Part 3 of The AI Governance Moment: A Practical Series on Saying Yes to AI Without Losing Control.
A sales team finds an AI pipeline management tool that could cut their administrative time in half and make their forecast far more accurate. The manager asks IT how to get it approved, and nobody is quite sure. The request turns into an email thread that gets forwarded to security, then legal, then procurement, then an architecture review board that meets once a month. Six weeks later it’s still waiting.
By then, half the team has signed up on a corporate card.
The company has had an AI policy the whole time. Legal wrote it last year, and it covers all bases. What it never had was a process: one place to send a request, one owner, and a clear path to yes.
The reputation governance earned
Governance has a reputation for being heavy and slow, and in a lot of companies that reputation is deserved. The most common cause we see in customer work is a framework borrowed from the largest, most regulated enterprises and dropped onto an organization with much simpler needs. Every request gets the same multi-team review, whether it’s a meeting summarizer or an agent that posts entries to the general ledger.
The other common failure is a policy with no process behind it, like the one in the story above. The two look different but end the same way. The approved path is slower than the workaround, so the workaround wins. That’s a design problem. The people signing up on corporate cards are doing exactly what the process rewards.
For a framework to be adopted, it has to balance structure with employee experience. That starts with one front door, a single place where every AI request goes, and it takes two kinds of sizing.
Size the framework to the organization
Organizations differ a lot in how much structure they want, and in how much they need. A B2B SaaS or healthcare technology company may require approval routing across several channels, written policies for proofs of concept, mandates on which infrastructure AI can run on, and formal architecture review. For them, that structure is part of the cost of operating, and a lighter version wouldn’t survive an audit.
A 300-person professional services firm usually needs much less. It needs to know what AI is running, who owns each tool, where to send a new request, and what the spend limits are. That covers the basics without adding a committee and a six-week turnaround.
The questions are the same at every size: what’s running, who owns it, what it can reach, and what it costs against what it returns. What changes is how much process sits around those questions. A framework matched to an organization’s needs gets used, because it protects the company without asking more of employees than the business actually requires. A framework built for someone else becomes the thing people route around.
Size each review to the risk
Inside whatever framework fits, requests shouldn’t all get the same review. Most AI requests are low risk. Someone wants to summarize meeting notes, draft follow-up emails, or perform research. Those can be approved in a day or two, and sometimes on the spot.
A smaller number carry real risk. A tool that can change records in a system of record, reach customer data nobody has reviewed, or act without a person in the loop deserves a closer look. In practice, requests that need no new access move fastest, read-only requests against approved data come next, and anything that writes gets the deepest review.
The win is a fast yes on most requests and real attention on the few that need it. It also changes the experience for the person asking. They have one place to go, a clear answer, and a timeline they can count on. When the first few requests come back quickly, people stop looking for a side entrance.
Make the value visible
A front door also gives a company something it rarely has: one place to see what each AI tool costs, who uses it, and what it returns. That matters more than it sounds. McKinsey’s State of AI 2026 survey found that 80 percent of respondents say AI has improved their own productivity, while 37 percent attribute any impact on EBIT to AI, a share that barely moved from the year before.
Part of that gap is measurement. When nobody tracks cost and value by use case, “we think it’s helping” is the best anyone can say. Tracked properly, it becomes a number. That number defends the spend that’s working, retires the tools nobody uses, and funds what comes next. Measurement won’t create a return on its own, but without it nobody can show one.
Start with what’s already running
Most companies are partway in. AI is already running across teams, so the front door has to cover what exists before it covers anything new. Every tool in use gets an owner and a place in the framework, duplicates get retired, and the tools that are working get the support to keep going. After that, every new request comes through the same door.
What we hear from customers is that this is the part they want most: structure added without shutting down the experimentation they encouraged. A framework that fits makes that possible, because it adds only as much process as the organization needs.
Governance done well gives a company enough structure to protect itself and an experience simple enough that employees choose it over the workaround. That balance is what lets a company say yes to AI without losing control.
Not sure how much structure your organization actually needs? We help companies build governance that fits how they work, light where it can be and thorough where it has to be. Contact us to start the conversation.
This is the final part of The AI Governance Moment. Start from the beginning with Two Years of Yes, or read Crawl, Walk, Run to Yes.