AI governance
Seven questions to answer before your organisation rolls out generative AI
Generative AI tools are usually adopted before anyone has decided how to govern them. Seven questions to answer first, covering where AI is already in use, what data goes in, what the tools can reach, who checks the output, who owns it and which rules apply, and how to evidence the answers.
Most organisations did not decide to adopt generative AI. It arrived: in free chatbots staff found on their own, in browser extensions, and in new features switched on inside software you already pay for. The board then asks whether it is being governed, and the honest answer is often "not yet".
Governing it does not have to start with a large programme. It starts with answering seven questions. Each one below says why it matters and what a good answer looks like.
1. Where is AI already being used?
You cannot govern what you cannot see. Before setting rules, find out which tools are in use, by whom, and for what: approved enterprise tools, free consumer chatbots, browser extensions, and AI features inside your existing software such as email, CRM and document platforms.
A good answer: an inventory of AI tools and uses, built from a short staff survey, your software and expense records, and network or browser data where you have it. Expect it to be longer than you think.
2. What data is allowed to go in?
The biggest early risk is not the technology but what people paste into it: client documents, personal data, contracts, source code, financial results. Once it has left your organisation, you may not be able to get it back.
A good answer: clear rules linked to your existing data classification. For example, public information can go into any approved tool, internal information only into enterprise tools under contract, and confidential client or personal data only where a specific use has been assessed and approved.
3. What happens to that data on the provider's side?
Consumer and enterprise versions of the same tool often have very different terms. Check whether your prompts and files are used to train the provider's models, how long they are kept, where they are processed, and who at the provider can access them.
A good answer: each approved tool has been through your normal supplier checks, with the data terms recorded. If personal data is involved, you have considered whether a data protection impact assessment is needed under UK GDPR.
4. What can the tool reach inside your systems?
AI assistants built into your email, files and collaboration platforms can usually see whatever the user can see. If permissions have drifted over the years, with shared folders open to everyone or old project sites never locked down, the assistant will surface that content in seconds to anyone who asks the right question.
A good answer: permissions on sensitive repositories have been reviewed before the assistant is switched on, and connectors that let AI tools act on your systems are approved individually rather than enabled by default.
5. Where does a person check the output?
Generative AI produces fluent answers that can be wrong. That matters little for a first draft of an internal email. It matters a great deal for client advice, published content, code that goes into production, or anything used to make decisions about people.
A good answer: for each use, a defined point where a named person reviews the output before it is relied on, with stricter review for higher-risk uses. Decisions about people, such as hiring, performance or access to services, deserve particular care.
6. Who owns it?
AI governance often falls between IT, legal, data protection and the business, so nobody owns it. Without an owner, policies are written once and never updated, and new tools are adopted without anyone deciding whether they should be.
A good answer: a named senior owner, a simple route for approving new tools and uses, and AI on the board or risk committee agenda at regular intervals, not only after an incident.
7. Which rules apply, and could you evidence your answers?
Depending on your sector and markets, several sets of rules may reach your AI use: UK GDPR, sector regulators' expectations, client contracts, and the EU AI Act where you place AI systems on the EU market or the output of a system is used there. Clients and procurement teams are also starting to ask how you govern AI, and they want evidence, not assurances.
A good answer: you know which obligations apply to each use, and you hold the records that show how you meet them: the inventory, the policy, the risk assessments and the review points. ISO 42001, the management system standard for AI, gives that evidence a recognised structure, and it shares much of its framework with ISO 27001 if you already hold it.
What an AI acceptable use policy should cover
Questions 1 to 6 translate into a short policy staff can follow:
- which tools are approved, and how to request a new one;
- what data must never be entered, with examples;
- when output must be checked, and by whom;
- how to report a mistake or a data leak involving an AI tool;
- who owns the policy and when it is reviewed.
Keep it to a page or two. A policy nobody reads protects nobody.
Where Threat Protect fits
Our AI governance and assurance service helps you answer these questions and keep the answers current. We start with a discovery of where AI is already in use and which uses carry real risk, then build the policy, risk assessment and human oversight, and the documentation that evidences them, on your existing management system wherever possible. We help you build audit-ready AI governance and prepare for the EU AI Act, and when you want ISO 42001 certification, it is delivered through certified assessment partners.
To see where you stand, try the EU AI Act readiness check, read our EU AI Act readiness guide or the practical guide to AI governance, or book a call and tell us how AI is showing up in your organisation.
Further reading
Frequently asked
Questions readers ask before getting in touch.
- Shadow AI is the use of AI tools at work without the organisation's knowledge or approval: staff pasting documents into a free chatbot, browser extensions that summarise pages, or AI features switched on inside software you already pay for. It is rarely malicious, but it means data can leave the organisation without any of the checks you would apply to a new supplier.
- If your staff can reach generative AI tools, and almost all can, then yes. A short policy that says which tools are approved, what data must never go into them, and who to ask is more useful than a long one nobody reads. It should be reviewed as tools and rules change.
- It can. Under UK GDPR, a DPIA is required where processing is likely to result in a high risk to individuals, and the ICO treats innovative technology as one of the factors to consider. If personal data will go into the tool, or its output will be used to make decisions about people, assess whether a DPIA is needed before rollout.
- It can, where you place AI systems on the EU market, or where the output of an AI system you use is used in the EU. Many everyday business uses, such as drafting assistance, carry light obligations, while uses in defined high-risk areas carry much heavier ones. Our EU AI Act readiness guide covers the scope and timeline.
- No. ISO 42001 is a management system standard for AI. It gives you a recognised structure for governing AI and evidencing it, which clients and procurement teams increasingly look for, but certification is not a legal determination that you meet the Act. It is a strong foundation for preparing for it.
Talk to us
Want to talk through how this applies to your company?
A 30-minute call with a senior advisor. No pitch. We will read your situation against what is in this piece and tell you the smallest sensible next step.