Governance for the AI use that is actually happening: which tools, which decision, and whether the policy holds.
AI governance is the set of decisions, agreements and evidence an organisation uses to handle AI responsibly. For most organisations that is not about building models. It is about the everyday use of existing AI services by employees: which tools are in use, which are allowed, which have no decision yet, and whether the policy is followed in practice.
Most organisations now have an AI policy, a preferred tool such as Microsoft Copilot, and a few agreements about responsible use. What they usually lack is the view underneath: which other AI tools people use, which of those have never been assessed, and whether the policy on paper matches the working day.
That is the part of AI governance these articles cover. Not model validation, bias testing or the register a provider of a high-risk system has to keep, but the governance of daily use: taking stock of the tools, deciding per tool what is allowed, telling people at the moment they open a tool, and being able to show afterwards that the decision held.
The order matters. Deciding before you have seen what is in use produces a policy about last year's tools. Helping people before a decision exists produces warnings nobody can act on. And a dashboard without a decision behind it is a count, not evidence.
None of this requires watching individuals. Organisation-wide figures, without a user id in the data, are enough to see where practice and policy drift apart. Where the numbers say nothing, an honest governance report says so.
Articles in this topic
A healthcare AI policy works when it says which tool is allowed on which account, what never goes into a prompt, and what staff do with a tool nobody has decided on.
Read the article
Anyone with a Microsoft 365 work account can already use Copilot Chat, no paid Copilot licence needed. What it can and cannot see of your work data, and what your organisation needs to decide.
Read the article
The Dutch Data Protection Authority, NIST and the Dutch Algorithm Framework all start with one question: which AI systems do you use? Six ways to find out, and what each one misses.
Read the article
For most organisations, AI governance is not about building models but about which AI tools staff use and what has been decided about them.
Read the article
Shadow AI is AI use people have taken up on their own, without the organisation deciding on it. How to recognise it, why it happens and what information you need.
Read the article
Which AI tools are allowed is for the organisation to decide. Here is how to build a list that reflects what is really in use, and what to do when a new tool turns up.
Read the article
An AI register records, for each tool, who owns it, what it is for, what data goes in and what was decided. Which fields belong in it, and why it is never finished.
Read the article ISO/IEC 42001, the NIST AI RMF and the AI Act side by side, and why most organisations can make do with four questions about the AI use they already have.
Read the article Know which AI tools are in use and whether your policy is taking hold, without a single individual appearing in the figures. Five design choices to make before you measure anything.
Read the article
The organisation has Copilot, yet staff still open ChatGPT, Perplexity and Gamma. What people are trying to get done, and what the organisation decides for each tool.
Read the article
A workable AI policy starts from the questions people actually ask: which tools, for what, with which data and what happens if there is no answer yet.
Read the article A yes/no list leaves most tools unnamed. What the four statuses mean, when to choose which and why every tool starts as "No decision yet".
Read the article
Beyond licences and permissions lie seven decisions that no setting takes for you, from which version of Copilot to allow to how you measure use without tracking people.
Read the article
At mortgage lenders and insurers, AI is built into underwriting and pricing and into advisers' daily work. What governance has to cover in each layer.
Read the article
A board wants to know whether AI is being used in the organisation. Which figures at organisation level show that, with no person attached to any of them.
Read the article
No magic score, but nine dimensions, from what happens to your input to which personal data goes in. And why one tool can be both low and high risk.
Read the article
Advisers and back-office staff use AI for meeting notes, applications and claims, all full of client data. What a regulated firm decides, and how it shows it.
Read the article
Network logs, surveys, invoices and SSO each capture part of an organisation's AI use. What each method misses, and why continuous observation in the browser works better.
Read the article
AI helps with council papers, objection letters and youth team notes, all full of resident data. Which tools are in use, what to decide and how staff get to see it.
Read the article
Five rows from a fictional AI register, from a free ChatGPT account to an HR screening tool, with the reason for every column and what to fill in.
Read the article
There is no fixed schedule: you review on a trigger, and at least once a year. Which three numbers show it is time, and what then needs to change.
Read the article Is AI being used, is it going through the approved tools and are your AI rules working? Eight KPIs that answer that, with what each figure does and does not tell you.
Read the article
IT wants more use of the AI tool it paid for; the privacy officer wants fewer tools nobody has decided on. Why those are the same figures, seen from two sides.
Read the article A spreadsheet is enough while the list is short. The four places where it breaks, and why software only helps when new rows come from observed use.
Read the article
Free accounts, AI features in learning tools and browser extensions: where shadow AI in schools comes from, and how to keep track of it without tracking teachers.
Read the article
Alongside Copilot, municipalities use Perplexity, ChatGPT and transcription tools, mostly without anyone having decided on them. How to keep track without monitoring staff.
Read the article
A firm's AI policy answers one question: is this tool allowed, with this file, on this account? The seven questions behind it, and where the compliance officer fits.
Read the article A proxy log holds every URL, user and timestamp. To know which AI tools are in use you need four fields from it, and the user is not one of them.
Read the article Teachers use AI for lesson materials, feedback and letters to parents, often with pupil data included. What a board running several schools needs to put in place.
Read the article Which fields a school's AI register needs, why the processing agreement and pupil data matter more, and which AI features are usually left out.
Read the article A register goes stale when a vendor adds a feature or a colleague opens a new tool. Keeping it current takes triggers, a rhythm and a second source.
Read the article
The professional rules name no tools. Which AI tools a lawyer may use is for the firm to decide: a list with statuses, conditions and alternatives.
Read the article Rewriting a letter or summarising an objection is usually fine; pasting in the personal data is not. Task by task, what comes out before you paste.
Read the article Once the Copilot licences are in place, a school board still has decisions to make: which variant, who can reach which pupil files, which connections to allow and what to do about the tools used alongside it.
Read the article Start from what is already in use. Record account, data, status and owner per tool, put the list where people work and do not leave out "No decision yet".
Read the article The Algorithm Register covers algorithms that affect residents; Copilot belongs in an internal register. What goes where, and how to keep it up to date.
Read the article An AI policy for a school has two strands: tools and data for staff, and AI in assignments for pupils. What each should cover, and where they meet.
Read the article "No confidential information" helps nobody at a law firm. What an AI policy should answer instead, and why the account type is the first thing to settle.
Read the article
A survey in April finds eleven AI tools; by June the list is wrong. Where shadow AI in a firm comes from, and how to keep track of it without monitoring individuals.
Read the article The board bears final responsibility, but a register held by a single function soon goes stale. What the DPO, CISO, IT, procurement and the business each contribute.
Read the article A Copilot licence covers one service. What else a municipality has to sort out: SharePoint and Teams permissions, the DPIA, what Copilot can reach and the tools used alongside it.
Read the article AI governance works when every decision has one owner. Here is what the board, DPO, CISO, IT, procurement, HR, team leads, works council and staff each decide and see.
Read the article A law firm uses more AI than the research database it licenses. Which tools belong in the register, and which fields carry more weight at a firm.
Read the article In an accounting firm, AI runs in the chatbot, the bookkeeping software and the audit tools. The extra register fields a firm needs, and how to keep the register up to date.
Read the article
Feedback on an essay, a mark sheet, a pupil support note: the task is fine, the pupil is not. What to take out before you paste, and how the task still gets done.
Read the article The questions a municipal AI policy must answer, which data never goes in, who reviews it and how the decision reaches the front desk.
Read the article
The admin center shows how many licensed users used Copilot, not what is in use alongside it. How to put the two side by side without tracking people.
Read the article
A Copilot licence covers the service, not how your people use it. Six rules you set yourself, on one page, with a table to work through.
Read the article Yes, as soon as they are used, even if nobody bought them. And not as a single row: free and business versions differ on exactly the fields a register holds.
Read the article Alongside Copilot, firms are using ChatGPT, transcription services and document-reading tools that nobody has decided on. Why that matters more for a regulated firm and under DORA, and how to keep track of it.
Read the article Lawyers use AI to summarise, draft and research, often with client information in the prompt. What the firm decides for each tool, and how that reaches the lawyer.
Read the article
A manual register shows what the organisation knows; observed use shows what falls outside it. Four steps turn that gap into a register that stays current.
Read the article At an accounting firm, AI helps with the ledger, the financial statements and the advisory memo. What the firm decides about each tool, and how it shows that.
Read the articleThe decisions, agreements and evidence with which an organisation keeps its AI use responsible and demonstrable. In daily practice it comes down to four questions: which AI tools are in use, what has been decided about each, do people know that decision when they work, and can you show the policy is followed.
No. The AI Act sets obligations for specific systems and roles, such as providers and deployers of high-risk systems. Governance of everyday AI use, such as staff using ChatGPT or Copilot, is mostly a matter of the GDPR, your own policy and the AI literacy duty in Article 4. Good governance makes those obligations easier to meet; it does not replace them.
No. You need to know which tools are used and how often, at organisation level. That can be measured without a user id in the data, which keeps the measurement inside the GDPR and outside the territory of employee monitoring.
Sensitive data gets a marking while you type, in the tools your team already works in. You decide what happens before you send.
Rens, BeeSensible
I'm happy to give you a twenty-minute tour. Leave your details and I'll find a time that suits you. You're also welcome to call or email.