AI Governance

Not by pretending the visibility problem away. Menlo Security documented a 68% year-on-year surge in shadow generative AI usage in 2025, and most of it never touches a formal approval process. The practical first step is a time-limited AI amnesty: a disclosure window, without punishment, that converts an invisible risk into an inventory the Board can actually govern, and surfaces the use cases employees have already validated.

The evidence says blocking does not stop the use; it hides it. BCG’s 2025 AI at Work research found 54% of employees would use AI tools even if the organisation had not authorised them, and Gigster’s 2025 research found 57% already hide their usage. Prohibition drives the activity further underground, where the data exposure is worst. The better questions are why people route around the sanctioned route, and what would make them choose it instead.

No. Minimum Lovable Governance is not less governance; it is governance matched to risk. A credit decisioning system warrants heavier scrutiny than a meeting summariser, continuous assurance beats the annual audit scramble, and controls embedded in the workflow get used where separate approval queues get bypassed. The test is whether the organisation could demonstrate its compliance posture tomorrow, not after weeks of preparation.

The provider’s, unless the Board has decided otherwise. Every foundation model arrives with a value system built upstream in pre-training and alignment, and system prompts, retrieval, and guardrails constrain that standard without re-authoring it. The choice for each material deployment is to accept, reject, or build, and the failure mode is accepting everywhere by default without ever naming the decision.

Not technical fluency. Directorial AI literacy is four specific capacities: interrogating maturity claims, distinguishing operational governance from governance theatre, identifying material AI risk, and exercising independent judgement rather than ratifying management’s framing. Deloitte’s 2025 Global Board Survey found two-thirds of Boards still report limited or no AI knowledge, so most directors will find gaps. Finding them is the point.

To the Board, through the risk and compliance committee, not to IT. That has been my position since the article introducing the Six Board Concerns model: the AI Centre of Excellence is a governance mechanism for decision-making at machine speed, not another technology function, and a reporting line through IT tends to narrow it to technical implementation. My 2022 article The Board in the machine made the same point in earlier language, placing oversight with the Audit and Risk Committee. Independence from operational pressure is the point; the case for the Centre sets out the mandate, authority, and resources the Board resolution should carry.

Often nobody can say. When people use public tools to create content or code, ownership of the output can be unclear, and the provider’s terms of service may be the only text on the point. The article introducing the Six Board Concerns model raises the question because organisations have been discovering intellectual property built in unapproved tools. The Board’s job is to require an answer for each material use case and to bring that work into the open. The AI Amnesty methodology does that, and the post-amnesty triage treats IP created without controls as a first-week, high-risk item.

Not on its own. ISO 42001 sets requirements for an AI management system, and ISO/IEC 42006:2025 adds the audit and certification requirements, but a certificate says a system exists, not that governance happens in practice. The diagnosis piece describes organisations that tick the boxes, implement ISO 42001, and still fail, because the Six Board Concerns model is an interconnected system and they worked through it one concern at a time. Certification pursued too early also tends to produce the heavyweight governance people route around. The Minimum Lovable Governance principle is the progressive path: embedded, proportionate, continuous governance first, maturing towards certification.