Building an AI governance program people can work with

In this lesson you'll

• Explain what an AI governance program is for: letting people use AI and agents safely, not stopping them
• Name the eight parts of a working program and where each is taught in this course
• Assign roles and accountability for the key AI decisions in your organization, even if your team is small

Welcome

This specialist course from the Enterprise Technology Association (ETA) is for the people who have to say "yes, safely" to AI: CIOs, CISOs, IT managers, security and risk owners, compliance leads and operations leaders at small to mid-size organizations and public bodies. When you finish the course and pass the final assessment, including a reviewed capstone, you earn the ETA Specialist: AI Governance and Security credential.

The course assumes you have completed Level 1: Foundations of the ETA Certified AI Empowered Professional, or have equivalent experience. We reuse its vocabulary without re-teaching it:

• ADAPT (Assess, Direct, Assure, Protect, Tune), the five capabilities of a fluent AI user. Most of this course is Protect at the scale of a whole organization.
• The six-part brief (goal, context, audience, constraints, format, done criteria).
• The ETA Agent Autonomy Ladder (Rungs 1 to 5) and its rule of thumb: climb only as high as the risk, the reversibility and your oversight allow. Module 3 turns the ladder into an approval control.

What AI governance is for

AI governance is the set of roles, rules and routines an organization uses to decide which AI uses are allowed, under what conditions, and who answers for the results. AI security is the part that protects data, systems and people from AI-specific threats and from ordinary threats that AI makes easier.

A common failure is treating governance as a brake. If the approved path is slow or unclear, people use personal accounts and free tools anyway, and you lose sight of the data. A better goal is a paved road: an approved, easy, well-lit way to use AI that most people choose because it is the fastest path. Governance then concentrates its effort on the small number of uses that are truly high risk.

Three ideas carry through every module:

1. Know what you have. You cannot govern AI you cannot see.
2. Match control to risk. Low-risk uses get light rules; high-risk uses get assessment, approval and monitoring.
3. Keep a person accountable. Every AI use and every agent has a named owner. "The AI did it" is never an explanation.

The eight parts of a working program

You do not need all eight at full strength on day one. A 90-day start, which you will plan in the capstone, usually gets a basic version of each part in place and then improves the riskiest areas first.

Roles and accountability

Governance fails quietly when nobody owns a decision. Name these roles, even if one person holds several.

A RACI for the decisions that matter

A RACI chart names who is Responsible for doing the work, who is Accountable for the outcome (exactly one person), who is Consulted and who is Informed. Write one for the five decisions below; they cause most of the confusion.

Your split may differ. What matters is one accountable person per decision, written down where people can find it.

Small organizations: one person, many hats

At a 60-person manufacturer, the IT manager may be the governance lead, security lead and administrator at once. That is fine if two things hold: the executive sponsor (often the COO or owner) still accepts high risks in writing, and an outside or internal second pair of eyes reviews high-risk approvals so the person granting access is not also the only person checking it.

A useful pattern is a small AI working group that meets for 30 minutes every two weeks during setup and monthly after: the governance lead, someone from security or IT, someone from legal or compliance (or an outside adviser), and two people from the business who use AI daily.

Workplace example: a county government

A county with about 900 employees found that staff in four departments were using different AI tools, and nobody could say who had approved them. The county administrator named the CIO as AI governance lead and herself as executive sponsor. The CISO took security controls, the county attorney's office took privacy and legal review, and each department head named a use-case owner for each AI use in their area. Within a month, the working group had a RACI on the intranet and a single intake form, and new requests stopped arriving by hallway conversation.

Try it

Draft the RACI for your organization. In your organization's approved AI tool, use a brief like this (remove names if your policy requires):

Goal: Draft a RACI chart for AI governance decisions at my organization.
Context: We are a [size, sector] organization. Our relevant roles are [list job titles,
e.g. IT manager, compliance officer, COO]. Some people hold several roles.
Audience: Our leadership team.
Constraints: Exactly one Accountable person per decision. Flag any decision where the
same person both grants access and is the only reviewer.
Format: A table with rows for: approve a new AI tool, approve a high-risk use case,
grant an agent access to a system, respond to an AI incident, accept residual risk.
Done criteria: Every row has R, A, C and I filled in, plus a note on any conflicts.

Check the draft against your actual organization chart and fix anything the AI assumed. No AI tool available? Copy the RACI table above and fill it in by hand with real job titles.

Key takeaways

• AI governance exists to let people use AI safely; a slow or unclear approved path drives shadow AI.
• A working program has eight parts; start with a basic version of each and strengthen the riskiest first.
• Name one accountable person for each key decision, and keep the person granting access separate from the only reviewer.
• Small organizations can combine roles, but the executive sponsor still accepts high risks in writing.