Governance is a heavy word for: which tool, which data, who hits send, what happens when it is wrong.
Aside. The robot does not get your badge. Your manager still reads the email with your name on it.
You are not founding a CoE. You are not “scaling transformation.” You are staying inside the lines so you are still here in March.
Find the policy
Search the intranet for AI, Copilot, confidential, acceptable use. If it exists, it beats a thread from a conference. If it does not, write your own card and ask your lead to look at it:
- Work data stays in the blessed tool
- Consumer chat gets only what you would put on a postcard
- You disclose AI drafts when the house style says to
- You never auto-send
High-risk uses (hiring, credit, health, student decisions) are not a fun prompt. They are a legal conversation. Stay out unless that is your job and counsel is in the room.
When a draft escapes
- Pull it down if you can
- Tell the person who owns the channel
- Say what was wrong, in English
- Fix the prompt or the library so that shape cannot ship again
- Do not blame “the AI” as if it had a badge number
Drift
Models change. A prompt that was fine in April can get chatty in September. Re-read anything on a schedule — Friday, five minutes — if it is customer-facing.
You are done when
You can point at the rule you follow, and you know who you tell if a bad draft left the building.