AI Governance: A Practical Starting Plan for Your Organization

Published by Horus Consultancy · About us

AI governance defines who may approve AI use, what conditions apply and how the organization checks that those conditions remain effective. Start with the AI tools people actually use, then assign accountable owners and proportionate controls.

A policy alone will not answer an employee who wants to upload customer information to a new assistant. The employee needs a clear decision, an approved route and someone responsible for exceptions. The following is a suggested starting plan, not a prescribed standard or a promise that governance can be completed in a fixed number of days.

Make AI use visible

Create an inventory of AI systems and use cases, including purchased tools and AI features inside existing software. For each entry, record the business purpose, owner, users, supplier, information involved and the decisions influenced by its outputs. Ask teams about unofficial tools as well as centrally purchased services.

For example, drafting an internal meeting agenda and screening job applicants should not receive identical reviews. The consequences of an incorrect output, the people affected and the ability to challenge the result differ.

Give decisions an owner

Name a business owner for each use case. Agree when security, privacy, legal, procurement and operational teams need to participate. Define who can approve a pilot, authorize production use, accept residual risk and suspend the system. A committee can coordinate these decisions, but should not obscure individual accountability.

Set usable approval conditions

• State which information may enter the tool and which uses need additional review.
• Specify where human review is required and what the reviewer must check.
• Record supplier limitations, access controls and any restrictions on onward use.
• Define a route for reporting errors, harmful outputs or unexpected behavior.

Make the rules accessible where work happens. A short approved-use guide, linked to a request form and a named contact, is often easier to follow than an isolated policy document.

Keep evidence of oversight

Retain approval records, relevant assessments, test results and decisions about exceptions. Give each approval a review trigger: a new model, changed purpose, different data, a supplier change or a significant incident. Track whether agreed actions are actually completed.

A useful first management review asks: Which AI uses are unowned? Which conditions are overdue? Which systems have changed since approval? These questions turn governance into an operating practice.

Where ISO/IEC 42001 fits

ISO/IEC 42001:2023 specifies requirements for an AI management system. It can provide a structured foundation for organizations developing, providing or using AI. Your initial inventory and ownership decisions can support that broader work, but do not by themselves demonstrate conformity.

Do small organizations need an AI committee?

Not every organization needs a new committee. The practical objective is clear authority, appropriate expertise and recorded decisions. A small organization may use existing management meetings with named owners and escalation rules.

What should we do first?

Choose one real use case and walk it from request through approval, operation and review. Use the gaps you find to improve the process before applying it more widely.

Related guidance

• AI Risk Management: Build a Risk Register Around Real Use Cases
• ISO/IEC 42001 Readiness: From AI Policy to Evidence of Practice
• ISO/IEC 27001 Internal Audit: Preparing Evidence and Closing Gaps
• ISO/IEC 20000-1 Readiness: Connect Service Management to Evidence

Discuss your next step

Horus Consultancy provides IT GRC consulting and internal audit support for organizations in North America and the Gulf, with a physical base in Canada. Explore our services, read our FAQ, or book a call with Islam Elzayat. For professional education, visit Horus Academy.