AI Governance Program
For boards, executive teams and risk teams. You leave with a policy, rules for acceptable use, named accountability and a governance framework the team can run.
- Boards
- Executive and risk teams
- Policy and acceptable use
- A framework you keep
Why teams call
The problem
Staff are already using AI. Some of that use sits in a tool the organisation approved. A lot of it does not. People paste client notes, customer records and draft decisions into public chat tools because the approved path is slow, unclear or missing. The board, the executive team or the risk team often hears about a use after it has already happened.
A policy in a shared folder does not change that habit. Staff cannot follow a document they have not been shown, and a rule with no owner is a rule nobody applies on the job. Accountability for an AI decision is often split across IT, legal, the business owner and the vendor. When something goes wrong, nobody can say who signed off.
The National AI Centre's Guidance for AI Adoption sets six practices for this work: decide who is accountable, understand impacts, measure and manage risk, share essential information, test and monitor, and keep a person in control. ISO/IEC 42001 describes the same kind of system. Put the policy and the roles in place, run them, and check that they still work. This program turns those practices into a policy, a register and named owners.
The room
Who it is for
Boards
Directors who need to know which AI uses exist, which ones carry risk, and who is accountable for each. The session gives the board a short briefing and a decision log it can ask management to keep current.
Executive teams
Leaders who approve AI spend and need a policy staff will follow. The work names an executive owner, writes the rules in plain language, and sets who reviews the register and how often.
Risk, legal and compliance
The people who already own privacy, security and conduct risk, and who need AI use on the same register. They help set the impact and risk criteria, and the line for when a person stays in control.
The work
What the program covers
- 01
See the current use
We list the AI uses the organisation already knows about, and the ones staff are running with no rule in place. Client material, customer records and draft decisions that go into a public tool are on that list, because the policy has to cover the use that is already happening.
- 02
Policy and acceptable use
We write what the organisation will allow, as rules a team can apply on the job. The rules say which data must stay out of a public tool, what must be shared with the owner, and where a person reviews the output before it is used.
- 03
Risk and accountability
Each use gets an owner, a note on its impact, and a person who watches the risk. The session also writes what happens when a use has to stop, so accountability is a name on the register and a clear line for that stop.
- 04
A framework the team runs
The team leaves with a way to test and monitor uses, a record of what is in play, and a review date. The review is how the framework stays in use after the sessions: run the rules, check them, and improve them.
The checklist is the six practices in the National AI Centre's Guidance for AI Adoption, October 2025: decide who is accountable, understand impacts, measure and manage risk, share essential information, test and monitor, and keep a person in control.
The way the team runs that framework follows ISO/IEC 42001, the international standard for an AI management system: put policy and roles in place, run them, and check that they still work.
The shape
Format and duration
Working sessions with the board, the executive team or the risk team. In the room the group writes a draft policy, a first register of uses and the names of the owners. The program is complete when that team has the policy, the acceptable use rules and the framework it will run.
A follow-up review checks whether the policy is in use and whether new AI tools have been added to the register. The shape follows ISO/IEC 42001: put the policy and the roles in place, run them, and check that they still work. A certification audit stays a separate decision.
The check
How impact is measured
Before the sessions we record whether a policy exists, whether staff can find it, and how many known AI uses have a named owner. After the follow-up review we record the same three things on the same register.
The comparisons are plain. More uses written down, fewer uses with no owner, and a policy people can point to. A file in a shared folder counts as a document. It counts as in use when staff can find the rules and the register has owners.
At the end
What you leave with
Policy and rules
An AI policy and acceptable use rules written so staff can read them in one sitting. The rules cover which data stays out of a public tool, and when a person reviews the output before anyone relies on it.
Named owners
A named person who decides on each use, a named person who watches the risk, and a written stop when a use needs one. The register carries the names, so accountability is no longer split across IT, legal and the vendor with nobody signing off.
A framework
A register of uses, a review rhythm, and the habit of keeping a person in control of the decision. The team knows who checks the register, how often, and what gets escalated to the executive team or the board.
Questions
Common questions
- Does this certify us to ISO/IEC 42001?
- No. You leave with a framework the team can run. A certification audit is a separate decision.
- Who needs to be in the sessions?
- The people who will own the policy. That may be the board, the executive team or the risk team.
- Which guidance do we use?
- The National AI Centre's Guidance for AI Adoption, October 2025, and the management-system shape of ISO/IEC 42001.
- What if people are already using tools with no rule in place?
- We start from that use, including uses nobody has written down, and the rules have to cover it.
Other programs
Enquire now
Ask us about a program.
Enquire now