Governance / Tanuj’s perspective

The real test of AI governance comes after the policy is signed.

A signed policy is a starting point. I judge its practical value by what changes in the next real decision: a new use case, a vendor selection, a model update, or an incident.

Follow one decision from start to finish

Choose a real AI use case and ask the team to walk through it. Who registered it? Who assessed the risks? Who decided whether the remaining risk was acceptable? What evidence did they use? When will the decision be revisited?

If the answers depend on who happens to be in the room, the organisation may have written expectations without establishing a repeatable way of working.

Make accountability specific

“The business owns the risk” is too broad to be useful on its own. Name the accountable role and identify the decisions it must make. Be equally clear about the roles providing technical evidence, challenging the proposal, approving exceptions, and monitoring the system.

Escalation matters too. A team needs to know what to do when the evidence is incomplete, the deadline is approaching, or the person who usually approves a change is unavailable.

Keep evidence that supports the decision

The aim is not to collect the largest possible folder. Keep a proportionate record of the use case, assessment, evaluation results, approval conditions, owner, and review date. Make it possible for someone who was not in the meeting to understand why the decision was reasonable.

My focus is on governance that survives handovers and changes. When the people, supplier, or model change, the organisation should still be able to explain how the system is controlled.

Editorial perspective, prepared with AI assistance. This article presents a practical approach; it is not a report of a specific news event.