Risk, Rules & Governance

Good AI strategy includes rules. Leaders want speed, and they also want to avoid harm, fines and bad headlines. This lesson shows how to set simple, useful rules for AI: who owns each system, how risky it is, what needs human approval, and which laws and standards to know.

Why rules help speed

Clear rules do not slow people down. Their absence does. When nobody knows what is allowed, teams either wait for approval or act in secret. A short policy lets people move with confidence.

An AI policy that people read

A policy should fit on two pages. It answers the questions people really ask.

• Which AI tools are approved, and how do I ask for a new one?
• What data may I put into an AI tool, and what must never go in?
• Who must check AI output before it is sent or used?
• How do I tell customers when AI is involved?
• Who do I tell when something goes wrong?

Sort projects by risk

Not all AI projects carry the same risk. Use tiers, so low-risk work moves fast and high-risk work gets more care.

TIER 1 - LOW RISK (team lead approves)
Internal drafting and summaries, no personal data, a person reads everything.

TIER 2 - MEDIUM RISK (owner + security + privacy review)
Customer-facing answers with checks, uses personal data under existing consent,
actions that can be undone.

TIER 3 - HIGH RISK (formal review board, testing evidence, human sign-off)
Decisions about people (hiring, credit, health, benefits), money movement,
legal or safety impact, actions that cannot be undone.

For every project record: owner, data used, who checks output, how mistakes are found,
how a person can override, and the stop plan.

Know the main frameworks

You do not need to be a lawyer. You do need to know the names and the ideas, and to ask a lawyer when stakes are high.

• NIST AI Risk Management Framework: a voluntary guide from the United States. It groups the work into govern, map, measure and manage.
• EU AI Act: a European law that sorts AI uses by risk and sets duties for each level. Check how it applies to you.
• Privacy laws such as GDPR: rules about personal data, consent and rights. They apply to AI as they do to any system.
• ISO/IEC 42001: an international standard for an AI management system that organizations can be audited against.

Human oversight that works

Saying a human reviews everything is not enough. Ask whether the person has time, skill and authority. A reviewer who sees a hundred items an hour will click approve on all of them. Design review for the risky cases and sample the rest.

Vendors and data

• Where does our data go, and is it used to train the vendor's models?
• How long is data kept, and how is it deleted?
• Which regions is it stored in? Does that fit our rules?
• What happens if the vendor changes terms or shuts down?

When something goes wrong

Have a plan before the first incident. Name who decides, who tells customers, how to switch the system off and how to learn from it afterwards. Practice once, in a calm meeting. Teams that rehearse respond better.