AI governance without killing velocity
Score every AI project on data sensitivity, autonomy, impact on people and regulatory exposure, and let the score decide the tier, who approves it and what review it needs. Low-risk internal tools get approved tools and basic rules, while high-risk systems and autonomous agents get a formal review, evals, human oversight, logging and an owner. Keep the governing group small, give it authority and fast answers, and publish approved tools, or people will use unapproved ones with your data.
Why governance slows teams down
Governance that requires a committee for every use slows everything, so teams quietly use whatever AI tools they like. Shadow AI, employees using unapproved tools with company data, is usually a bigger risk than the projects that go through review. A governing group is either a decision-making body or a bottleneck.
Risk score
risk_score = data_sensitivity * 3 + autonomy_level * 3 + user_impact * 2 + regulatory_exposure * 2
Each factor is scored from 1 to 5, so the score runs from 10 to 50.
| Tier | Score | Examples | Approval | Human oversight |
|---|---|---|---|---|
| 1 | 10 to 20 | Internal tools, no sensitive data, a person reviews outputs | Engineering lead | Not required |
| 2 | 21 to 35 | Customer-adjacent, regulated data, moderate automation | Product and security leads | Recommended |
| 3 | 36 to 45 | Customer-facing, decisions affecting people | Full council, legal or security can block | Required before production |
| 4 | 46 to 50 | Autonomous agents with real-world actions | Full council, CEO aware | Required, logged and audited |
Council
- Small: a chair (CTO or Chief AI Officer), product or engineering, legal or compliance, security, and a business owner.
- Every member can decide, or sends an alternate who can.
- Answers in 48 to 72 hours, not at next month's meeting.
- Every decision recorded: system, risk score, tier, decision, conditions, next review date.
One-page submission
1 - What does the system do, in plain language? 2 - What's the risk score, and how was it calculated? 3 - What data does it touch, and is any of it regulated? 4 - Does it generate output, or take actions? 5 - What's the business case, and who owns the outcome? 6 - What could go wrong, and what's the mitigation? 7 - When is approval needed?
Shadow AI survey
Send three anonymous questions:
1 - Which AI tools do you use at work, with or without approval? 2 - What kind of company data, if any, do you put into them? 3 - What would make you switch to an approved tool?
Build the policy from what people do, not what you assume they do.
Regulation
The EU AI Act's obligations phase in over several years, with rules for high-risk systems applying later than the bans and transparency duties. See compliance basics for the current dates and for India's DPDP rules.
From the floor
In the webinar on AI agents for business leaders, I described governance in three layers: executive oversight, where CXOs and legal leadership set risk tolerance and budget, operational teams who ensure compliance day to day and monitor agents for biased or discriminatory answers, and lifecycle management of each agent from concept to retirement.
The risk score, tiers, council and shadow AI survey on this page come from the AI Council charter template in my Enterprise AI Accelerator Playbook.