AI Governance Starter Guide
About this resource
Most organizations approach AI governance backwards. Somebody is assigned the policy, finds a template, fills in the blanks, and circulates it for acknowledgment. Then it turns out nobody had actually decided which tools were approved, where human judgment was required, or who answers the question when an employee is unsure. The policy is the output of governance, not the substance of it.
This guide sets out the substance as eight questions, each with what you are actually deciding and what to watch for as you decide it. It covers scope, boundaries, data, human accountability, verification, disclosure, escalation, and ownership. It also introduces the eight-layer governance stack, gives you the anatomy of what a good policy should make clear, names five governance mistakes that create more risk than they remove, and closes with a policy test: eight questions an employee should be able to answer after reading your policy. If they cannot, you have a document rather than governance.
Answer them with the right people in the room and the policy becomes a transcription exercise. Skip them and you will write a document that governs an imaginary organization.
How to use it
Work through the eight questions in one meeting with an executive sponsor, an operations lead, someone from IT or security, and at least one manager who does the governed work. Include that last person and the policy survives contact with reality. Once the answers exist, drafting is the easy part, and it is worth having counsel review the result before publication. What counsel cannot do is make the decisions for you.
Inside the download
Whether embedded AI features, custom assistants, and personal accounts are in scope. Most policies miss this.
Three tiers of use that a person can apply on a Tuesday without calling anyone.
Actual categories from your organization, including one that is explicitly permitted.
Why "a human reviews it" decays into a signature within a month unless you say what reviewing involves.
Common questions
Eight. What are we actually governing, including embedded features and personal accounts. What kinds of use are acceptable, restricted, and prohibited. What information can employees enter. Where must a human remain accountable. What must be verified before output is used. When should AI use be disclosed. What happens when something goes wrong or somebody is unsure. Who owns governance and how will it evolve.
A structure covering eight dependent layers: purpose, boundaries, data, human oversight, verification, accountability, escalation, and review. Most organizations address the middle layers because boundaries and data rules are the visible part of governance, and skip purpose at the top and review at the bottom, which is what makes the result feel arbitrary and go stale.
An executive sponsor with authority, an operations lead who understands the work, someone from IT or security for the technical assessment, and at least one manager who performs the work being governed. Governance designed by legal or IT alone reliably produces rules that are technically sound and operationally unworkable.
Free. No email list, no follow-up sequence.
More from the resource library, chosen because they pair well with this one.
Twelve components, what each one has to accomplish, and the common weakness that makes each one fail.
Seven groups, seven different responsibilities, and the assumption that everybody else owns AI.
Nine things that decide whether any of this takes hold, and a ten-item leadership self-check scored on evidence rather than intent.
Tell us a little about yourself and this document is yours. We don't have an email list. We collect this so we know who's finding our resources useful, and that's it.
You're downloading
this document
Your information is kept confidential and never shared with anyone.
