AI Governance: How to Govern and Secure AI Use

AI governance, in a mid-size firm, is the set of agreed rules, tools, owners and checks that decide how staff use AI at work. A firm builds it in five steps, taken in order: find the AI already in use, write a few rules, supply approved tools, name an owner and a place to ask, then set controls with a review. Each step below says who settles it, what to keep afterwards and where it stops short. The wider task has its own Signisys page about governing and securing AI use at work.

AI Governance for a Firm With Staff Already Using AI

Some plain meanings come before the steps. A rule is a short instruction staff can repeat, such as which data may go into which tool. An approved tool is an AI tool the firm has chosen and set up for staff to use. An owner is the named person who answers questions about AI use and keeps the record.

Throughout, an invented marketing agency shows the steps at work. Its staff write copy, client decks and report drafts, and they began using AI tools one person at a time. The agency is invented for this article; Signisys did not work with it.

Signisys calls the five steps below a working description: they make no claim to be a standard or a complete list.

Taken together, the steps let a firm secure AI use in the order staff meet it. For the design side of the subject, Signisys has written about building controls into systems from the start, while this article sets out what to do first and next.

Finding the AI Already in Use

Step 1 starts with questions to staff, before anyone writes a rule. Which AI tools have people opened this month, on which accounts, and for what kind of work?

When you ask, say plainly that the point is to learn, not to blame, as people who expect blame may say less.

At the agency, the operations director asks each team lead for a plain list: the tool, its purpose and the kind of data pasted in. Two team leads then find colleagues using a free account for client decks. Neither lead had known about it before the round of questions.

For each entry, write down the tool, who uses it, for what, and what data goes in. Treat the list as a first picture rather than a count, as people may remember more after the first conversation. To see what a single entry on that list can leave exposed, a worked case is in one pasted file followed through an accountancy practice.

Judging readiness is its own task, and Signisys covers it on a page about judging how ready the firm is for AI. At this point, the step only records what staff already do, which keeps the list honest. For a written test of that readiness, the sheet is in groundwork a firm confirms before it starts an AI pilot.

A Few Rules Staff Can Say Aloud

Step 2 then turns the list into rules. Each rule answers one of three questions: what data may go into which kind of tool, what a person must check before output leaves the firm, and whom to ask when unsure. If a colleague is unable to repeat a rule from memory, it may be too long.

For example, the agency writes three rules in plain words. Client names and unreleased work stay out of free public tools, even if a deadline is close. A person reads each draft against its source before it goes to a client. Staff who are unsure ask the owner first.

Responsibility for the work stays with the agency and the person who sends it, whichever tool helped write it. Where staff use a service the firm did not choose, the compliance side is covered in the legal duties that unapproved AI tools can put at risk.

Before writing the data rule, the owner finds out what sort of data the firm holds. For that part, Signisys has a page on keeping client data out of the wrong places. A legal adviser in the firm’s own country checks any rule that touches personal data, and this guide is not legal advice.

Approved Tools Give the Rules Somewhere to Land

Step 3 gives staff a safe place to do the work. A rule that says “do not use that” can fail if staff then have nothing to use. The firm chooses a tool and sets it up for them.

Two questions help here. What are staff already trying to do with AI, and which approved option would serve that work?

The agency picks one tool for drafting and one for summarising, each on a firm account. Before signing up, the operations director reads the terms for how the supplier keeps and reuses text.

After that, the owner adds a tool to the approved list only after a short check with the partner who handles client contracts. The list sits in the shared folder, where each member of staff can see it. When a team asks for a new tool, the owner reads the same terms before saying yes. For a way to test that nothing staff use is missing from the record, see a dated sheet that marks each AI tool against written evidence.

An approved tool narrows the places data goes, though staff still check what comes back.

One Named Person and a Shared Mailbox

Step 4 then puts a name against the work. One person answers questions and keeps the list of tools, rules and exceptions, with a stand-in for absences. A group answering by committee may slow staff down, and slow answers may stop them asking.

At the agency, the managing partner names the operations director as owner and the head of delivery as stand-in. Staff message one shared mailbox rather than a person’s inbox, which makes the questions and answers a record. Later, the owner reads that record at each review.

The owner does not need to be an AI specialist. What matters is authority to say yes or no to a use, and to take a doubtful case to a partner.

Who in your firm already answers questions about security or data, and would they take this on?

AI Governance Controls, and the Review That Tests Them

Step 5 checks whether the rules hold in practice. A control here means a check the firm runs, such as whether staff use only approved accounts, whether someone read client work against its source, and whether questions reached the owner. Which checks a firm can run depends on its systems; the owner starts with the ones the team can see.

The review comes next. On a date set in advance, the owner reads the record of questions, the list of tools in use and the exceptions. Where staff keep breaking a rule for a good reason, the team changes the rule; a rule staff are unable to follow is not working.

In this Signisys working description, the review is the test of the whole order of work. For AI governance at the agency, that means the managing partner and the owner sit down on the review date and go through each rule.

Public guidance supports this step. The guide on generative AI from the Government of Canada sets out, as good practice for federal institutions that deploy a generative AI tool, testing before deployment, monitoring on an ongoing basis, and pausing and updating a tool that falls short of its performance targets. The page was last modified on 24 September 2026. A dated review in a private firm follows the same idea.

A review shows what the firm can see, though staff may still use tools outside the list.

AI Governance as the Agency’s Staff Meet It

Here each step appears from the side of the people doing the work. Each row pairs a message with the place staff find it again. For the agency’s staff, AI governance shows up as these five messages.

If a new joiner can find each of the five answers in a morning, the order of work is visible to staff.

Starting With the Team Leads’ Lists

The agency’s first list came from one round of questions to team leads. Any firm can hold the same round before it talks to anyone outside, and that is where the agency’s AI governance began, before anyone chose a tool. Where an outside view helps, Signisys can read that first list with you and talk through what comes next.

Signisys offers enterprise AI solutions as well as data and AI work, which gives it a stake in this subject.

AI Governance FAQ: Owners’ Follow-Ups