Most enterprises that have adopted AI have some form of policy. Far fewer can describe what actually happens when a concern arises: who is notified, who investigates, who decides, and who informs the board.
Governance is not the document. It is the behaviour the document produces under pressure.
Where AI risk actually sits
AI-related risk in enterprises rarely originates where leadership expects it. It clusters in three places.
- The third-party layer. AI functionality embedded in systems already in use (finance, CRM, HR, service desks) is often activated by vendor update without any internal review.
- The individual layer. Employees using public AI tools for productivity reasons, often because approved alternatives are slower or unavailable.
- The accountability layer. Decisions informed by AI output where responsibility for the decision has quietly become diffuse.
A practical oversight model
An oversight model that holds under scrutiny is built from four components: an inventory of AI use across the enterprise, including embedded and unapproved use; a clear classification of information sensitivity with defined handling rules; an approval and review route for new use cases proportionate to their risk; and a named accountability structure with defined escalation.
Each component produces evidence. Evidence is what allows an enterprise to respond to a client, a regulator or a board question with something other than reassurance.
Reporting to the board
Board reporting on AI should be concise, recurring and honest. A workable format covers current AI use and material changes, exposures identified and how they were addressed, decisions pending, and the commercial outcomes of AI investment. That is a single page. It is considerably more useful than an annual presentation on the state of artificial intelligence.
The dependency question
Enterprises should also be clear about what they are dependent on. Where AI capability is concentrated in a small number of vendors, and where operational processes have been rebuilt around that capability, the enterprise carries continuity risk. That risk belongs on a risk register, with a considered position on what happens if the dependency becomes unavailable, changes commercially or fails.
Governance is ultimately an exercise in knowing your own position. The enterprises that manage AI well are not the ones with the most restrictive policies. They are the ones that know exactly where AI is being used, what it can reach, and who is answerable for it.
