AI governance

What AI governance delivers

AI governance covers the rules by which a company decides which AI systems may be used, who approves them and who answers for the results. It does not answer which technology is good, it answers who decides and what they must adhere to.

Without such rules a typical pattern emerges. Individual teams test tools, nobody knows the total number and when a complaint arrives nobody is responsible. The damage does not come from the individual trial but from the missing overview.

The four core elements

• Register: A list of all systems in use with purpose, provider, data types and the responsible person. Without this register no other rule can be checked.
• Risk classification: Not every system needs the same review. A spelling correction is something different from a system deciding credit or prices for individual customers.
• Approval path: Who may introduce what, and from which level a review by data protection and management is required.
• Operational review: Who inspects the results, on what cadence, and where a complaint lands.

Where the law comes in

Two legal areas matter most for retail. First, data protection: every processing of personal data needs a purpose and a legal basis, and that also applies when the processing is carried out by a service provider. Second, information duties for AI systems that interact with people. A chatbot must be recognisable as a machine, and anyone producing content that looks deceptively real has to think about labelling.

For systems used in sensitive areas, such as hiring or credit decisions, the requirements rise substantially. A retailer is generally not affected by those. It is affected as soon as a system decides price, availability or payment method for individual customers, and that is exactly where the requirements are often overlooked.

What an introduction without a big project looks like

The start is small and consists of three steps. First, create the register, without claiming completeness, but with a named owner. Second, define three risk levels, low, medium and high, with a short description of what falls into each. Third, set an approval path that allows self declaration for low levels and requires review for high ones.

Two rules belong alongside, and they achieve the most in daily practice. First: no system without a named responsible person. Even the statement that nobody is responsible must be owned by someone. Second: no automatic action without a way to switch it off. The rule sounds technical but is a governance rule, because it raises the question of who decides in an emergency. Anyone who honours these two points has already captured most of the benefit without running an extensive rulebook.