AI Governance & Leadership Guide

What AI governance means

AI governance is the set of responsibilities, policies, decision processes and oversight activities an organisation uses to manage how AI is selected, deployed and used. For an SME, governance does not need to mean a large committee or complex bureaucracy. The objective is to make sure someone is responsible, significant AI uses are reviewed, and important decisions can be explained and revisited.

1. Assign responsibility

Start by identifying who is responsible for AI governance. The responsible person or role should have enough authority to coordinate AI-related decisions and escalate significant risks to management.

• Name an individual or role responsible for AI governance.
• Define who approves significant AI use cases.
• Define who owns operational AI risks.
• Identify who should be consulted when legal, privacy or security issues arise.
• Make responsibilities visible to relevant employees.

2. Establish an AI governance policy

A documented AI governance policy provides a common set of expectations for employees and management. It should explain how the organisation approaches AI use, who is responsible, what uses require review, and how concerns are escalated.

• Define the purpose and scope of AI governance.
• State who is responsible for oversight.
• Describe acceptable and unacceptable AI use.
• Define approval requirements for significant AI use cases.
• Address data, privacy, security and human oversight expectations.
• Define how incidents and concerns are escalated.

3. Review significant AI use cases

Not every AI use case requires the same level of review. An organisation can use a proportionate approach based on factors such as the type of data involved, the impact of decisions, the number of people affected and the degree of human oversight.

• Identify AI use cases that require management review.
• Record the purpose and intended outcome of significant use cases.
• Identify important risks before approval.
• Record the approval decision and responsible owner.
• Review significant use cases when circumstances change.

4. Review governance periodically

AI governance should not be treated as a one-time exercise. Organisations should periodically review their policies, responsibilities, AI inventory, risks, incidents and changes in AI use.

• Set a periodic governance review schedule.
• Review changes to AI use cases and vendors.
• Review incidents, issues and corrective actions.
• Update policies and responsibilities where necessary.
• Record the outcome of the review.

What good documentation looks like

Documentation should be proportionate and useful. The goal is to create a clear record of who is responsible, what was decided, why it was decided and what was subsequently reviewed.