Innohub

1. Introduction: AI needs leadership, not just users

In many organizations, AI is already part of everyday work, even if it is not yet officially managed.

One team uses ChatGPT to draft customer messages. Another is experimenting with AI in recruiting. A third feeds sales data into an analytics tool. A fourth builds an automation that proposes decisions without anyone being entirely sure where the data goes or who is responsible for the outcome.

This is a familiar transitional phase of the AI era: usage spreads faster than governance.

At first it feels efficient. People save time, get better drafts and discover new ways of working. But without shared ground rules, that same speed can turn into risk.

That is when the questions start piling up:

Can customer data be entered into an external AI tool?
Who approves AI-generated content?
Which use cases must not be automated?
How do we make sure AI does not discriminate, leak information or draw incorrect conclusions?
Who is responsible if an AI suggestion leads to a wrong decision?

These questions are answered by AI Governance — in other words, the good governance of AI.

It is not mere bureaucracy. At its best, it is the organization's way of making AI safe, effective and scalable.

The EU AI Act is the world's first comprehensive legal framework for AI, and its aim is to promote trustworthy AI in Europe through risk-based regulation.^[1]

2. What does AI Governance mean?

AI Governance means the leadership, rules, responsibilities and oversight of AI within an organization. Put more simply, it answers the question:

Who may use AI, for what purpose, with what data, with which tools — and who is responsible for the outcomes?

That sounds administrative. But in practice it is about everyday decisions. For example:

May an employee use AI to summarize a customer document?
May the sales team feed CRM data to AI?
May HR use an AI tool to pre-screen applications?
May a customer service bot make refund decisions?
May AI suggest a diagnosis, a contract clause or a credit decision?
At what point does a human need to check the AI's output?

Good AI Governance makes these boundaries visible. Without it, the use of AI easily comes down to the personal judgment of individuals. That may work in a small pilot, but not once AI spreads across the entire organization.

3. Why has AI governance become critical right now?

AI is no longer just an IT department project. It is used by marketing, sales, customer service, HR, finance, product development, leadership, lawyers and analysts. That makes AI an exceptional technology: it does not stay in one system but quickly seeps into every layer of work.

Traditional software usually does what it was built to do. AI, by contrast, produces answers, assessments, recommendations and drafts depending on the situation. It can sound confident even when it is wrong.

AI brings at least four new challenges to an organization:

Usage spreads in a decentralized way. Employees can adopt tools without any central decision.
Data moves to new places. Customer data, personal data, contracts or trade secrets can end up in a prompt.
Quality varies. AI output can be excellent, mediocre or wrong — often in a very convincing form.
Accountability becomes blurred. If AI suggests and a human approves, who is really responsible?

NIST's AI Risk Management Framework was developed to help organizations manage the risks AI poses to individuals, organizations and society.^[2]

This is a good way to think about AI Governance: it is not just about making rules, but about understanding and managing risks.

4. The basic questions of AI Governance

1. What AI do we use?

Many organizations do not know. They may be using public AI services, enterprise AI tools, AI features built into the CRM or HR system, their own machine learning models, automations and agents that can use tools and carry out multistep tasks.

The first step in governance is an inventory: what AI systems and use cases actually exist in the organization?

2. What may AI be used for?

Not all uses are equal. Asking AI to brainstorm blog headlines is one thing; letting it score job applicants or propose a loan decision is quite another.

Good governance divides use cases into, for example, three groups: permitted; permitted under certain conditions; and prohibited or requiring separate approval.

3. What data may be given to AI?

This is one of the most important questions. The organization has to define whether AI may be given public information, internal information, customer data, personal data, sensitive personal data, trade secrets, contracts, source code or financial data.

If this is not defined, employees are left to guess. And guessing is a poor data protection strategy.

4. Who is responsible for the outcome?

AI does not carry responsibility. The organization and its people do. That is why every significant AI use case needs a named owner. Not an abstract “the business.” Not a vague “IT.” But clearly: who is responsible for quality, risk, oversight and decisions?

5. The anatomy of good governance: people, processes, tools and responsibilities

AI Governance is not a single document. It is a whole in which four elements work together.

People

You need roles: a business owner, a technical owner, a data protection officer, a security officer, a legal expert, risk management, users and leadership.

In a small startup, the same people may hold these roles. In a large organization, they are spread across different teams. What matters is not the org chart but that responsibilities are clear.

Processes

You need ways of working: how a new AI use case is approved, how risks are assessed, how data is checked, how AI output is validated, how errors are reported and how use cases are monitored over time.

Without a process, AI Governance remains a guideline on the intranet.

Tools

You need approved tools and technical limits. For example: which AI services are permitted, whether enterprise agreements are used, whether entered data is stored for model training, how logs are collected, how access rights are managed and how sensitive data is prevented from ending up in the wrong places.

Responsibilities

If an AI system makes a mistake, you need to know who notices it, who stops its use, who fixes the process, who communicates with customers or authorities and who decides whether to continue using it.

Good governance does not eliminate errors entirely. It makes them manageable.

6. AI ground rules in the organization

Every organization needs AI ground rules. Not an 80-page document nobody reads. But clear guidance that says what you may and may not do.

1. Approved tools

Employees need to know which tools they may use: approved general AI tools, approved enterprise tools, prohibited or unapproved tools, and guidance on browser extensions and unofficial apps.

2. Permitted use cases

For example: drafting text, summarizing internal documents if the data allows it, brainstorming, drafting translations, explaining code, and classifying customer feedback if data protection has been taken into account.

3. Prohibited or approval-required use cases

For example: processing personal data without approval, entering sensitive information into public tools, automated recruiting decisions, legal/medical/financial decisions without expert review, and customer-facing content in high-risk areas without human approval.

4. Data protection boundaries

This needs to be stated plainly. What data may be used? What may not be used? When does data need to be anonymized? When must only an approved enterprise environment be used?

5. Human approval

It is worth writing a clear human-in-the-loop principle into the ground rules:

AI may prepare a proposal, but a human approves the result before external use or any significant decision.

6. Error reporting

Employees need to know what to do if AI gives a dangerous answer, discloses incorrect information, makes a discriminatory suggestion, uses the wrong data or produces content that is harmful to a customer. A good culture makes reporting errors easy, not embarrassing.

7. Risk-based thinking: not all AI use is equal

One of the most common mistakes in AI Governance is treating all AI use the same way. That leads to a model that is either too lax or too heavy. If everything is allowed, risks spiral out of control. If everything requires heavy approval, nobody bothers to use AI sensibly.

Low risk

Examples: internal brainstorming, headline options, summarizing general text without confidential data, drafting training material.

Governance model: light guidelines, users' own review, no sensitive data.

Medium risk

Examples: drafts of customer messages, internal analyses, sales materials, classifying customer feedback.

Governance model: approved tools, human review before external use, clear data boundaries.

High risk

Examples: recruiting, credit decisions, health-related recommendations, insurance decisions, legal interpretations, HR decisions.

Governance model: separate approval, a documented risk assessment, human-in-the-loop, monitoring and auditing, clear responsibilities.

The EU AI Act imposes obligations on high-risk AI systems relating to risk management, documentation, human oversight and compliance with instructions for use, among other things. The obligations of deployers of high-risk systems include, for example, assigning human oversight, ensuring that input data is appropriate, monitoring the system's operation and keeping logs.^[3]

8. Data, privacy and security in AI governance

AI Governance without data governance is like traffic rules without roads. AI needs data. But not all data belongs in AI. An organization should define at least four data classes.

1. Public data

This can usually be used with lighter controls: public website content, public reports, general market information, public product descriptions.

2. Internal data

This may only be used in approved environments: internal guidelines, strategy documents, process descriptions, internal training materials.

3. Confidential data

This requires stricter limits: customer contracts, pricing, the sales pipeline, financial forecasts, product development plans.

4. Personal data and sensitive data

This is an area requiring close attention: employee data, customer data, health data, applicant data, identification data, payment data.

In AI governance, the data question is best framed like this:

What harm could be done if this data ended up in the wrong place, the wrong model or the wrong answer?

This question makes the risk visible.

9. Human-in-the-loop as part of AI Governance

Human-in-the-loop is one of the most important practical mechanisms of AI Governance. It means that a human reviews, approves or steers what the AI does. AI can produce the first draft, analysis or proposal, but a human takes responsibility for the final decision.

AI Governance defines the points at which this human role is needed. For example:

AI may write a draft reply, but a customer service agent approves it.
AI may summarize an application, but the recruiter makes the decision.
AI may flag risk signals, but an expert evaluates them.
AI may suggest contract wording, but a lawyer reviews it.
AI may classify feedback, but a human checks a sample and the outliers.

What matters is that human review is not a mere formality. If the human is only there to click “approve,” the governance is just for show.

A good question to ask is: Does the human really have the time, expertise and authority to change the AI's suggestion? If the answer is no, human-in-the-loop does not work.

10. AI Governance in companies and startups

In a startup, AI Governance can easily sound like too big a word. A small team has no compliance department, legal team or risk committee. It has founders, time pressure, customers and a need to get things moving.

Even so, startups in particular should think about AI Governance early. Not because they need to build heavy bureaucracy. But because early choices scale.

To begin with, a light model is enough for a startup:

approved AI tools
what data is never entered into AI
where a human approves AI output
who is responsible for customer-facing content
how AI use cases are recorded
how errors are handled

In a scale-up, the model expands. That is when an AI use case register, risk classification, auditing practices, vendor assessments, data protection impact assessments, staff training and management reporting come into play.

So good AI Governance does not mean a startup starts behaving like a bank. It means managing the use of AI with the same seriousness as customer experience, security and product quality.

11. Regulation: the EU AI Act, NIST and the OECD principles

AI Governance does not arise in a vacuum. It is shaped by rapidly evolving regulatory and reference frameworks. Three important reference points are the EU AI Act, the NIST AI Risk Management Framework and the OECD AI Principles.

EU AI Act

The EU AI Act is a risk-based regulatory framework. Its idea is simple: the greater the risk an AI system may pose to people, the stricter the requirements that apply to it.

For high-risk systems, the emphasis is on risk management, data quality, documentation, transparency, human oversight, logging and usage monitoring, among other things.

According to the European Commission, the AI Act is the world's first comprehensive legal framework for AI, and its aim is to address the risks of AI and strengthen Europe's position as a developer of trustworthy AI.^[1]

NIST AI Risk Management Framework

NIST's framework divides AI risk management into four core functions: Govern, Map, Measure, Manage. NIST's AI RMF Playbook describes these four functions and offers suggested actions, references and guidance for implementing them.^[4]

This is a practical model for companies too:

Govern: define responsibilities and principles
Map: map use cases, context and impacts
Measure: measure risks, quality and performance
Manage: manage, fix and monitor risks continuously

OECD AI Principles

The OECD's AI principles emphasize innovative and trustworthy AI that respects human rights and democratic values. The principles were adopted in 2019 and updated in 2024.^[5]

These principles can be distilled into an idea that matters for any organization: AI must be useful, but also responsible, transparent and human-centered.

12. Risks: what happens if governance is missing?

Without AI Governance, the use of AI may look modern from the outside, but on the inside it is out of control.

1. Shadow AI

Shadow AI means using AI without the organization's approval or visibility. Employees use tools because they are useful. But the organization does not know what is being used, what data is being entered, where the information is stored or what risks are arising. This is one of the most common governance challenges of the AI era.

2. Data risks

Confidential information can end up in the wrong place: customer data in a public AI service, contracts in tools with unclear terms of use, personal data in models that should not process it, source code in an unapproved service.

3. Quality risks

AI can produce incorrect, outdated or fabricated information. The problem is not just the error. The problem is that the error can sound extremely convincing.

4. Discrimination and bias

In recruiting, financing, education and service targeting, AI can reinforce existing biases. Without governance, nobody may notice the problem until the damage is already done.

5. Blurred accountability

When AI is part of a process, responsibility can fragment. Product says the business is responsible. The business says IT chose the tool. IT says the user approved the result. The user says the AI suggested it.

Good AI Governance breaks this chain by naming responsibilities in advance.

6. Runaway costs

Without governance, every team can buy its own tools. The result: overlapping licenses, weak negotiating power, security risks, a fragmented overall picture and inconsistent practices. Governance saves money because it creates visibility.

13. From AI Governance to an AI Operating Model

AI Governance is a good start. But ultimately an organization needs more than rules. It needs an AI Operating Model — an operating model in which the use of AI is part of everyday management.

This means AI has a place in strategy, processes, technology choices, risk management, training, metrics and on the management team's agenda.

AI Governance asks: What are the rules and responsibilities?

The AI Operating Model asks: How is AI used continuously, safely and effectively?

This is an important difference. Many organizations start with guidelines. The best organizations build a capability.

14. The future: AI governance becomes a core leadership skill

Next, AI will become increasingly autonomous. Agents can carry out multistep tasks, use tools, retrieve information, send messages, update systems and trigger processes. That makes governance more important than ever.

The AI Governance of the future cannot be just a document updated once a year. It has to be a continuous system.

1. AI inventories become a mandatory baseline

Organizations need to know where AI is used. Not roughly — for real.

2. Risk classification becomes routine

Every AI use case is assessed by risk. Light uses get light rules. High-risk uses get strong oversight.

3. Leadership has to take ownership

AI Governance cannot be left to IT alone. AI affects customers, employees, products, the brand, costs and accountability. That is why it belongs on the leadership agenda.

4. Human-in-the-loop becomes more precise

It is no longer enough to say that “a human checks it.” You need to define who checks, what they check, against which criteria, at what point, how the review is documented and when the AI is stopped.

5. Trust becomes a competitive advantage

Companies that can show they use AI responsibly may gain an edge in the eyes of customers, investors, employees and authorities. In the AI era, trust is not a soft value. It is business infrastructure.

15. Conclusions: what should you take away from this?

AI Governance is the management system of the AI era. It does not mean slowing down the use of AI. It means AI can be used more boldly, because the boundaries are clear.

These are the key takeaways:

AI cannot be led through experiments alone. As usage grows, shared ground rules are needed.
Governance is an enabler of efficiency. Good AI Governance reduces ambiguity — people dare to use AI when they know what is allowed.
Data is at the heart of governance. The biggest risk is not always the AI's answer. Often the biggest risk is what information is given to the AI.
Responsibility must be assigned. If nobody owns an AI use case, nobody is really leading it.
A risk-based approach makes the model sensible. Not everything needs to be governed with the same weight. But in high-risk use cases, a light touch can prove costly.
The human must not be a rubber stamp. Human-in-the-loop only works if the human has the expertise, time and authority.
AI Governance is a competitive advantage. The winners are those who can use AI reliably, safely and at scale.

Ultimately, AI Governance is a way of saying: We don't just use AI. We lead it.

16. Practical models and tools for organizations

16.1 A basic framework for AI ground rules

Purpose: Why does the organization use AI, and what does it aim to achieve with it?
Approved tools: Which AI tools may be used? Which may not?
Permitted use cases: What may AI be used for freely?
Use cases requiring approval: What requires approval from a manager, data protection, the legal team or the person responsible for AI?
Prohibited use cases: What must AI not be used for?
Data boundaries: What data may be entered into AI? What data must never be entered?
Human review: When must AI output be approved by a human?
Responsibilities: Who is responsible for the tool, the use case, the data and the outcome?
Error reporting: How are AI errors, incidents or suspicious answers reported?
Update cycle: How often are the guidelines reviewed, and who is responsible for updating them?

16.2 AI use case register

Use case name: [What is being done?]
Owner: [Who is responsible?]
Users: [Who uses it?]
Tool: [Which AI tool is used?]
Data: [What data is used?]
Risk level: [Low / medium / high]
Human review: [At what point does a human approve or review?]
Impact on people: [Could this affect customers, employees, applicants or other individuals?]
Data protection notes: [Does it include personal data or sensitive information?]
Approved: [Who approved it, and when?]
Monitoring: [How are quality, errors and impacts monitored?]

16.3 A quick risk classification model

Low risk: AI helps with brainstorming, drafting or internal work. No personal data, no customer impact, no decisions.

Medium risk: AI affects content visible to customers or employees. Human review before use.

High risk: AI affects a person's rights, job, health, money, access to services or a significant decision. Requires approval, documentation, oversight and continuous monitoring.

Prohibited or requires special approval: AI makes a decision without a human in a situation where the impact on a person is significant.

16.4 AI Governance responsibility matrix

Leadership: sets the strategic direction for AI, approves the risk appetite and principles, and secures resources.
Business owner: owns the use case, is responsible for benefits and quality, and ensures human review.
IT / technology: approves tools, manages access rights and ensures technical security.
Data protection: assesses the processing of personal data, provides guidance on data boundaries and takes part in high-risk assessments.
Security: assesses vendors and technical risks, monitors incidents and ensures safeguards are in place.
Legal team: assesses regulatory and contractual risks and supports high-risk use cases.
Users: follow the guidelines, review AI output and report errors.

16.5 The human-in-the-loop rule

AI may suggest. A human approves.
AI may speed things up. A human is accountable.
AI may analyze. A human assesses the impact.
AI may draft. A human verifies the facts, tone and consequences.

16.6 Ten questions on AI Governance for leadership

Do we know where AI is used in the organization?
Do we have a list of approved AI tools?
Do employees know what data may be given to AI?
Do we have prohibited use cases?
Has high-risk AI use been identified?
Who owns the most important AI use cases?
At what points does a human review AI output?
How are AI errors reported?
How do we measure the benefits and risks of AI?
When will the AI Governance model next be updated?

16.7 The first 30 days of launching AI Governance

Week 1: Appoint an AI Governance lead or a small working group. Compile a preliminary list of the AI tools in use. Identify the 5–10 most common use cases.

Week 2: Create the first version of the AI ground rules. Define permitted, approval-required and prohibited use cases. Spell out the data boundaries clearly.

Week 3: Create a use case register. Classify the most important use cases by risk. Define the human-in-the-loop checkpoints.

Week 4: Train the teams. Publish the guidelines. Open a channel for questions and error reports. Decide on the update cycle and ownership.

AI Governance is not a brake on AI. It is a steering wheel, a seat belt and a map in one package.

Without it, an organization can certainly move fast. But it may not know where it is heading, who is at the wheel and what happens if the road gets slippery.