Govern It

Governance is not a layer you add after building. It is a property of how the work system operates — built in, not stapled on.

Most AI governance programs start with a framework and work backward to controls. That produces compliance theater: policies that exist on paper, controls that cannot be verified, evidence that would not survive examination.

The decision — not the system — is the unit of governance. Ask: which decisions does this AI affect, and what controls and evidence do those decisions require?

Before asking "what controls do we need?", ask "what applies here?"

• What decisions does this AI affect? — not what tasks it performs, but what consequential decisions it influences.
• What requirements govern those decisions? — laws, regulations, policies, standards, contracts, risk tolerance.
• What controls do those requirements demand? — specific controls that satisfy the applicable requirements.
• What evidence proves the controls operate? — artifacts that survive audit, examination, or procurement review.

Work from decision to requirement to control to evidence — not from framework to checklist.

A control is meaningful only if:

• It addresses a real risk or requirement.
• It actually operates as designed (not just documented).
• Someone is accountable for its operation.
• Evidence exists that it worked.

For every AI-affected decision, someone must be accountable for the outcome — not the model, not the vendor, not "the algorithm."

• Who owns the decision? — a human, with name and title.
• What authority do they have? — to approve, override, escalate, modify.
• What do they need to exercise that authority? — time, competence, evidence, tools.
• What happens when something goes wrong? — who is responsible, what remediation exists.