AI governance fails in two ways: nobody writes the rules, or nobody can follow the ones that exist.
What usually happens
Teams adopt AI tools because they help. Some process customer data, some run on free accounts tied to personal e-mail addresses. Then a board member, a customer or an auditor asks for the AI policy, and the answer is either silence or a forty-page document written by someone who never uses the tools. That gap is shadow AI.
What good governance contains
A short policy that says what is allowed, with which data, and who decides. Clear roles: who approves a new tool, who classifies a use case, who handles an incident, who signs off a model change. Controls that leave evidence without slowing everyone down. And an approval flow fast enough that people use it instead of working around it.
Strict enough for auditors, practical enough to be followed.
How we set it up
We map how AI is really used today, including the tools nobody registered. We design the framework with you in two review sessions, roll it out team by team with context instead of a memo, and set up a quarterly review with an evidence checklist. It is built to satisfy auditors and to survive a normal working week.