Play 5: Govern AI Like the Rest of the Business

Play 5: Govern AI Like the Rest of the Business

Goal: every AI in the enterprise is known, acts on someone's authority, stays within its limits and leaves evidence behind.

The questions to be able to answer

• What AI is running — including the assistants and agents people adopted on their own?
• What can each one see and do, and on whose authority?
• Which decisions can it prepare, and which must a person make?
• What did it do, for whom, and what did it cost?
• Which rules apply to it, and can we show they're being met?

How to run it

• Inventory every AI. Register each assistant, agent and model against the team that uses it, what it touches, its owner and its risk level. Include the ones you didn't buy.
• Tie identity to a person. Every AI action should trace to a named person's authority. Today that usually means acting within the user's permissions. As standards for agent identity mature, move toward distinct agent identities with delegated, scoped, short-lived access — and never standing privileges.
• Set governance in proportion to risk. Light review for low-risk uses, more for high-risk ones. Decide this per use, not as one policy for all AI.
• Keep approvals where the decision lives. Approvals belong on the operating model, next to the budget, control or initiative they affect — not in a chat log.
• Map obligations once. The EU AI Act, the NIST AI Risk Management Framework and ISO/IEC 42001 overlap heavily. Map each requirement once, to the controls that satisfy it, and evidence those controls from the work. Note that EU AI Act high-risk obligations now apply from December 2027 for stand-alone systems and August 2028 for AI in regulated products, following the 2026 amendments.
• Keep the record. Log what AI did, on whose authority and with what result, where auditors will look for it.

Outputs

• An inventory of AI in use, with owners and risk levels.
• A decision-rights list for AI: what it may prepare, what people decide.
• A map from AI obligations to controls and evidence.

Signs it's working

• Someone can answer "what AI touched this number?" in minutes.
• New AI goes through intake before it goes into production, without slowing teams down.

Pitfalls

• A separate governance tower. Governing AI in a separate system from the business it affects recreates the silos you're trying to remove.
• Reusing broad credentials. An agent with a shared superuser account is an incident waiting to happen.
• Policy without evidence. A policy no one can prove is being followed won't survive the first audit.