Governance that keeps AI useful

Too much governance creates friction. Too little creates risk.

The right design gives people clarity about ownership, escalation and acceptable use — without creating a review board that turns a two-week pilot into a six-month approval cycle.

Weak governance is not the absence of documents. It is documents that nobody reads and processes that nobody runs. The giveaway: the AI policy lives on a Notion page, nobody can name who owns it, and when an incident happens, the first five minutes are spent working out who to call.

The other giveaway — every decision about the AI system ends up on the CEO's desk. That is not strong governance; that is missing governance with a senior person absorbing the risk personally.

For a scoped pilot, we insist on four artefacts. One — a named owner who can stop the system (not a committee, a person). Two — an escalation path that is one phone call long, not a hierarchy. Three — an acceptable-use statement that fits on one page and is signed by the operators. Four — an incident log, even if the log is empty.

Anything more than that for a pilot is overhead. Anything less and the pilot cannot survive its first real-world event.

If the pilot converts to a production program, the governance grows with it — but the shape stays the same. Named owner becomes a small oversight group. Escalation path becomes a runbook. Acceptable-use statement becomes a policy. Incident log becomes a review cadence.

What does not need to happen: the creation of a committee. Committees are where governance goes to die. The best AI governance I have seen lives in three documents, one meeting cadence, and a named owner — not in twenty.