Framework
The AI Governance Engagement, From Discovery to Operate
Most governance advice reads like a single meeting's checklist. A real engagement has phases, and each phase earns the right to ask the next question.
Phase 1, Discovery
What is the requirement? Not “what problem are we solving,” a requirement is specific, measurable, and owned. Vague problems produce vague governance.
Is AI the only option? The honest answer is often no. A simpler rule-based system, or no automation at all, sometimes satisfies the requirement with less risk and less governance overhead to carry.
Phase 2, Readiness
How prepared are we? Data readiness, organizational readiness, and technical readiness are three different questions that get collapsed into one “are we ready for AI” conversation far too often. An organization can be technically ready and organizationally nowhere close.
What data is involved, and how sensitive is it? Not answered once at the start, answered per action, since the same system touches different data at different moments.
Phase 3, Impact and Accountability
What decision does this influence, and how reversible is it? A software decision and a Physical AI decision carry different weight. One can be rolled back. One cannot.
Who owns the outcome? A named business owner, not a technical team, since the team that built it is rarely the team accountable for what it does.
Phase 4, Operate and Govern
Who can halt this in real time, and how fast? A tested interrupt, not an assumption someone is watching.
What is the blast radius if this goes wrong? Scope should set the level of scrutiny, not the category of system.
What resource does this consume that cannot be recovered? Energy and water drawn by an inference are gone the moment it runs, used or wasted.
How do we keep monitoring it, continuously? A quarterly review cannot keep pace with a system making thousands of decisions a week.
An engagement earns its way through these phases. Most AI deployments skip straight to Phase 4 questions without ever answering Phase 1 honestly. That is usually where the real risk starts.