Minimum Viable AI Governance: How to get started

This is the second article in a two-part series. The first set out the case for Minimum Viable AI Governance and the six controls it requires - Discover, Assign, Classify, Control, Monitor, Evidence. This article covers implementation: three stages, each delivering something concrete, each creating the foundation for the next.

‍

The governance conversation stalls at the same point. Everyone agrees AI governance is necessary - the EU AI Act has made the regulatory imperative concrete. And then someone asks: where do we actually begin?

Traditional programmes answer with the policy: define the rules, establish the framework, then proceed. This reliably produces governance programmes still in design when the AI estate has moved on.

Minimum Viable AI Governance gives a different answer. Begin with what is real. Start with the AI already in use, not the rules to be enforced. Start with the minimum effective action available now, not the programme to be built eventually. At every stage, something useful is produced - rather than nothing - until the framework is complete. It also creates something a policy document cannot: a live picture of which AI is in use, how, and to what effect - the foundation for scaling AI efficiently, not just governing it safely.

‍

Three stages. Each one operational.

Each stage is named after what the organisation has achieved once it’s complete.

Together they cover six capabilities: Discover → Assign → Classify → Control → Monitor → Evidence. 

Stage 1 - Establish Visibility | Discover + Assign

The first objective is a complete, current picture of AI activity - based on what is in use, not what teams have reported. This means discovering AI tools, systems, models and agents across cloud, on-premises and SaaS environments, surfacing shadow AI, and capturing for each use case: owner, data touched, model used, connected systems and approval status. Dataset connections are documented at registration, creating a complete record rather than a system inventory with the data picture missing.

The output is a single, continuously maintained AI inventory - an automated, living register rather than a spreadsheet completed once and left to go stale. Without it, risk classification is guesswork, controls cannot be targeted, monitoring has nothing to anchor to, and evidence cannot be produced. The gap between what leadership believes is in use and what the inventory reveals is almost always larger than expected - and naming it is what makes governance a concrete operational priority rather than an abstract one.

Stage 2 - Apply Proportionate Controls | Classify + Control

With a reliable inventory in place, the organisation moves from visibility to control. The governing principle: controls should match risk, not exceed it.

Each use case is classified against the EU AI Act's mandatory risk tiers - unacceptable (prohibited), high risk (mandatory documentation, human oversight, conformity assessment), limited risk (transparency obligations), minimal risk (proceed with appropriate care) - plus sector-specific requirements and internal criteria. Applying this at registration removes the case-by-case committee bottleneck.

The result is a permission structure: approved use cases proceed without friction; restricted uses are addressed; review-required uses are routed through defined approval processes. Controls - data restrictions, model guardrails, oversight thresholds - apply only where the risk tier warrants them. This risk-based, permission-granting approach is where Minimum Viable AI Governance most clearly differs from traditional governance: uniform processes slow low-risk innovation to the pace of high-risk decisions, creating friction without additional safety, and a stronger incentive to bypass the process. Proportionate control gives employees a governed route to the AI capability they need rather than a blanket restriction - making governance an enabler of adoption, not an obstacle.

Stage 3 - Generate Assurance | Monitor + Evidence

With an inventory maintained and controls in place, the governance system produces the evidence boards, auditors, regulators and customers require — not assembled under pressure but generated continuously since Stage 1. Decision records, audit trails, control mapping and current risk assessments are maintained automatically.

This evidence is ready when needed: a customer due diligence questionnaire, a regulatory request, an internal audit. And it marks the structural transition from governance as a project the organisation is working towards to governance as an operating model it is running.

The same inventory and monitoring infrastructure that enables compliance also enables something broader: measuring actual use, adoption and business value for each AI use case. Which tools are delivering real productivity gains? Which use cases justify further investment? Which are underused or duplicative? Governance built this way becomes the operational foundation for scaling AI efficiently across the organisation - not just controlling risk but directing effort and investment where AI demonstrably creates value.

The principle that makes it work

Minimum Viable AI Governance works because it meets AI adoption where it actually happens - quickly, informally, driven by teams solving immediate problems - rather than assuming a controlled rollout that governance can anticipate in advance. It establishes visibility first, applies controls calibrated to actual risk, and generates evidence as a natural output rather than a periodic exercise.

Stage 1 is where to begin. From that foundation, governance grows into something more than a compliance mechanism - the operational basis for scaling AI where it creates value and directing investment accordingly.