Now that we know we can work with AI, how do we build responsible frameworks for using it.
AI is here to stay. Like the internet, dot‑coms, and cell phones, it arrived quietly, almost by stealth. We assumed it was a fad. We thought it would pass. Instead, we opened the door, invited it into our homes, and it sat down at our kitchen tables and in our conference rooms.
Now it grows exponentially and threatens to take over our houses and our businesses. It lives in the ways we communicate, the food we buy, our means of transportation, and our government. It increasingly shapes our jobs, how we learn, our health, and our mental well‑being.
The statistics alone tell the story:
- 86% of students worldwide now use AI in their studies
- 1+ billion global users
- 89% of U.S. small businesses use AI
- The U.S. does not have the highest adoption rate (56%)
- Developers use AI at the highest rate (37–40%)
- Only 1 in 4 AI projects meet expected ROI
- Only 2% of ChatGPT users pay for the service — raising sustainability questions
We are well past the stage of asking “Can we?” and “Should we?” We are already here — and have been for years. What’s new is visibility: AI agents like ChatGPT, Copilot, and Claude make the technology feel suddenly present, suddenly personal.
AI now determines whether you get insurance and at what rate. It filters your résumé before a human ever sees it and then it even interviews you, assuming your résumé passed its filter.
This is the point where proactive governance must step in.
Governance Matters Now!
Governance is no longer optional. Any company or individual using AI must decide:
- Who determines when AI usage or capabilities are out of scope?
- What risks are acceptable?
- What controls must be in place?
In my earlier article AI Governance in Insurance: Why It Matters, I outlined five core pillars:
- Transparency
- Accountability
- Fairness
- Human oversight
- Auditability
These pillars all support one core human principle: trust.
Trust is not automatic. It is built slowly, through norms, expectations, and lived experience. As Composto et al. (2025) note, trust evolves during uncertainty, and mismatches between expectations and behavior weaken it.
AI introduces uncertainty at scale. If keeping up becomes too difficult, governance will always take a back seat — except in highly regulated industries.
The Gaps in Governance
Cybersecurity leaders at Black Hat 2026 highlighted several governance gaps that directly overlap with the pillars of accountability, oversight, and auditability:
- Companies are moving past tool‑monitoring and toward exposure and risk assessment.
- AI categories are blending: identity, exposure management, application security, infrastructure operations, and AI governance now appear in the same buying conversation — a sign of collapsing boundaries and rising complexity.
- AI‑generated content raises questions of sovereignty, intellectual property, and ownership.
These gaps affect every organization, not just enterprises.
What Steps Can Companies Take Today to Support Governance
Governance needs to be built continually around growing AI capabilities and use cases and every level. The responsibility to build governance frameworks lies with every entity that uses AI in any capacity, at both the macro level (industry, government, enterprise) and the small business, grass roots level (small businesses and teams).
Macro-Level Actions
- Standardize AI Risk Categories Across Industries=> Large organizations should adopt shared taxonomies for AI risk — identity, exposure, data privacy, model drift, IP risk — to reduce fragmentation and accelerate compliance.
- Require AI Use‑Case Inventories=> Enterprises and regulators should mandate inventories of AI tools, data flows, and decision points. This aligns with NIST’s AI Risk Management Framework and emerging EU AI Act requirements.
- Enforce Human Oversight for High‑Risk AI=> Hiring, healthcare, credit scoring, and insurance underwriting should require documented human review until systems demonstrate reliability. Industry regulators, like NAIC, are continuing to provide guidelines.
- Build Multi‑Layer Governance (ML + GenAI + Agentic AI)=> Governance must now cover legacy ML, generative AI workflows, and autonomous agentic systems — each with different risk profiles. Governance has to keep moving fast and efficiently!
- Incentivize Transparency and Auditability=> Regulators should encourage third‑party audits, model cards, and explainability standards to rebuild public trust.
Grassroots-Level Actions
Small businesses and teams need to apply lightweight, disciplined structures to support their AI processes. Current small business guidance emphasizes five core practices: policy, risk assessment, vendor vetting, monitoring, and sector-specific rules.
Here are some ways to embed those in your operations:
- Create an Approved AI Tool List=> Document which AI tools employees can use and which they cannot use. This prevents “shadow AI,” the #1 risk for small teams.
- Define Clear Data Rules=> State explicitly what cannot be pasted into AI tools: customer records, payment data, contracts, employee information, regulated data.
- Require Human Review for Customer-Facing Work=> AI can draft, but humans must approve refunds, complaints, pricing, legal language, and anything that affects trust.
- Assign Workflow Owners=> Every AI workflow needs an owner responsible for quality, cost, and error monitoring. No owner = no governance.
- Track AI Costs Monthly=> Subscriptions, usage fees, automation tasks, API calls. Tie them to workflows and ROI. If a tool doesn’t justify its cost, halt it.
- Log Mistakes and Near Misses=> Governance improves when errors are recorded. Keep a simple log of wrong drafts, failed automations, privacy concerns, and customer complaints.
- Build a Current-State AI Map=> Document how AI tools interact with your systems, processes, and people, including what controls already exist. This is your “governance baseline.”
- Create or Enhance a Data Dictionary=> Define your risk categories: privacy risk, operational risk, reputational risk, IP risk, compliance risk. This becomes your internal language for governance.
AI governance is not about creating a simple one-page policy document and storing it away. It’s a new paradigm in operating discipline that protects trust, reduces risk, and ensures AI serves human goals rather than replacing them.
Want more information about how to get started? Contact us!
