AI governance
without bureaucracy

How does an organisation set up AI governance without it becoming bureaucracy?

An organisation needs at least four mechanisms: one register of all AI applications, one gate for upfront review, one periodic check and one escalation path. The risk of over-regulating is that people work around it and a shadow practice emerges with tools nobody knows about, while the organisation believes it's in control.

Is a separate AI ethics committee needed for AI governance?

Usually not: for AI governance, it's usually better to add AI as a topic to the body that already exists within the organisation's existing risk structure. That body already has a mandate and already meets regularly.

Can the register for AI governance be a spreadsheet?

Yes, if the spreadsheet is accurate: for AI governance, an accurate spreadsheet beats a half-filled GRC module. The register holds, per application, the owner, the purpose, the risk level, the data used, the supplier, and when it was last reviewed.

Is the three-level risk classification for AI governance also a legal judgement under the EU AI Act?

No. The three-level classification is a working model to structure the internal conversation within AI governance. The EU AI Act applies its own classification, and the advice is to have your legal department or a specialised adviser determine exactly where your applications fall under it.

Source: article by Dave Willemstein; primary source: Regulation (EU) 2024/1689 (AI Act), EUR-Lex; European Commission, "AI Act" (regulatory framework AI) (as of 6 October 2026). Updated: October 2026.

The real risk of AI governance

The risk isn't that you regulate too little. The risk is that you regulate so much that people work around it, and you end up believing you're in control while a shadow practice grows with tools nobody knows about.

That happens faster than with classic IT, because AI tools are so easy to access. An employee who hits a six-week approval process can sort out the alternative themselves in two minutes with a credit card. Good governance accounts for that.

Start with risk classification, not technology

The mistake made most often: one regime for everything that's labelled "AI". That means a tool that writes up meeting notes has to go through the same process as a model that influences credit decisions. The result is predictable: the first gets slowed down for no reason, and the second doesn't get enough attention, because all the attention went to the avalanche of low-risk requests.

A workable three-level split:

• Low: supports one employee, the output is reviewed directly by that person, no effect on anyone outside the organisation. Examples: summarising, draft text, searching internal documents. Regime: log it and apply general usage agreements.
• Medium: influences a work process or a decision about a customer, with human review. Examples: preparing case files, prioritising requests, stock advice. Regime: logging, a named owner, a test set, periodic evaluation.
• High: affects people's rights or interests, or operates without meaningful human review. Examples: credit scoring, candidate screening, fraud detection. Regime: full documentation, formal review beforehand, demonstrable oversight, logging.

The EU AI Act applies its own classification, with specific obligations per category and prohibited practices at the top end. It isn't limited to organisations established in the EU either: under Article 2 of the Act, it also reaches UK organisations that place an AI system on the EU market, or whose system's output is used in the EU. The UK has no AI Act of its own and regulates AI through existing sector regulators instead, applying shared principles rather than one cross-cutting law, as set out in the UK government's AI regulation: a pro-innovation approach. Have your legal department or a specialised adviser determine exactly where your applications fall under either framework. The split above is a working model to structure the internal conversation, not a legal judgement.

The four mechanisms you need at minimum

1. One register

A list of every AI application running or in development across the organisation, with for each one: owner, purpose, risk level, what data goes in, which supplier, and when it was last reviewed.

This sounds dull and it's the single most important thing you'll have. Without a register, you can't answer any other question. With one, you can find out who to talk to within an hour for any incident, audit question or supplier change.

Keep it light: a spreadsheet that's accurate beats a GRC module that's half filled in. What matters is that keeping it updated is a condition for going ahead, not a request made after the fact.

2. One gate

One moment where a new application is reviewed before it goes live. Not three, not a chain of departments waiting on each other. One meeting, with a fixed group (business, data/IT, risk) and a fixed turnaround time.

For low-risk applications, the gate is a ten-minute formality. For high-risk applications, it's a serious review. The difference is in the preparation, not the number of bodies involved.

Agree a maximum turnaround, say two weeks, and stick to it. The credibility of your governance depends more on this than on the content of your assessment framework.

3. One periodic check

AI applications degrade quietly. The world changes, the data shifts, the supplier updates the underlying model. Without a periodic check, you only notice once a user complains, and by then it's already been wrong for months.

A different rhythm per risk level: low risk, an annual check that it's still in use; medium risk, a six-monthly evaluation against the test set; high risk, quarterly with a documented outcome.

Important: the check should use a fixed test set made at the start. Without that set, you're testing a feeling, not a performance.

4. One escalation path

What does an employee do when they notice an AI application doing something odd? If the answer is "I don't know", nobody reports anything, and you only hear about it from a customer.

Make it concrete: one email address or form, a commitment to respond within two working days, and the authority to temporarily pause an application resting with one named person, without needing to convene a committee first. That last piece of authority makes the difference and is almost always forgotten.

What you can skip

Three things that often get built and rarely deliver anything:

• A separate AI ethics committee alongside your existing risk structure. Usually better to add AI as a topic to the body that already exists: it already has a mandate and already meets.
• A lengthy AI policy document before there are any applications. Policy written without practical experience is abstract and gets rewritten within a year. Start with five usage agreements on one page.
• Tool choice as a governance question. Which platform you use is a procurement question. Which decisions you hand to it is the governance question.

Write down what you don't do, too

This is the part that gives the best return for the least work. If you decide not to build a particular application (AI-assisted staff appraisals, say), record why, who decided that, and when it will be looked at again.

Without that record, the same proposal comes back every quarter through a different route, and you have the same discussion each time with different people. With it, the conversation takes two minutes: here's the decision, here's the reasoning, and we'll look again in October.