Can you imagine finding out that ten (or more!) people in your company are using five different AI tools to do their jobs, and no one can tell you what information is being entered into them?
For a lot of business leaders, that probably does not require much imagination.
AI adoption is happening quickly, and much of it is happening from the bottom up. An employee finds a tool that helps write a proposal. Someone else uses AI to summarize meeting notes. A department starts experimenting with automation. Another team pays for a different platform because it solves a specific problem.
Individually, each decision may make sense. Collectively, you can end up with AI sprawl before leadership even realizes it has an AI environment to manage.
That is why I believe AI governance has to become part of business conversation now.
Not because companies should slow down their use of AI. Quite the opposite. Good governance makes it easier to use AI with confidence.
Start With a Simple Question: What Are We Allowing?
When I talk with executives about AI, one of the first things I think organizations need is surprisingly basic: an acceptable-use policy.
Employees need to know what is allowed, what is not allowed, and where the boundaries are. There needs to be clear and understandable guardrails.
Can someone put client information into a public AI tool? What about financial data? Internal documents? Employee information? Can teams purchase their own AI applications? Who reviews a new AI tool before it becomes part of a workflow?
If the answer to those questions is “we have not really decided,” then the organization already has a governance issue.
And telling employees not to use AI is probably not a realistic strategy.
People are going to use tools that make their jobs easier. The better approach is to give them clear, practical rules for using those tools responsibly.
WorkSmart’s own AI strategy follows that same principle: start with the workflow and business outcome, establish appropriate governance and data guardrails, then determine which technology belongs in the solution.
Governance Should Not Be a 50-Page Document Nobody Reads
When business leaders hear the word “governance,” they sometimes picture policies, committees, and layers of approval that make it harder to get anything done.
It does not need to look like that.
At its core, AI governance should help answer a few practical questions:
- Which AI tools are approved for business use?
- What information can and cannot be shared with those tools?
- Who is responsible for evaluating new AI applications?
- Which business processes are appropriate for AI?
- Where is human review still required?
- How will we know whether an AI initiative is actually producing value?
- How do we revisit those decisions as technology changes?
That is a manageable starting point.
Organizations can build more sophistication as their use of AI grows. NIST’s AI Risk Management Framework takes a similar approach, giving organizations a voluntary structure for managing AI risk across the design, deployment, use, and evaluation of AI systems. Its generative AI profile extends that framework specifically to the risks associated with generative AI.
ISO/IEC 42001 takes the idea further by providing an international standard for an AI management system, including policies, responsibilities, risk management, monitoring, and continual improvement.
The point is not that every organization needs to implement a formal standard tomorrow. The point is that responsible AI use requires structure.
You Cannot Govern What You Cannot See
Before making a big AI investment, I would want to understand what is already happening inside the business.
Which tools are employees already using?
Which departments are experimenting with AI?
What business problems are they trying to solve?
What company data is involved?
Are multiple teams paying for tools that perform essentially the same function?
This is where AI governance and AI strategy start to overlap.
Sometimes the biggest opportunity is not buying another tool. It is discovering that employees are already using AI to solve a legitimate business problem and then creating a safer, more scalable way to do it.
Other times, the right decision may be to consolidate tools, establish a standard platform, improve data controls, or stop using an application altogether.
That is also why WorkSmart’s AI Readiness approach looks at current and shadow AI usage alongside data security, technology, governance, workforce readiness, and business opportunities. The objective is to understand both where AI can create value and where unmanaged use is creating risk.
Governance and Innovation Are Not Opposites
I think this is an important distinction.
The organizations that put sensible guardrails around AI are not necessarily the ones being cautious. They may actually be in a better position to move faster.
Think about the alternative.
Every department selects its own applications. Nobody owns the AI strategy. Security evaluates tools after they have already been adopted. Leadership does not know what data is moving where. Employees are unsure about what they are allowed to do, so some move ahead while others avoid AI altogether.
That is not innovation. It is inconsistency.
Governance creates a framework for making decisions. Once people know the rules, they can spend less time wondering what is permitted and more time identifying valuable applications.
The goal should not be to control AI for the sake of control.
The goal should be to create enough structure that the organization can use AI deliberately.
Tie AI Back to the Business
The other mistake I see is treating AI strategy as a technology strategy.
I do not think the first question should be, “Which AI platform should we buy?”
I think the first question should be, “What are we trying to improve?”
Maybe you are trying to shorten a process that takes employees six hours every week. Maybe you want your team to find information faster. Maybe a manual handoff is slowing down customer service. Maybe there is repetitive administrative work that keeps skilled employees from focusing on higher-value responsibilities.
Start there.
Then look at whether AI is the right answer, what information it needs, what risks need to be managed, how success will be measured, and who will own the outcome.
That is a much healthier conversation than starting with the tool.
It also gives leadership something concrete to evaluate. Did the workflow improve? Did employees actually adopt it? Are we faster and more accurate? Did it create a new risk somewhere else? What quantifiable benefits are we experiencing?
AI should earn its place in the workflow.
The Best Time to Establish the Rules Is Before You Need Them
Most organizations do not need a massive AI transformation plan to get started.
They need visibility.
They need some basic rules.
They need ownership.
And they need to connect AI investments to real business priorities.
If your organization is already experimenting with AI, governance is not something to address after the strategy is finished. It is part of the strategy.
The companies that handle this well will not be the ones that simply adopt the most AI.
They will be the ones who understand where AI belongs, where it does not, and how to use it in a way that supports the business without creating unnecessary complexity or risk.
That is a much better definition of progress.
Donald DeMarco
CEO, WorkSmart IT Services
Sources
National Institute of Standards and Technology, AI Risk Management Framework (AI RMF). NIST AI Risk Management Framework
National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST Generative AI Profile
International Organization for Standardization, ISO/IEC 42001: Artificial Intelligence Management Systems. ISO/IEC 42001 overview