Insights · Question
Do we need an AI governance policy?
If anyone in the organization uses AI tools with company or client data, or AI features inside existing tools shape decisions about people, money, safety or legal rights, yes. The policy states which tools are approved, what data may be entered, which uses require human review, how outputs are checked and disclosed, and what is logged, and it is paired with an inventory of where AI is actually used and with technical controls where they exist. Customers’ questionnaires now include AI sections, insurers ask, and regulators and frameworks such as ISO/IEC 42001 and the NIST AI RMF expect documented supervision. Most organizations discover during the inventory that AI is in far wider use than anyone had recorded.
In more detail
The reasoning.
A policy without approved alternatives is ignored, and a policy without an inventory governs uses nobody knows about. The order of work is inventory, classification by consequence, policy with supervision points, vendor and model review for the tools in use, and an evidence pack for the people who ask.
For consequential uses, such as AI in hiring, credit, healthcare or legal decisions, an impact assessment is required by several regimes and expected by the rest.
See acceptable-use and supervision policy, AI use inventory and classification, the AI governance and assurance service and what is ISO/IEC 42001.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 90 days