The small AI governance pack every team should have

Many teams delay AI governance because they imagine a large committee, a permanent review queue and a policy that will be outdated before it is approved. The alternative is not to ignore governance. It is to begin with a small set of working documents tied to real decisions.

1. A one-page use-case card

Every proposed use should state the user, the decision or task being supported, the model or service involved, the data it receives, the output it creates and the person accountable for the outcome. A short card creates a common language and makes hidden assumptions visible.

2. Simple risk tiers

Not every experiment needs the same review. A drafting assistant for internal notes is different from a system that influences hiring, pricing or access to a service. Define a small number of tiers using practical triggers such as sensitive data, external impact, automation level and reversibility.

3. Clear data handling rules

People need to know what can be entered into which tools. Name the approved services, prohibited data classes, retention expectations and escalation route. Avoid relying on a general instruction to be careful; it is too vague to guide day-to-day work.

4. An evaluation record

Record what was tested, which examples were used, where the system performed poorly and what human checks remain. The record should be understandable by someone who did not build the solution. This matters when a prompt changes, a model is replaced or the use case expands.

5. A named owner register

Each live use case needs an owner for performance, an owner for the underlying business process and a clear route for incidents. One person may hold more than one role, but the responsibilities should not be implied.

These documents will not answer every policy question. They do something more useful at the start: they create traceability, proportional review and a repeatable way to say yes, no or not yet.