Your team is already using AI

Not next year. Today, in tools nobody approved, on work nobody reviewed. Governing AI means knowing what’s in use, deciding what’s allowed, and being able to show both. That’s it.

This page explains what the job actually is, in plain words, before you spend a dollar on it.

Take the free scorecard →

What governing AI actually means

Five questions you need answers to

Strip away the frameworks and the acronyms and this is the whole job. If you can answer these five in writing, you are governing AI.

What AI are we using?

Every tool, who owns it, and what data goes into it. Most organizations cannot answer this on the day they're asked.

What are people allowed to do with it?

A written policy and a practical standard, both short enough that staff will actually read them.

What could go wrong, and who's watching?

A named owner per risk, a sense of how likely and how bad, and a date you'll look again.

Does everyone know the rules?

Training, then a dated signature per person. Unsigned staff are the gap auditors find first.

Can you prove all of the above?

Dated records, a report each quarter, and a page you can send to anyone who asks. This is the part a template can't do.

Who’s asking

The question arrives from four directions

Your board

“What's our AI policy?”

Usually followed, one meeting later, by “and how do we know it's working?” The second question is the hard one.

Funders and members

“How are you handling AI?”

Increasingly a line item in grant applications and renewal packets. A live trust page answers it without a scramble.

Customers and insurers

“Complete this AI questionnaire.”

Security reviews now carry AI sections. The answers come straight out of your inventory and crosswalk.

Regulators

“Show your assessment.”

State and international AI rules are arriving on a schedule. Where they apply, they ask for records you either have or don't.

The honest version

What we won’t tell you

That you're already breaking the law

Most of these rules are new, and plenty may not apply to you. We'll tell you which ones do.

That software makes you compliant

It doesn't. It gives you a defensible starting point and the records to back it up. You review and approve everything.

That it's finished in one afternoon

The first package takes about an hour. Running the program is a rhythm, not an event, and that's the point.

Download the briefing (PDF)

The one-page version — designed to forward to a board, an executive team, or a funder.

Any working email — we’ll send the briefing there. Temporary/disposable addresses aren’t accepted. No spam — unsubscribe anytime.

Where this comes from

Primary sources

We link the law itself, not an article about the law. Every URL below was checked by a human on July 29, 2026.

Statutes and regulations

Research and analysis

Educational briefing, not legal advice. Laws change; check your obligations with counsel. Last verified: July 29, 2026.

See how you’d answer the five questions today

Ten minutes, free, and you’ll know exactly which of them you can’t answer yet.

Take the free scorecard →