Governance structures and AI policies

By November 2026, Birchline has two pilots running, two more planned, an image campaign that taught a hard lesson, and 1,100 staff with varying ideas about what they are allowed to do. The steering committee asks Jules for something that will hold it all together: who decides which AI uses are allowed, what rules everyone follows, and how the company knows the rules are working. Farah calls this AI governance, and she is careful to explain what it is not. "Governance is not a committee that says no," she says. "Done well, it is what lets you say yes faster, because everyone knows the path from idea to approval." This lesson describes the structures and policies that make up AI governance at an organization like Birchline.

What AI governance covers

AI governance is the system of roles, policies, processes and controls that direct how an organization develops, buys and uses AI, so that its use is effective, lawful, safe and aligned with the organization's values. It connects the practices from earlier lessons, such as use-case selection, human review, data readiness, security and responsible AI, into one approach with clear decision rights.

Good AI governance usually answers five questions. Who decides? What rules apply to everyone? How is each use case assessed and approved? What is recorded? How is compliance checked and improved over time? The sections below take them in turn.

Who decides: roles and structures

Birchline keeps the structure light, because it is a mid-sized retailer, not a bank. Larger or more regulated organizations add more layers, but the roles are similar.

Two design choices matter more than the chart. The review group includes people who can say what the law requires, what security needs and what the business wants, so that one meeting can reach a decision rather than sending a proposal round several departments. And decision rights are written down: the review group can approve low and medium-risk uses itself, while high-risk uses go to the steering committee. That rule is what makes approvals fast for most ideas.

What rules apply: AI policies

A small set of short policies covers most needs. Long policies are not read, so Birchline aims for documents that fit on a few pages, with detail in linked standards.

The acceptable use policy is the one every employee meets. Its central table lists data types against tools. Public information can go into any approved tool. Internal business information goes only into tools licensed under Birchline's enterprise terms, such as the Gemini app under Birchline's Workspace agreement. Customer personal information goes only into systems specifically approved for it, such as the planned email assistant. Payment card data never goes into any generative AI tool. That table is easy to remember, which is why it works.

How each use case is assessed: risk tiers

The approval standard sorts each use case into a risk tier using a few questions, and each tier has a defined path. Lesson 8 introduced the tiers; governance defines the process behind them.

def risk_tier(customer_facing, personal_data, affects_people, takes_actions, consequential_decision):
    if consequential_decision:
        return "Not permitted"
    score = sum([customer_facing, personal_data, affects_people, takes_actions])
    if score >= 3 or (customer_facing and takes_actions):
        return "High"
    if score >= 1:
        return "Medium"
    return "Low"

cases = {
    "Slogan brainstorming":      (False, False, False, False, False),
    "Product description drafts": (True, False, False, False, False),
    "Staff policy assistant":     (False, True, False, False, False),
    "Shopping assistant":         (True, True, False, True, False),
    "Ranking job applicants":     (False, True, True, False, True),
}
for name, answers in cases.items():
    print(f"{name:<28} {risk_tier(*answers)}")

Slogan brainstorming         Low
Product description drafts   Medium
Staff policy assistant       Medium
Shopping assistant           High
Ranking job applicants       Not permitted

The function is a simplification, and the real standard includes judgment, but the questions are the ones that matter. Is it customer-facing? Does it use personal information? Does it affect people's opportunities or treatment? Can it take actions? Would it make or recommend a consequential decision about a person? Product description drafts are medium risk because they are published, even though an editor approves each one.

In its first month, October 2026, the review group handled nine requests. Six were low risk and simply registered, two were medium and approved within a week with conditions, and one, the shopping assistant, is high risk and is scheduled to go to the steering committee in December with its red-team results. Jules tracks the time from request to decision, because governance that takes months pushes people back toward shadow AI.

What is recorded: the AI inventory

Every AI system in use at Birchline, built or bought, is listed in an AI inventory: a register with the system's name, purpose, owners, risk tier, model and provider, data sources, users, approval date, review date and links to its assessments and test results. The inventory answers questions that otherwise take days: which systems use customer data, which rely on a model that is being retired, which are due for review. When Google announces a new model version, Farah can see in minutes which Birchline systems will be affected and need retesting.

The inventory also holds the documentation from lesson 8, such as the system record and impact assessment, so an auditor or regulator could see how a decision was reached.

Frameworks and standards

Organizations do not have to invent governance from scratch. Several well-known frameworks provide structure, and Birchline maps its policies to them.

• The NIST AI Risk Management Framework (2023), from the US National Institute of Standards and Technology, organizes AI risk work into four functions: govern, map, measure and manage. It is voluntary and widely used in both countries.
• ISO/IEC 42001 (2023) is an international standard for an AI management system, in the style of other ISO management standards. Organizations can be certified against it, which some customers and partners ask for.
• Google's Secure AI Framework, covered in lesson 7, provides the security part.
• Sector regulators and industry bodies add guidance in regulated fields such as finance and health.

The US legal landscape as of late 2026 combines federal agency enforcement of existing laws, such as consumer protection and anti-discrimination law, with a growing set of state laws, some focused on automated decisions and disclosure; a December 2025 executive order seeks a national framework and challenges some state AI laws, and Colorado replaced its 2024 AI act with a narrower law taking effect in January 2027. Birchline's legal counsel reviews the landscape twice a year.

Customers in the European Union are not part of Birchline's market, but Farah mentions the EU AI Act, which sorts AI systems into risk categories with duties for each, because many international vendors design their products to meet it, which shapes the tools Birchline can buy.

Checking that governance works

Governance is only real if someone checks it. Birchline uses a few simple measures in Jules's quarterly report to the steering committee: the number of systems in the inventory and their tiers, how many reviews are overdue, the median time from request to decision, incidents reported and closed, training completion, and findings from sampled audits of high-risk systems. From 2027, internal audit will test a sample of systems each year against the policies, independently of the team that runs them.

Policies also need updating. The review group revisits them every six months and after any significant incident, regulatory change or new type of AI use, such as the first agent that can take actions on Birchline's behalf.

Governance for bought AI

Not every AI system is built at Birchline. Many software products the company already uses are adding AI features, often switched on in an update. The governance standard covers these too. When a vendor adds generative AI to an existing product, the system owner records it in the inventory, checks whether it changes what data the vendor processes, and asks the procurement questions before the feature is enabled for staff. In the first month this caught a scheduling tool update that would have sent staff availability notes to a new AI service under different terms; the feature stayed off until the vendor confirmed how the data would be handled.

Bought AI also needs exit planning. If a vendor changes its terms or retires a product, the owner should know how to export Birchline's data and configuration and what the fallback would be. That planning is easier at the start of a contract than in the middle of a dispute.

Keeping governance proportionate

Farah warns that governance can fail in two directions. Too little, and risky uses slip through. Too much, and staff stop asking, which pushes work into shadow AI and makes risks invisible. The signs of too much are long queues, forms that ask for information nobody uses, and the same questions asked of a slogan generator and a customer-facing agent. Birchline's review group reviews its own process every six months with the same honesty it asks of system owners.