AI adoption is already happening inside commercial teams. People use assistants to summarise meetings, draft content, analyse data, research accounts and automate routine workflows. Governance therefore has to meet real behaviour, not an imagined future state.

NIST’s AI Risk Management Framework is designed as a voluntary way to manage AI risk, while the ICO provides UK guidance on data protection obligations where AI processes personal data. Together they suggest a practical principle: know the use case, understand the data, assess the risk, assign human accountability and monitor the outcome.

Classify use cases by consequence

Not every AI task deserves the same control. Reformatting public copy carries a different risk from evaluating job applicants, generating customer-specific advice or making a decision that materially affects an individual.

Create simple risk tiers based on data sensitivity, impact, autonomy and external exposure. Low-risk use can move quickly. Higher-risk use should require review, testing and documented approval.

Make data rules specific

The ICO’s guidance focuses on lawfulness, fairness, transparency, security, data minimisation and individual rights where personal data is involved. Commercial teams need those principles translated into practical behaviour.

Define which systems are approved, what categories of data may be entered, when personal or confidential information is prohibited, and what additional safeguards are required for customer or employee data.

Keep humans responsible for consequential outputs

Human oversight should be meaningful, not ceremonial. The reviewer needs enough context, authority and competence to challenge the output. A person who simply clicks approve is not a control.

For externally published content, customer recommendations and important operational decisions, require verification against source material and clear ownership of the final result.

Create an incident and learning loop

Governance improves when teams can report near misses, hallucinations, privacy concerns and poor outputs without turning every error into a disciplinary event. The aim is to learn where controls or training are weak.

Keep a light register of approved use cases, owners, systems, data classes and material incidents. That creates a practical evidence base for improving policy.