Governance That Does Not Kill Speed

Why this matters

Governance exists to keep irreversible or high-impact mistakes from happening quietly. It should not exist to create theater or permanent delay. The failure modes run both ways: no governance lets a quiet mistake become an expensive one; bloated governance makes every safe thing slow and trains people to route around it. The test of a governance system is whether it matches its weight to the actual risk.

What you will be able to decide after this

• What the risk tiers in your context actually are — and which tier a proposal sits in.
• What each tier requires: nothing, review, or formal approval.
• Whether your rules would be read, and whether they would survive a test case.

Core lesson

Effective governance for AI:

• Focuses on high-consequence decisions and data exposure. The rules exist for the small set of actions that are expensive to undo or dangerous to release. Everything else is the team's business.
• Uses clear, lightweight criteria instead of endless review boards. A review board that meets monthly is a delay with a calendar. A named rule is a decision that already happened.
• Distinguishes experiments from production. A sandbox run with test data is not a deployment. The rules that govern production do not govern experiments — and the boundary between the two is explicit, not vibes.
• Assigns real ownership rather than diffuse committees. One named person per risk tier, not a committee that shares accountability until nobody has it.
• Can move at the speed of the risk involved. Low risk moves fast; high risk moves through the formal gate. The speed is set by the risk, not by the committee's calendar.

The external frameworks are reference points, not the whole point: the NIST AI RMF's "Govern" function and ISO/IEC 42001 both emphasize accountability, policy, and lifecycle responsibility; the EU AI Act forces explicit risk classification. Use the spirit: match process weight to actual risk. Do not confuse compliance activity with actual judgment — a checkbox on a form is not the same as a named owner who can be asked "what happened, and what did you do?"

Example of lightweight rules:

• Low risk (internal drafting, no customer data, easily reversible): team-level judgment + logging.
• Medium risk (customer-facing drafts, internal decision support): named reviewer + recorded acceptance.
• High risk (automated decisions with legal, safety, or significant financial impact): formal review, documented human oversight, clear shutdown authority.

Worked example

A company's rule set, one page: Low risk — internal-only drafting and summaries; team judgment, log the use. Medium risk — anything customer-facing or that feeds a decision with money attached; named reviewer, recorded acceptance, no silent auto-advance. High risk — automated decisions with legal, safety, or significant financial impact; formal review, documented human oversight, shutdown authority named. Tested against three cases: an internal meeting-note summarizer lands low-risk and ships the same day; a customer-reply drafter lands medium-risk with a named reviewer; a credit-limit adjustment tool lands high-risk and goes to formal review with a shutdown owner. The test catches the design flaw too: the first draft of the rules sent every customer-facing draft to the formal review board — the low and medium tiers collapsed into "all customer stuff = board," which would have buried the safe half of the work. Adjusted to match weight to risk, the rules survive their own test.

Practice

Write the three risk tiers for your context — low, medium, high — and the rule for each in one sentence. Then place a recent AI use in your organization in each tier, and check whether the rule would have been proportionate.

Apply — produce the artifact

Draft the simple governance rule set for AI use in your context. Define what requires only team-level judgment, what requires explicit review, and what is prohibited without senior approval. Keep it short enough that people will actually read and use it.

Verify

Test the rules against three recent or realistic cases — one low-risk, one medium, one high. If the rules create obvious bureaucracy for the low-risk case or leave the high-risk case under-controlled, adjust them.

Sources

This module is original practice guidance based on the authoring standard and does not depend on a specific external factual claim. Editorial review is still required.