Most organisations already use more AI than their leadership realises. Sales is drafting proposals with ChatGPT. Engineering is reviewing code with Copilot. Marketing is generating images with Midjourney. Customer support is summarising tickets with Claude. None of this went through procurement, and almost none of it is governed.
AI governance does not mean banning these tools. It means knowing where they are used, what data they touch, and who is accountable when they go wrong. ISO/IEC 42001 codified this in 2024. Regulators are catching up quickly. This is the practical starting point.
Step 1: Find what is already in use
Run a one-week internal discovery. Survey department heads. Check your SSO logs and your finance system for AI subscriptions. Look at browser DNS logs if you have them. Most businesses find 3 to 10 times more AI tools in use than expected.
Step 2: Classify by risk
Not every AI use case carries the same risk. Sort them into three bands:
- Low risk. Tools that do not see sensitive data, like content brainstorming or grammar checking on public-facing text.
- Medium risk. Tools that touch internal but non-regulated information. Code reviewers, internal document summarisers.
- High risk. Tools that process customer data, financial records, regulated personal data, or that make decisions about people. These need the strictest controls.
Step 3: Establish a policy that humans can follow
A useful AI usage policy fits on one page. It states what people can do, what they cannot do, and where to ask if unsure. It names a single approval channel for new tools and a single owner accountable for the program.
Resist the urge to write a 40-page document. Nobody will read it, and your most enthusiastic AI users will work around it.
Step 4: Vet vendors properly
For any AI tool that handles non-public data, get answers to four questions before approval: Where is the data processed? Is it used to train the provider's models? What are the deletion guarantees? What audit and access controls do they offer?
For high-risk tools, sign a data processing agreement and review their SOC 2 or equivalent. For low-risk tools, document the decision in a paragraph and move on.
Step 5: Train your people
Most AI incidents are not malicious. They are people pasting customer data into a public chat to summarise it, or accepting a code suggestion that introduces a security flaw. Practical training prevents both. Run a 30-minute session on what to share, what not to share, and how to verify AI output before relying on it.
Step 6: Monitor and review
AI usage changes every quarter. New tools appear. New use cases emerge. Review your inventory every six months at minimum. Run a tabletop exercise once a year to test how you would respond if a major AI tool leaked data publicly.
What ISO/IEC 42001 adds
If your business is heading toward certification, ISO/IEC 42001 formalises the management-system view. It expects documented roles, risk assessments, change controls, and continuous improvement. The work above maps directly to those requirements.
You do not need a 200-page program to start. You need a one-page policy, an inventory, a risk classification, and a named owner. Get those four in place this quarter, and you are already ahead of most organisations of your size.