Beyond the Policy Document

When organisations talk about AI governance, they usually mean one of two things: either the regulatory compliance requirements they need to meet, or the internal policy documents they have produced to demonstrate that they take AI seriously.

Both of these things matter. But neither of them is governance. Governance is what happens when a team is about to deploy an AI system and someone asks the right questions. It is the process by which decisions about AI use get made, reviewed, and held accountable. It is the organisational muscle that determines whether AI is used in ways that are consistent with the organisation's values and obligations — not just on the day of deployment, but six months later when the system is running in production and nobody is paying close attention.

Building that muscle is harder than writing a policy. It is also considerably more valuable.

The Three Questions Every AI Deployment Should Answer

Before any AI system goes into production, three questions should be answered clearly and documented.

First: what decision or action is this system influencing, and who is affected by it? This sounds obvious, but it is frequently skipped. Teams focus on what the system does technically and lose sight of what it does in the world. An AI that ranks job applications is not just a ranking tool — it is a system that influences who gets hired. An AI that flags transactions for review is not just a filter — it is a system that determines whose financial activity gets scrutinised.

Second: what happens when the system is wrong? Every AI system makes errors. The question is not whether errors will occur but what their consequences are and how they will be detected and corrected. A system that occasionally misclassifies a low-stakes item is very different from one that occasionally misclassifies a high-stakes one.

Third: who is accountable for this system's outputs? Not technically accountable — that is usually clear. Accountable in the sense that if the system produces a harmful outcome, there is a named person or team whose job it is to respond. Without that accountability, governance is theoretical.

The Human in the Loop: When It Helps and When It Does Not

Human oversight is often presented as the solution to AI governance challenges. If a human reviews the AI's output before it takes effect, the thinking goes, the risks are managed.

This is sometimes true. For high-stakes, low-volume decisions — a credit application, a medical diagnosis, a hiring recommendation — meaningful human review can genuinely catch errors and add context that the AI lacks.

But for high-volume, low-stakes decisions, human review is often illusory. When a human is asked to review thousands of AI outputs per day, they are not reviewing them — they are rubber-stamping them. The cognitive load is too high, the time per decision too short, and the incentive to push back too low. The human in the loop becomes a liability shield rather than a genuine check.

Good governance is honest about this distinction. It asks not just whether a human is in the loop, but whether that human has the time, information, and authority to actually intervene when something is wrong.

Data Quality and Model Drift: The Governance Problems Nobody Talks About

Most AI governance discussions focus on the moment of deployment. Far less attention is paid to what happens after deployment — which is where most of the real governance challenges occur.

AI systems are trained on data that reflects the world at a particular point in time. As the world changes, the relationship between the system's inputs and the outcomes it is trying to predict can shift. A model trained on pre-pandemic booking patterns will behave differently in a post-pandemic market. A model trained on one customer segment will produce different results when applied to another.

This drift is not always obvious. The system continues to produce outputs. The outputs continue to look plausible. But the quality of those outputs may be degrading in ways that are only visible in aggregate, over time, to someone who is actively looking.

Governance means having a process for monitoring model performance after deployment, not just before it. It means defining the metrics that would indicate drift, setting thresholds that trigger review, and having a clear process for retraining or replacing a model when those thresholds are crossed.

Governance for Smaller Organisations

Much of the published guidance on AI governance is written for large enterprises with dedicated AI ethics teams, legal departments, and compliance functions. For smaller organisations — independent hotels, SaaS startups, mid-size operators — it can feel irrelevant or disproportionate.

It is not. The governance challenges are the same; the mechanisms just need to be proportionate to the scale.

For a smaller organisation deploying AI, governance might mean: a simple checklist that any team member can complete before a new AI tool is adopted, a designated person (not necessarily a specialist) who is responsible for reviewing AI-related decisions, a quarterly review of the AI tools in use and whether they are performing as expected, and a clear process for raising concerns about AI outputs.

None of this requires a dedicated team or a large budget. It requires intention — the deliberate decision to treat AI adoption as something that deserves structured thinking, not just enthusiasm.

Governance as Competitive Advantage

There is a tendency to frame AI governance as a cost — a compliance burden, a constraint on speed, a set of hoops to jump through before you can do the interesting work.

The organisations that are getting this right see it differently. They see governance as the thing that allows them to move faster with confidence, because they have the processes in place to catch problems before they become crises. They see it as a source of trust with customers and partners, who increasingly want to understand how the AI systems they interact with are managed. And they see it as a foundation for sustainable AI adoption — the difference between deploying AI that keeps working and deploying AI that creates problems you spend years cleaning up.

Good governance is not the opposite of good AI. It is what makes good AI possible.