Proportionate AI governance: control without the bureaucracy

There are two common failure modes in AI governance. In the first, there is none: teams adopt tools and build systems with no inventory, no review and no clear accountability. In the second, every use of AI, from a spelling assistant to a credit-decision model, must pass through the same heavyweight approval process, so people either wait months or quietly work around it.

The answer is proportionality. Oversight should scale with the potential for harm.

Start with an inventory

You cannot govern what you cannot see. The first step is a simple register of where AI is used across the organisation, including:

• Systems built in-house
• AI features inside software you already license
• Tools staff use directly, sanctioned or otherwise

For each entry, capture the purpose, the owner, the data involved and who is affected by its outputs. This alone often surfaces surprises.

Tier by risk

Next, sort each use into a small number of risk tiers. A workable starting point:

1. Minimal: internal productivity aids with no personal data and human review of every output.
2. Limited: customer-facing or data-processing uses where errors are visible and reversible.
3. High: systems that materially influence decisions about people’s finances, health, employment or access to services.

Recognised frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 offer useful vocabulary here, and emerging regulation increasingly uses similar tiering.

Match controls to tiers

The key principle: each tier gets a defined, predictable set of controls, so teams know in advance what is expected.

• Minimal: registration and adherence to an acceptable-use policy.
• Limited: a lightweight review covering data protection, security and a basic evaluation of output quality.
• High: a full impact assessment, documented testing including bias and robustness, human oversight design, monitoring in production and periodic re-review.

Predictability matters as much as rigor. When teams know exactly what a high-risk review involves, they can plan for it instead of fearing it.

Make it part of the delivery process

Governance works best when it is built into how systems are designed and shipped, not bolted on at the end. Evaluation suites, model documentation and audit logging can be produced as a natural by-product of good engineering practice, which means the evidence a reviewer needs already exists.

Review and adapt

Finally, treat the framework itself as a product. Review it at least annually, update tiers and controls as regulations and technologies change, and collect feedback from the teams who use it.

This article is general information, not legal advice. For help designing a governance framework for your organisation, see our AI Security & Governance and AI Compliance, Testing & Auditing services.