Put the minimum viable governance structure in place. Make accountability clear, use existing committees where possible and avoid creating bureaucracy that nobody has time to maintain.
Purpose
The organisation has an agreed governance model, practical internal rules and a clear route for approval, escalation and oversight.
Recommended timing
Weeks 6–7 · Indicative timing. Adjust to the organisation’s size, complexity and available capacity.
What to do
- Confirm who can approve new AI use, who owns the business process and who provides specialist review.
- Adopt or adapt an organisation-wide AI use policy. Keep employee rules understandable and actionable.
- Define an approval route for new or materially changed AI use, including procurement and software configuration changes.
- Agree how concerns, incidents, exceptions and suspected misuse are reported and escalated.
- Use an existing risk, technology or compliance committee where it can provide effective oversight. Create a new committee only if there is a clear need.
- Agree what information management receives and how often.
Meetings to arrange
Use these default meeting formats. Combine meetings or shorten them where the same people are involved and the decisions can be made together.
Governance design workshop
Duration: 90 minutes
Attendees: Executive sponsor or delegate, programme lead, legal, risk, IT, security, privacy, HR and procurement.
Agenda: Agree roles, decision rights, approval and escalation routes, policy ownership and committee arrangements.
Expected output: Draft operating model, RACI, policy approval route and reporting cadence.
Policy and process review
Duration: 60 minutes
Attendees: Programme lead, HR, legal, privacy, security, IT and selected business representatives.
Agenda: Check that the proposed rules are usable, proportionate and consistent with existing policies and processes.
Expected output: Policy ready for the organisation’s normal approval process; process owners identified.
Decisions to make
- Which existing governance forum will oversee AI?
- Who has authority to approve, restrict or suspend a use case?
- What requires specialist review before a decision?
- How will employee questions, exceptions and incidents be handled?
Definition of done
- Governance roles and responsibilities.
- AI use policy submitted through the normal approval route.
- New-use approval and escalation process.
- Committee or management reporting arrangements.
Keep it proportionate
Use existing roles, committees and processes wherever they work. Do not create a new approval layer or collect more information than is needed to make a sound decision.
Resources to use
Use the relevant Lucentreg resources at this point in the programme: the communications templates, simplified AI usage questionnaire, integrated governance workbook, assessment guidance, policy template, committee terms of reference and worked examples. Download blank resources, then maintain completed records in your organisation’s own approved environment; Lucentreg does not need to receive your operational data.
Important: Lucentreg provides educational and operational guidance, not legal advice or a determination of compliance. Screening prompts and suggested actions are starting points. Your organisation remains responsible for its decisions and should obtain qualified legal or technical advice where appropriate.