Governance and AI¶

A long table with mismatched chairs. Around it: a werewolf, two vampires, and someone who may be a wizard. On the chalkboard behind them: WHO DECIDES, and below it in slightly smaller chalk: IS IT EVEN LEGAL. A stack of policy documents sits at one end next to an inkpot with a quill in it.

An organisation that has recently discovered that its staff are using AI tools, and that has no policy for this, is in a situation that is familiar and addressable.

The challenge is not that AI is being used. It is that it is being used without anyone having answered the questions that need answering: what data is going into these tools, where is that data going, who agreed to the terms of service, and what is the organisation’s position on what AI-generated content it will produce and use?

These questions apply regardless of whether the tools in question are Microsoft Copilot, a standalone ChatGPT subscription someone set up on a personal card, or a sector-specific AI feature in the CRM.

Policy catches up to practice, eventually.