Minimum Viable AI Governance: What it is and why it matters

Most organisations approach AI governance the wrong way. They start with the policy. A framework is drafted, a review process designed, and — meanwhile — the EU AI Act is imposing hard deadlines: documented oversight, risk classification and accountability for AI in high-impact domains must be demonstrable. The governance programme is still in a working group. The employees who needed an answer already found one: they use ChatGPT for customer proposals, running AI tools on confidential documents, building agents nobody in IT has evaluated.

The result is the worst of both worlds: no speed, and no control.

This is not a theoretical risk. It is the default outcome of treating AI governance as a policy problem rather than an operational one. Done well, it also denies organisations something else: the ability to measure, learn from and scale the AI that is working and adds the most value to your organization.

The problem with policy-first governance

The traditional approach assumes a linear sequence: define the rules, then enforce them. Build the framework, then deploy. This fails for one structural reason: AI adoption does not wait for governance to be ready. By the time the framework is approved, the AI estate has grown beyond it. The governance programme is governing a version of the organisation that no longer exists.

The predictable outcome is a shadow AI problem. Employees route around governance rather than through it - the governed route is too slow, the ungoverned route is faster. A second failure mode receives less attention: excessive governance on low-risk AI. Uniform approval processes mean a scheduling tool requires the same committee sign-off as a model influencing credit decisions. This is not safer. It is slower without being more protective.

‍

A different starting point

Minimum Viable AI Governance begins from a different premise: you cannot govern what you cannot see, and you cannot see what you have not yet looked for.

The answer to what AI is actually in use is almost always more complex than leadership expects: unapproved tools, sensitive data entering general-purpose interfaces, AI embedded in software the business has run for years, agents deployed informally, and datasets connected without any systematic record of what data is involved or who is accountable.

Answering this accurately requires semi-automatic registration - AI use cases, systems, models and connected datasets discovered and proposed for registration automatically, with humans confirming ownership, classifying risk and granting approval. The automation removes the discovery burden; the human step preserves judgment exactly where it belongs.

This is the operational premise of Minimum Viable AI Governance - independently validated by MIT's Centre for Information Systems Research, which defines it as the least governance necessary to manage risk effectively while enabling the organisation to identify and pursue opportunities. Governance heavier than the risk warrants does not make organisations safer. It makes them slower and drives the very shadow AI activity it was designed to prevent.

‍

The six simple steps that matter

Minimum Viable AI Governance is a set of six operational capabilities, established in order.

Discover.  Know what AI is in use - tools, models, systems, agents, use cases and connected datasets - including those never formally approved. This requires continuous, automated discovery, not manual surveys. Semi-automatic registration translates each discovery into a structured record: use case, system, model and dataset proposed for registration with the information needed to make a governance decision, ready for a human to confirm and approve.

Assign.  Make ownership explicit for every material use case: business owner, technical owner, use case, approval status. Unowned AI is ungovernable AI.

Classify.  Assess risk consistently - against the EU AI Act's mandatory risk tiers and other applicable frameworks - and apply classification automatically rather than case by case.

Control.  Apply specific controls and guardrails where the risk warrants them, and only where it does. Lower-risk innovation moves freely; higher-risk use cases require approvals, data controls and human oversight.

Monitor.  Use the AI registry and continuous monitoring to detect and measure change, drift and policy breaches after deployment, not through annual audits. The same foundation shows actual use, adoption and business value per use case: which tools deliver, which justify expansion, and which are underused or duplicative.

Evidence.  Maintain decision records, audit trails, control mapping and compliance status automatically. Under the EU AI Act, this is in many cases legally required, not optional.

Discover → Assign → Classify → Control → Monitor → Evidence

This sequence is not a maturity model requiring years to complete. It can be implemented progressively: beginning with visibility, adding controls as the risk picture becomes clear, building the evidence layer as the AI estate matures.

‍

Why this is different

Traditional governance depends on self-reporting and periodic review. The AI registry is a spreadsheet: updated when people remember to, incapable of capturing what was never reported. Datasets rarely appear in it at all.

Minimum Viable AI Governance starts with operational reality. Semi-automatic registration means that when a new AI system appears, it is identified, structured and presented for human decision - not left waiting for someone to fill in a form. Dataset connections are documented at registration, so the inventory captures the full data picture alongside the systems. Classification is automated against established frameworks. The record is continuous and current, not assembled annually.

These are not incremental improvements. They represent a different model: governance built from what is real, applied at the speed of actual AI adoption.

‍

The practical implication

Minimum Viable AI Governance can be established in weeks, not quarters. It does not require a complete policy framework - it requires an accurate picture of what is happening and the operational controls to act on it.

The AI adoption is already happening. Every week spent completing a framework is another week in which AI is being used in ways the organisation cannot see, does not own and cannot provide evidence. Under the EU AI Act, for organisations in scope, that gap is not a risk management concern — it is compliance exposure.

The governance programme that starts with a policy document will always be running behind the technology. The governance programme that starts with operational control can stay ahead of it. And when governance is built on a live registry and continuous monitoring, it becomes something more than compliance — the operational basis for knowing which AI is delivering value and scaling it accordingly.

‍

In the second article in this series, I will share a concept for three concrete stages, what each deliver, and where to begin.