CIOPages
The six jobs/Job 02

Govern the AI already in use

Staff already use AI tools the company never approved, and the SaaS products you license keep adding AI features. The work is to find what is running, set the rules, decide who approves new AI, and meet the laws that now apply.

The decisions

5 decisions make up this job

  1. 1

    Where governance sits

    Set up a separate AI review board, or add AI questions to the reviews you already run: architecture, security, privacy, procurement and third-party risk.

  2. 2

    What is already running

    List the AI tools staff use, the AI features inside licensed SaaS, the models you call and the agents teams have built. Every later decision starts from this inventory.

  3. 3

    The rules for staff

    Name the approved tools, the data each may touch, and what happens when someone breaks the rules. Consumer and enterprise terms differ on whether your data trains the model.

  4. 4

    Risk tiers and who approves

    Sort AI uses by risk. For each tier, decide what has to happen before go-live (testing, documentation, sign-off) and who signs.

  5. 5

    Which rules apply

    The EU AI Act has applied since August 2, 2026, with exceptions. ISO/IEC 42001 and the NIST AI Risk Management Framework give the structure most programs follow.

Blueprints and templates

Design AI management as a function

How use cases are approved, how agents are specified, limited and retired, which controls apply at which risk tier, and who decides.

Inside the blueprint

AI Management: AI Transformation Blueprint

298
capabilities in the AI management model
239
KPIs
12
value streams in 60 stages, today and with AI
116
entities in the data model
Includes a leadership presentation template for the board.Open it →
How others did it

Trench Notes on this job

Each page sets out the steps and the documents, and practitioners add what they learned doing it.

  • Setting up AI governanceRead
  • Securing AI agentsRead
  • Writing an AI acceptable use policyPublishes November 16, 2026
  • Building an AI inventoryPublishes December 31, 2026
  • Assessing AI riskPublishes December 3, 2026
  • Managing shadow ITPublishes December 2, 2026
  • Evaluating LLM applicationsPublishes January 7, 2027
  • Writing a data classification policyPublishes February 1, 2027
  • Complying with the EU AI ActPublishes February 19, 2027
Choose the technology

Buyer Guides, comparisons and RFP questions

Also on CIOPages

More for this job

Keep reading

Checklist
API Strategy & Governance Checklist

Assess API program maturity across design, security, documentation, and lifecycle.

Assessment
Transformation Execution Risk

Will Your Transformation Actually Succeed — or Stall?

Decision apps

Apps for this job

Enter your situation and each app returns a working document you can take into the meeting.

Shadow AI Exposure RegisterInventory the AI-built apps and automations sprawling across your org, score each on data, blast radius, and ownership, and assign a disposition before they become incidents.AI Coding Governance Policy BuilderGenerate a tiered, board-ready acceptable-use policy for AI coding tools — calibrated to your industry, risk appetite, and the data your teams touch.AI Agent Reality TestPressure-test a proposed AI agent initiative against the prerequisites that determine success.Vendor Security Questionnaire Auto-FillerDraft answers to vendor security questionnaires from your security profile, with placeholders for details to fill in.

No charge. Sign in with your work email to use them.

The other jobs
Job 01Decide where AI goes in the businessJob 03Choose and buy technologyJob 04Control technology spendJob 05Modernize the estateJob 06Secure and comply