Governing the AI you already have

Most organizations don't have an AI adoption problem. They have an AI governance problem. The tools are already in use (often faster than anyone can inventory them) and oversight hasn't caught up. The answer isn't a moratorium. It's a governance backbone that lets the business move while someone is genuinely accountable for the risk.

The gap is real, and it's widening

Adoption is running well ahead of oversight. Surveys consistently find that most employees now use generative AI at work, while only a minority of organizations have a clear usage policy: “shadow AI” that quietly routes sensitive data into systems no one has vetted. Meanwhile the risks are new in kind, not just degree: models that confidently fabricate answers, prompt injection, training-data and intellectual-property leakage, bias surfacing in credit or claims decisions, and third-party model dependencies inherited without ever being seen. Traditional IT-risk frameworks weren't built for systems that behave probabilistically and shift under you.

A backbone that already exists

You don't have to invent AI governance from scratch. The NIST AI Risk Management Framework (AI RMF 1.0, released in 2023) has become the de facto reference, and it is built around four functions:

• Govern, the cross-cutting function: who is accountable, what the policies are, and how oversight works across the AI lifecycle. It is the one function that spans the whole organization.
• Map, establish context: where AI is used, by whom, for what, and what could go wrong. Most programs discover their real AI inventory at this step.
• Measure, actually test: accuracy, bias, drift, and adversarial and safety evaluation, with evidence. This is the step most programs skip.
• Manage, prioritize and respond: mitigate, transfer, or accept residual risk, with monitoring and incident response.

Every control maps back to one of the framework's characteristics of trustworthy AI (valid and reliable, safe, secure and resilient, accountable and transparent, explainable, privacy-enhanced, and fair) so the conversation stays in terms a board can follow. For generative AI specifically, NIST's companion Generative AI Profile (July 2024) extends the framework with a set of risk categories aimed squarely at large language models and agents, from confabulation to prompt injection to data leakage.

A policy no one can produce evidence for isn't governance. It's a document.

The failure mode: governance on paper

The most common way AI governance fails isn't the absence of a policy: it's stopping at one. Organizations complete Govern and Map, producing a charter and an inventory, then never operationalize Measure, because they lack the data and testing infrastructure to benchmark risk consistently. Without measurement, Manage has no evidence base and risk decisions become guesswork. A program that can't produce evidence isn't governance; it's paperwork.

Why this matters now

The AI RMF is voluntary, but the concepts it uses are the same ones appearing in binding regimes: the EU AI Act's risk tiers and obligations, ISO/IEC 42001 as a certifiable management system, and supervisors' sharpening questions. Enterprise buyers already ask vendors how they govern, map, measure, and manage their AI, and vague answers read as a risk signal. Building the muscle now, while it is still voluntary, is how organizations adapt quickly when it isn't, and the direction of travel is plainly toward more expectation, not less.

What boards should ask

Directors don't need to become AI engineers. They need to ask five things: Do we know where AI is used across the business, including tools we never sanctioned? Who is accountable for it? What have we actually tested, and what did we find? What data are we putting into these systems, and where does it go? And how would we know if a model began behaving badly? Confident, evidenced answers mean the governance is real. Reassuring but vague answers mean it isn't yet.