Governance for the AI use that is actually happening: which tools, which decision, and whether the policy holds.
AI governance is the set of decisions, agreements and evidence an organisation uses to handle AI responsibly. For most organisations that is not about building models. It is about the everyday use of existing AI services by employees: which tools are in use, which are allowed, which have no decision yet, and whether the policy is followed in practice.
Most organisations now have an AI policy, a preferred tool such as Microsoft Copilot, and a few agreements about responsible use. What they usually lack is the view underneath: which other AI tools people use, which of those have never been assessed, and whether the policy on paper matches the working day.
That is the part of AI governance these articles cover. Not model validation, bias testing or the register a provider of a high-risk system has to keep, but the governance of daily use: taking stock of the tools, deciding per tool what is allowed, telling people at the moment they open a tool, and being able to show afterwards that the decision held.
The order matters. Deciding before you have seen what is in use produces a policy about last year's tools. Helping people before a decision exists produces warnings nobody can act on. And a dashboard without a decision behind it is a count, not evidence.
None of this requires watching individuals. Organisation-wide figures, without a user id in the data, are enough to see where practice and policy drift apart. Where the numbers say nothing, an honest governance report says so.
Articles in this topic
The Dutch DPA, NIST and the Dutch government's Algorithm Framework all start with the same question: which AI systems do you use? There are several ways to find out. Each one finds a different kind of AI, and no one-off count stays correct.
Read the article
AI governance sounds like a topic for teams that build models. For most organisations it is about something else: which AI tools staff actually use, what has been decided about them, and whether that decision holds during the working day.
Read the article
Shadow AI is AI use that people started on their own, without a decision from the organisation. It appears because the work gets easier, not out of bad faith, and a ban mostly makes it invisible. What helps is a decision per tool.
Read the article
The answer is not printed on the tool. It is a decision the organisation takes. How to build a list that matches what is already in use, and what to do with the tool that turns up tomorrow.
Read the article
An AI register is the list of AI tools and applications an organisation uses: who owns each one, what it is for, which data goes in and what has been decided. The fields that belong in it, and why the list is never complete.
Read the article ISO/IEC 42001, the NIST AI RMF and the AI Act are all called frameworks, and all three are something different. For most organisations a small framework of four questions about the AI use that already exists is enough.
Read the article An organisation can know which AI tools are in use, whether its policy lands and where the risk sits, without a single person appearing in the figures. That is not a compromise but a design, made of five choices you make up front.
Read the article
The organisation bought a safe route, and yet ChatGPT, Perplexity and Gamma are open in the browser. That is not disobedience. It shows what people are trying to get done, and where the preferred route apparently falls short.
Read the article
An AI policy that works does not start from a template. It starts from the questions a colleague wants answered on a Tuesday afternoon: which tools, for what, with which data, and what to do when the answer does not exist yet.
Read the article A list of yes and no leaves most tools unnamed, and everyone reads a tool that is not on the list differently. Four statuses, one of which is the honest starting point, keep the decision with the organisation.
Read the article
Assigning licences, cleaning up permissions and turning off flex routing is the technical side. Next to it sit seven decisions no setting makes for you, from which variant is allowed to how you measure use without tracking people.
Read the article
At mortgage lenders and insurers, AI sits in two places: in the processes themselves, such as underwriting and pricing, and in the daily work of advisers and handlers. The first place gets the attention, the second gets the use. Governance covers both.
Read the article
A board wants to know whether AI is being used in the organisation and where it adds something. A handful of figures at organisation level answers that, with no person attached to any of them. Which figures those are, and which you can leave out.
Read the article
There is no magic score. There are nine dimensions that matter, from what happens to your input to which personal data is likely to end up in it. And the reason the same tool can be low risk and high risk at once.
Read the article
An adviser has an intake meeting summarised, the back office a claim. The data in those texts belongs to clients, and the firm is supervised. Which AI is in use, what the firm decides about it, and how you show that later.
Read the article
Network logs, surveys, invoices and SSO each see part of the AI use and each miss a different part. What they share: a snapshot ages. What you need is observation in the browser, continuous, with no user id.
Read the article
In a municipality, AI helps with the council paper, the objection letter and the neighbourhood team's notes. The data that passes through belongs to residents. Which tools are in use, what the municipality decides about them, and how that decision reaches the front desk.
Read the article
Five rows from a fictional AI register, from a free ChatGPT account to an HR tool that pre-sorts applications, with the reason behind every column. Two rows sit at no decision yet, and that is exactly right.
Read the article
There is no fixed rhythm. You review an AI policy when something prompts it, and at least once a year when nothing does. Three numbers tell you whether it is time, and what needs to change.
Read the article A board wants to know whether AI is used, whether it runs through the agreed route, and whether the agreements work. Eight KPIs that answer that, with for each one what it says, what it does not say, and whether it can be measured without a user id.
Read the article
IT wants more people using the AI tool the organisation paid for. The privacy officer wants fewer tools without a decision. They look like two agendas, but they are the same figures seen from two sides, and they get better together.
Read the article A spreadsheet is enough while the list is short, changes little and one person keeps it. It breaks in four places: discovering new tools, reviews, getting the decision to the person at work, and versions. Software only fixes that if the rows come from somewhere else.
Read the article
Free tools on personal accounts, AI features in learning tools that were already there, and extensions someone installed during a break. Where shadow AI comes from in schools, why a quarterly survey falls behind, and how to keep track without tracking teachers.
Read the article
A municipality that has rolled out Copilot has not thereby settled its AI use. Next to Copilot run Perplexity, ChatGPT, transcription and translation tools, mostly without a decision. How to keep track without following employees.
Read the article
A firm's AI policy can be short, but it must answer the question that lands on the floor: is this tool allowed, with this file, on this account. Which questions it answers, what the compliance officer does, and how it reaches the floor.
Read the article A proxy log holds every URL, every user and every timestamp. To answer which AI tools are in use, you need four fields from it, and the user is not one of them. Data minimisation applied to measurement.
Read the article Teachers use AI for lesson material, feedback and letters to parents, and pupil data often goes in with it. What a board with several schools arranges: sight of the tools, a decision per tool, that decision at the moment of typing, and figures without names.
Read the article An AI register at a school has the same fields as any register, plus three that weigh more: the processing agreement, the pupil data and the school where the tool runs. It also covers the AI features inside learning tools the school already had.
Read the article An AI register does not go stale on the day you write it. It goes stale on the day a vendor adds a feature or a colleague opens a new tool. Staying current takes triggers, a rhythm, and a second source.
Read the article
The professional rules name no tools, they name core values. Which AI tools a lawyer may use is therefore a firm decision: a list with statuses, conditions and alternatives, and a route for the tool that is not on it yet.
Read the article Rewriting a letter, summarising an objection, answering a council question: the task is usually fine, the personal data is not. Per task, what comes out before you paste, and why the account type weighs heavily in a municipality.
Read the article A Copilot licence for staff is assigned in an afternoon. What remains to be decided: which variant, who can reach which pupil files, which data and connections, and what you do about the AI tools teachers use next to it.
Read the article Start from what is already in use, not from a blank document. Record the account and the data per tool, give every tool a status and an owner, and publish the list where people work. Why a list without "no decision yet" is not finished.
Read the article The Dutch Algorithm Register publicly describes the algorithms that affect decisions about residents. The chatbot, the transcription tool and Copilot are not in it; that is what a second, internal register is for. What belongs where, and how observed use fills the internal one.
Read the article An AI policy for a school answers two kinds of questions: which tools and which data for staff, and what use on which assignment for pupils. Two policy lines, and one teacher who explains both.
Read the article
An AI protocol that says "carefully" and "no confidential information" does not answer the trainee's question on a Wednesday afternoon. Which questions an AI policy for a law firm does answer, why the account type is the first agreement, and how the policy reaches the lawyer at the moment of typing.
Read the article
A survey in April turns up eleven AI tools. By June the list is wrong: a new transcription tool, an AI note in the compilation software, a contract analysis tool a colleague recommended. How a firm keeps track without following its staff.
Read the article The board carries the final responsibility, but a register that sits with one person is out of date within a quarter. The roles of the DPO, CISO, IT, procurement and the business, and why "the DPO will handle it" fails.
Read the article A Copilot licence covers one service. In a municipality, four things sit beyond it: the permissions in SharePoint and Teams, the DPIA, the data Copilot may reach, and the AI tools in use alongside it.
Read the article Nobody owns AI in the organisation, and that is fine as long as every decision has one owner. What the board, DPO, CISO, IT, procurement, HR, team leads, works council and employees each decide, deliver and see.
Read the article A law firm uses more AI than the research database it licenses: chatbots, dictation software, contract analysis, the AI features inside the legal database. Which tools belong in the register, and which fields carry more weight for a firm than elsewhere.
Read the article In an accounting firm, AI runs in the chatbot, the bookkeeping package and the audit software. Which register fields a firm needs on top of the usual ones, and why the register is only right once you also look at what is actually opened.
Read the article
Feedback on an essay, a grade list, a care note: the task is fine, the pupil is not. What you take out before you paste, why removing the name is not enough, and how you still get the task done.
Read the article An AI policy adopted by the board only helps a neighbourhood team worker if it answers her Friday-afternoon question: may I use this tool, with this note? Which questions the policy must answer, who reviews, and how the decision reaches the front desk.
Read the article
The Microsoft 365 admin center shows how many licensed users have used Copilot, and in which app. It does not show what is in use next to Copilot. How you put the two side by side without tracking people.
Read the article
A Copilot licence covers the service: a data processing agreement, no training on your data, processing inside Microsoft 365. It does not cover the use. Six agreements a board makes itself, on one page, with a table to walk through them.
Read the article Yes, as soon as they are used, even if nobody bought them. And not as one row: the free and the business version differ on exactly the fields a register exists for.
Read the article A firm that has rolled out Copilot has not settled its AI use. Next to it run ChatGPT, Perplexity, transcription and tools that read files, mostly without a decision. Why that weighs more under supervision and DORA, and how to keep track without following employees.
Read the article
Lawyers use AI to summarise, draft and research. The information that passes through those tools was entrusted to the firm under a duty of confidentiality. Which tools are in use, what the firm decides about each, and how that decision reaches the lawyer at the keyboard.
Read the article
A manually kept register shows what the organisation knows. Actual use shows what falls outside it. The gap between those two lists is the work, and in four steps it becomes a register that keeps itself current.
Read the article In an accounting firm, AI helps with the general ledger, the financial statements and the advisory memo. What goes in belongs to the client. Which tools are in use, what the firm decides about them, and how you show that later.
Read the articleThe decisions, agreements and evidence with which an organisation keeps its AI use responsible and demonstrable. In daily practice it comes down to four questions: which AI tools are in use, what has been decided about each, do people know that decision when they work, and can you show the policy is followed.
No. The AI Act sets obligations for specific systems and roles, such as providers and deployers of high-risk systems. Governance of everyday AI use, such as staff using ChatGPT or Copilot, is mostly a matter of the GDPR, your own policy and the AI literacy duty in Article 4. Good governance makes those obligations easier to meet; it does not replace them.
No. You need to know which tools are used and how often, at organisation level. That can be measured without a user id in the data, which keeps the measurement inside the GDPR and outside the territory of employee monitoring.
Detect sensitive data before it leaves your team, in any app, in real time.
Rens, BeeSensible
I am happy to give you a twenty-minute tour. Leave your details and I will find a moment that suits you. Calling or emailing works just as well.