AI tools joined most teams without a job description, a manager or a probation period. Here is what running them well actually looks like on an ordinary week.
Think about the last person you hired.
Before they touched a client file they had a contract, a line manager, a laptop with the right permissions, a couple of days of induction and a probation review in the diary. Nobody in your business called that compliance. It was just how you run a team.
Now think about the AI tools that arrived over the past two years.
Someone in marketing started using one for first drafts. The finance lead pasted a spreadsheet into another to get it summarised. A recruiter added a browser extension that screens CVs. A project manager set up an assistant that sends client updates on its own. None of it came through the door the way a person would. No induction, no manager, no review. It turned up, it was useful, and it stayed.
That is the whole of the AI governance question for most businesses. Not "how do we comply with a regulation" but "how do we manage a set of new colleagues who arrived without any of the structure we give to everyone else."
Why this matters on a Tuesday, not just at audit time
Regulation is usually why people search for this topic. It is rarely why it matters day to day. The moments that actually land on a leader's desk look like this:
- A prospective client asks in a pitch, "How do you use AI on our work?" Someone has to answer, and "we're careful with it" is not an answer.
- A junior sends a client a document containing a confidently wrong figure that a tool produced and nobody checked.
- A staff member leaves, and the assistant they set up to email candidates keeps running on their old login.
- A new hire asks which tools are allowed and gets three different answers from three colleagues.
- You discover a tool has been in use for six months because the invoice landed.
None of these are compliance failures. They are management gaps, in the same category as unclear reporting lines or nobody owning the shared inbox. And they are fixed the same way: with a bit of visible structure, applied once and kept up.
The five questions you already ask about people
You already know how to do this, because you do it with staff. The questions translate directly.
1. What do we actually have?
You know your headcount. Do you know your AI count? Not to police anyone, but because you cannot manage what you cannot see. This includes the tools that act on their own, sending emails, updating records or screening applicants. Those are closer to a colleague than a piece of software, and they deserve to be listed as such.
2. Who is responsible for it?
A person, by name. Not the IT provider, not "the team," not "everyone." Every person in your business has someone they report to. Every AI tool should have someone who owns it.
3. Do people know how to use it well?
The same standard you apply to any tool. Fifteen minutes on what to check before it goes out, what never gets pasted in, and when to tell a client that AI was involved. Most staff want this. Nobody enjoys guessing.
4. What are the rules?
One page. Which tools are approved, what they can and cannot be used for, who to ask. Written down so the three-answers problem stops.
5. Can we show it?
When the client asks, you produce something rather than a shrug. There is a difference worth naming here: showing is handing over your own document, verifying is a third party confirming it. Clients, insurers and procurement contacts increasingly want the second, because self-attestation is fine internally and worth very little in a pitch or a supplier questionnaire.
What this looks like in practice
This is a week of light work, not a quarter of consultancy.
- Monday. Send the team two questions. Which AI tools do you use for work? What do you use them for? Make it clear there is no wrong answer.
- Tuesday. List what comes back. Mark which tools touch client data, money, or decisions about people such as hiring or performance. Those are the ones that need a second look.
- Wednesday. Name an owner for AI in the business. Write the one-page rules.
- Thursday. Twenty minutes with the team. Walk through the rules and the two or three habits that matter most.
- Friday. Put the list, the owner, the rules and the training record somewhere you can find them, and decide whether you want that verified rather than taken on trust.
By the following Monday you have something most businesses your size do not: a clear picture of what you use, who is accountable, and proof that your people know how to use it. That is the entire foundation.
Where the regulation fits
The EU AI Act does apply to businesses that use AI tools, not only to the companies that build them. The obligations that matter most for a typical firm are around keeping oversight and records of the tools you deploy, and telling people when they are dealing with AI rather than a person.
But here is the useful part. If you run AI the way you run people, you will find you have covered most of that as a by-product. The register, the named owner, the training record and the written rules are what the regulation asks for. They are also just what a well-run team looks like.
Regulation is evidence that this matters. It should not be the reason you start.
Governance is a habit, not a department
The word governance makes it sound like something that needs a committee. In a twenty-person firm it is five habits: know what you use, name who owns it, teach the team, write down the rules, keep the proof.
Four of those five you can do yourself in a week, and you should. The one that fails first is the fifth. A register is accurate the day you write it. Three months later a tool has been added, someone has left, the training record has aged, and nothing forces any of it to stay current. That is the gap between a folder you keep and proof someone else will accept.
You would never let a new hire wander the business with no manager, no induction and access to everything. The AI tools on your team should not get a lower standard than the people on it.
Not sure where your business stands? The free EUQA diagnostic takes a few minutes and shows you which of the five habits you already have in place and which are missing. Take the free diagnostic.