AI governance your team can actually follow
For a team of 50, AI governance isn't a policy binder. It's a short set of rules, built into the way the work runs, that everyone can read.
What governance means at your size
Three questions:
- What is AI allowed to do on its own?
- Who checks its work, and when?
- How do changes get made, and by whom?
If you can answer those in plain language, and the answers are built into how the work runs, you have governance. If the answers live in a document nobody opens, you don't.
Rules that are part of the process
The rules work best when the system enforces them, not when people have to remember them. Some I've built:
AI doesn't send to customers. The startup's sales pipeline drafts every email and sends none. The founder reads and sends each one. Where the tools allow it, the AI only gets permission to create drafts.
It asks instead of guessing. When a reply could belong to two people, it stops and asks in its report.
Every decision has a reason. It never marks a lead as lost without writing down why.
Keys never go in a chat. At the agency, API keys get saved safely and are never pasted into a conversation.
Changes are checked before they go live. When someone at the agency shares something new with the team, it's checked automatically: fixed checks first, then an AI review. Safe changes go live on their own. Anything risky waits for a person.
People only see their own data. On the agency's client dashboard, each client sees only their own work.
Start strict
It's easy to loosen a rule once the output has been good for a month. It's very hard to win trust back after the first bad send. More in Drafts, never sends.
What's out of scope
If you have formal legal or regulatory obligations around AI, you need a specialist for those. I set up the day-to-day rules your team works by.
How we'd start
Pick the AI use at your company that worries you most. I'll help you write the rules for it, and build them into the way it runs.
Common questions
What is AI governance?
The rules for how a company uses AI: what it may do on its own, who checks its work, how access is handled, and how changes are made.
Does a small team need AI governance?
Yes, but small. A few clear rules, built into the work, that everyone can read.
Should AI ever act without a person checking?
When a mistake is cheap, easy to notice and easy to undo, like an internal reminder. Anything customer-facing should start with a person approving it.
Do you handle legal compliance?
No. For formal regulatory obligations, use a specialist. I set up the working rules your team follows day to day.