asking is therefore not whether the organisation has an AI strategy. The question is whether the organisation has control over how AI is actually being used.

An AI strategy tends to be about where the organisation wants to go. AI governance is about how the organisation gets there in a safe, responsible and controlled manner.

In many organisations, AI adoption is happening far faster than the governance surrounding it. Employees are picking up new tools, departments are experimenting with their own solutions, and AI is gradually becoming part of work processes and the basis for decisions.

Often without leadership having full visibility.

If you are a leader, can you answer these questions:

• Which AI tools are being used in the organisation today?
• Which data is being shared with these solutions?
• Who is responsible for approving new AI tools?
• How is AI-generated content quality-assured?
• Which decisions are influenced by AI?
• How do you document your use of AI to customers, owners and authorities?

Many leaders find they do not have good answers to all of these questions.

That does not necessarily mean the organisation has a problem. But it may mean the organisation lacks governance.

AI governance is the framework that ensures AI is used in line with the organisation’s objectives, values, risk appetite and regulatory requirements.

It covers, amongst other things:

• roles and responsibilities
• guidelines for AI use
• risk assessments
• control over data and models
• documentation and traceability
• compliance with legislation and standards

In short: AI governance turns AI into a governed organisational capability, rather than simply a set of tools employees use on their own initiative.

With the EU AI Act, it is becoming increasingly difficult to treat AI as a purely technology initiative.

Organisations that develop or use high-risk AI must be able to document how AI is used, which risks have been assessed and which control mechanisms are in place, and all providers and deployers of AI systems must take measures to support AI literacy among their staff. For many, this will require far more than a strategy or a general AI policy. It requires governance.

Many organisations spend considerable time discussing what AI can do for them. Perhaps it is time to spend just as much time discussing how AI should be governed.

Because when AI becomes part of the organisation’s work processes and decisions, having a strategy is no longer enough. What you need is AI governance.