An AI Governance Framework a Leadership Team Can Actually Use

At some point this year your board chair will ask how the company is using AI. "IT is looking into it" is not an answer, because the question is not about technology. It is about what the company allows, who decided, and how you would know if something went wrong.

An AI governance framework is the short set of decisions that answers that question. For a company of 50 to 500 people it covers five things: what may go into AI tools, who approves a new use, where a human must sign off, what gets recorded, and how often the leadership team reviews it. It fits on one page, and the page has an owner.

This article walks through those five decisions, then gives you a one-page AI policy template you can adapt in an afternoon.

Not legal advice. This is operational guidance for leadership teams. Rules on AI, data protection and employment differ by country, state and sector, and they are changing. Check what applies to you with counsel before you treat any policy as complete.

Why an AI governance framework belongs to the leadership team

Most companies already use AI, whether or not anyone decided they would. Someone in finance pastes a supplier contract into an assistant to summarize it. A sales manager drafts proposals with one. A recruiter's applicant tracking system shipped a ranking feature in a release note nobody read. None of this is a scandal. All of it is unmanaged.

Handing the problem to IT feels natural and does not work, for a simple reason: IT can tell you which tools are installed and how they are secured. It cannot tell you whether the sales team should be putting customer pricing into a third-party tool, or whether a manager may use AI to draft a performance review. Those are business decisions about risk and judgment. They belong to the people who answer for the business.

The good news is that the decisions are few. The hard part is making them explicit.

The five decisions in an AI governance framework

1. What may go in

This is the decision that prevents most real damage, so make it first. Sort your information into three or four classes and say plainly what each class may touch.

The most useful line on this table is the right-hand column. Most incidents start with a person using a free tool on a personal account because it was faster, not because they meant harm.

2. Who approves a new use

Name one executive who says yes or no. Not a committee: a committee is where requests wait. IT checks security, legal or HR is consulted where people or contracts are involved, and the named executive decides.

Tier the approval by risk so low-risk uses do not queue behind high-risk ones:

• Low risk (public information, a person reviews everything before it is used): the team lead decides and tells the owner.
• Medium risk (internal or confidential information, output used inside the company): the named executive approves.
• High risk (output that affects a customer, a payment, or a decision about a person): the named executive approves, and the leadership team is told.

3. Where a human signs off

The line that matters is between AI that proposes and AI that acts. A proposal is a draft a person reads, changes and accepts. An action is an email that has been sent, a record that has changed, a candidate who has been filtered out.

Write down the outputs that always need a named person's approval before they take effect. For most companies the list starts with anything sent to a customer, anything that moves money, and any assessment of a person: hiring, pay, performance, discipline. That last category gets the most legal attention in most places. See AI in hiring and performance for why consequence to a person is the trigger, rather than how sophisticated the model is.

4. What gets recorded

If a decision was informed by AI, you should be able to say afterwards what the AI produced, what it was given, who accepted it, and what changed between the draft and the final version. For tools you buy, that record has to come from the vendor. Ask for an export, not a description. The twelve questions in how to audit what your AI assistant did will tell you quickly whether a tool can produce one.

For informal use, such as a manager drafting a document, the record can be as light as keeping the final version and noting that AI drafted it.

5. How often it is reviewed

Quarterly is enough for most companies of this size. Put it on the leadership team agenda for twenty minutes: what new uses were approved, anything that went wrong, anything a vendor changed. Three things force an earlier look: an incident, a new tool that touches people decisions, or a change in the rules where you operate.

A one-page AI policy template

This is the page your board chair can read. Replace the bracketed text, delete what does not apply, and give it a date and an owner.

Two lines on that page do more work than they appear to. "Anything not on the list needs approval before use" makes the default no, which is the only default you can defend. And "reporting quickly is never a disciplinary matter in itself" is what gets mistakes reported while they are still small.

Worked example: a 180-person distribution company

An illustration of how this goes in practice, not a case study.

The COO asks every department head one question: "Which AI tools does your team use, and for what?" The answers come back in a week. There are eleven tools in use, four of them on personal accounts. Finance is summarizing supplier contracts in a free assistant. HR's recruiting software has a candidate ranking feature switched on by default.

The leadership team spends one meeting on it:

1. Approved tools: they keep three, all company accounts, and move the finance work to one of them.
2. What may go in: supplier contracts are confidential, so the free tool is out the same day.
3. Human sign-off: the ranking feature is switched off until HR can show who reviews the ranked list and how a rejected candidate's question would be answered.
4. Records: the approved tools can export their history, which is part of why those three were kept.
5. Review: twenty minutes on the leadership agenda each quarter, owned by the COO.

When the board chair asks, the CEO hands over one page and says who owns it. That is the answer the question was looking for.

Treat it like any other priority: give it an owner and a measure

A framework that nobody measures becomes a document. Give it two or three measures the owner reports on each quarter: the number of tools in use that are not on the approved list, the number of high-risk uses approved this quarter, and how many reported mistakes were closed. These are ordinary KPIs with an owner and a baseline, built the same way you would create KPIs for any department.

Governance also is not only defensive. Once the leadership team knows what can safely go into a tool, the more useful question becomes where AI should help the business, and planning is where most leaders underuse it. AI for strategic planning covers how to let AI draft measures and targets from your strategy while leaders keep the decisions.

Mistakes worth avoiding

Banning AI outright. People keep using it, on personal accounts, where you have no visibility at all. A ban moves the risk somewhere you cannot see.

Writing a twenty-page policy. Nobody reads it, so nobody follows it. If it does not fit on a page, the decisions are not made yet.

Governing tools instead of uses. The same tool can be harmless for marketing copy and serious for performance reviews. Approve uses, not just products.

Forgetting the features inside software you already own. The riskiest AI in many companies is a default-on feature inside a system bought for something else.

No owner. A policy that belongs to "the leadership team" belongs to nobody. One name goes on the page.

Frequently asked questions

What is an AI governance framework?

It is the set of decisions a company makes about how it uses AI: what information may go into which tools, who approves a new use, which outputs need human sign-off, what is recorded, and how often the whole thing is reviewed. For a company of 50 to 500 people it should fit on one page with a named owner.

Do we need an AI governance framework if we are a small company?

Yes, and it is easier at your size. You do not need a committee or a dedicated role. You need the five decisions written down, one executive who owns them, and a short quarterly review. Most companies of this size can do the first version in one leadership meeting.

Who should own AI governance?

One named executive, usually the COO or whoever is accountable for data and operations. IT, legal and HR should be consulted on security, contracts and people decisions, but the owner decides. If it is owned by a group, requests stall and nobody answers the board's question.

Is an AI policy template enough on its own?

A template is a starting point. The value is in the decisions you make while filling it in: which tools you approve, which information classes they may touch, and which outputs need sign-off. A template copied unchanged gives you a document without those decisions behind it.

Does this framework make us legally compliant?

Not by itself. It gives you the controls most rules expect, such as human oversight, records and clear approval, but what applies to you depends on where you operate, your sector, and how you use AI on decisions about people. Check your obligations with counsel and adjust the policy to match.