AI governance is the standing set of decisions, owners and review dates that determine which AI tools a company may use, on what data, who can approve an exception, and when the arrangement is checked again.
That comes down to four decisions, each with one named owner: which tools are permitted, which classes of data may go into them, who approves an exception and how fast, and when the whole arrangement is reviewed. It excludes the text of your AI policy, the choice of which tools to buy, and anything to do with training models.
Most companies write the policy, skip the structure, and then cannot work out why the document is out of date within a quarter and nobody follows it. This post is for a COO, head of people or operations lead who has been handed AI governance and found only material written for organisations ten times their size. It covers what changes at 50 people versus 500, and what the whole thing costs in meeting time. ivee sells governance and policy work, so weigh the advice with that in mind. Where the honest answer is "do less", that is what it says.
Why does AI governance matter if your company only buys AI tools?
Because a company using Microsoft Copilot, ChatGPT Enterprise or Claude is already making governance decisions every week, and without an owner those decisions go to whoever clicks first. Most published definitions describe controls for keeping AI systems safe and ethical, which suits an organisation building models. They leave a 60-person services firm asking who decides whether a team may connect an assistant to the shared drive.
The NIST AI Risk Management Framework is the voluntary US reference most governance material draws on. Its Govern function expects accountability structures that give the appropriate teams and individuals authority, and expects ongoing monitoring and periodic review to be planned, with roles defined and the frequency of review determined. Strip out the vocabulary and that is the four decisions below.
What are the four decisions AI governance needs a named owner for?
AI governance needs four decisions owned by named people, and a setup with fewer than four owners has a gap you will otherwise discover during an incident.
Which tools are permitted. The owner is whoever already runs software procurement, usually an IT manager, ops lead or COO. The output is a register, and building an approved AI tools list walks through it step by step.
Which classes of data may go into them. The owner is the person accountable for data protection: the DPO where you have one, otherwise the head of operations. Three classes is enough to start: public, internal, and anything that identifies a person or a client. The ICO's guidance on AI and data protection includes a chapter on the accountability and governance implications of AI, which is the UK regulator's place to start for the personal data class.
Who approves an exception, and how fast. The owner is one person with authority to say yes or no, and a published turnaround measured in days. One AI decision maker in ivee's research with 500 UK AI decision makers wrote: "Someone has requested access to an automation tool and I haven't allowed it yet, as I do not know the wider risks to the business." That is what this decision looks like when nobody owns it.
When the whole arrangement is reviewed. The owner is the executive sponsor, usually the COO, and the date lives in a calendar rather than in a document.
The requests are heading somewhere more technical. In ivee's August 2026 AI decision maker survey of 500 UK AI decision makers, fielded 22 to 25 August, 75% said either that they have no idea, or that fewer than 1% of their workforce knows how to build and deploy an AI automation. A leadership team that cannot say how many people can build one cannot say how many requests to expect either. The sample is drawn from organisations already building with AI, so it describes committed adopters rather than UK business as a whole.
How is AI governance different from an AI policy?
An AI policy is one document that governance produces, while governance is the standing answer to who decides, who reviews and how often. The policy records what the rules are on the day it is written. Governance is what changes the rules when a vendor alters its data terms or a team asks for a new tool.
Governance excludes three things, and each has its own post, so this one does not cover them. The wording of the rules is a drafting job, set out in the nine sections an AI policy needs. Unsanctioned tools are a behaviour problem, covered in why a policy alone does not stop shadow AI. Training models sits outside the scope entirely, as does the choice of which tools to buy.
EU AI Act risk classification belongs in how to develop an AI policy for your organisation. This post states no EU AI Act obligations, and nothing here is legal advice. Anything you act on should come from the official text or a lawyer.
What does AI governance look like at 50 people versus 500?
Under roughly 50 people, AI governance is one named person and a recurring calendar entry. At 500 it is one named owner plus a small panel with the authority to say yes or no. The four decisions are identical, and what scales is who is in the room and how many requests arrive.
Criterion | Around 50 people | Around 500 people |
|---|---|---|
Who decides | One named owner: a COO, ops lead or head of IT | One named owner as chair, plus a panel of 3 to 4: IT or security, data protection or legal, and a business lead |
Exception turnaround | Within 2 working days | Within 5 working days |
Review rhythm | One 60-minute entry each quarter with the executive sponsor | A 60-minute panel meeting each month, and a 90-minute review each quarter |
Meeting and admin time | About 4 hours a month | About 15 hours a month |
The turnarounds and hours are ivee's working estimates, built up in the next section, not measurements from a survey. The 50-person line is a rule of thumb rather than a threshold.
In December 2025 the Department for Science, Innovation and Technology said, in its response to the AI Management Essentials consultation, that approaches to AI management could vary significantly depending on an organisation's size and role, and that it planned guidance aimed specifically at SMEs. Size changes the structure, which is why enterprise frameworks read as overbuilt at 60 people.
A committee with no decision rights is worse than no committee. It adds a step in front of the wait, and a step feels like progress, so nobody notices the queue is still there. Whatever the headcount, the owner or panel must be able to answer a request inside the turnaround, or people tend to solve it themselves on a personal account.
How much meeting time does AI governance take?
AI governance takes about 4 hours a month at 50 people and about 15 hours a month at 500, counting every person in the room and the owner's admin time. These are ivee's planning estimates, built from the structure above rather than measured across companies, so treat them as a budget to test rather than a benchmark.
Around 50 people: roughly 3 hours a month for the owner to answer requests and keep the tool register current, plus a 60-minute quarterly review with the executive sponsor. That review is 2 person-hours a quarter, or about 40 minutes a month, which makes about 4 hours in total.
Around 500 people: roughly 8 hours a month of owner time on requests and the register, a monthly 60-minute panel of 4 people (4 person-hours), and a 90-minute quarterly review with 6 people (9 person-hours a quarter, so 3 a month). That makes about 15 hours in total.
Setting it up is a one-off working session of two to three hours to name the four owners, set the turnaround and put the review dates in diaries. If those numbers look small, that is the point. Governance fails because it gets skipped, not because it is expensive.
When does a company need an AI governance committee?
A company needs a committee when one person can no longer answer requests inside the published turnaround, or when the decisions cross legal, security and operational lines that one person cannot judge alone. There are three signs. The request queue outgrows the owner. AI use touches regulated decisions or personal data at volume, as in financial services or healthcare. Or several business units are building their own automations and nobody can list them.
Until then, a committee is a calendar invite. When you do form one, write down what it can approve alone, what it escalates, and how many days it has to respond.
What do people get wrong about AI governance?
People get four things wrong about AI governance, and the first is the most common: treating the policy as the whole job.
"We have a policy, so we have governance." The policy is one output. If nobody owns the review date, it stays frozen while tools, vendor terms and staff habits move on.
"It is a compliance job." Lawyers and the DPO advise, but the owner is usually a COO or operations lead, because the decisions are about how work gets done.
"It slows adoption down." Slow governance does. One that answers in two to five working days can be quicker than asking around, and it gives a team a clear answer to point to.
"Set it once." Vendors change their data terms and teams adopt new tools between annual reviews. Tie a review to those events as well as to the date.
ivee runs AI governance and policy work for teams. If the four decisions above have no owner yet, put a governance call in the diary with ivee and bring your current tool list.
