9 min read AI Process Improvement

Your AI Governance Committee Has a Blind Spot. It's Called 'Everyone Else.'

Bayeux Tapestry style illustration contrasting two approaches to AI governance. On the left, a thriving multi-level building filled with workers collaborating at every level, with the Latin inscription HIC GUBERNATIO AB INTUS AEDIFICATUR (here governance is built from within). On the right, an empty scaffolding structure covered in cobwebs with a lone figure sitting idle, inscribed STRUCTURA VACUA NEMO AUSCULTAVIT (an empty structure, no one listened). Mythical creatures decorate the tapestry border.
Hic Gubernatio Ab Intus AedificaturHere governance is built from withinStructura Vacua Nemo AuscultavitAn empty structure — no one listened

The organisations getting AI governance right share a common practice: they build it from the ground up. They involve the people who use the tools daily, encounter the edge cases, and understand where the real operational risks sit. Then they wrap strategic oversight around that intelligence.

The result is governance that people follow because it addresses their actual working conditions. Policies are shorter, because they’re built around real scenarios rather than theoretical risk categories. Training lands, because it answers questions people have actually asked. And compliance becomes something people do naturally, because the sanctioned path was designed by people who understand the work.

Here’s how to build it.

Five shifts that make governance stick

1. Map what’s already happening before writing a word of policy

Start with a no-blame discovery exercise. Ask people what AI tools they’re already using, what they wish they could use, and where they’re uncertain about what’s allowed. The gap between those three answers is your governance roadmap.

This matters because most organisations are further along than their governance frameworks acknowledge. A 2025 survey of over 12,000 white-collar employees found that 60.2% had used AI tools at work, while only 18.5% were aware of any official company policy. The usage is already there. The governance just hasn’t caught up.

The Director of Housing running tenant services, the Publishing Director managing content workflows, the Head of Advisory at an accountancy practice: each of them has teams making AI decisions right now without guidance. The discovery audit gives you visibility, and visibility is where useful governance begins.

2. Put practitioners on the steering committee

The people who encounter the governance-critical edge cases are rarely the ones writing the governance framework. The customer service representative deciding whether a complaint containing personal data can go into a summarisation tool. The finance analyst wondering whether client revenue figures can be processed by a third-party model. These are the decisions where governance either works or doesn’t, and they happen daily at every level below the steering committee.

Including practitioners on the committee doesn’t dilute strategic oversight. It sharpens it. BambooHR’s 2025 workplace data showed that 72% of C-suite executives use AI daily, compared with 18% of individual contributors. Senior leaders bring valuable experience of the tools. And the operational staff bring something different: knowledge of where the tools meet messy, real-world conditions that produce actual risk. Governance needs both perspectives.

The TUC’s 2025 pro-worker AI innovation strategy reinforces this from a trust perspective: polling showed that 50% of the public would trust AI in public services more if workers were actively involved in its governance, rising to 72% among Black voters. Involvement builds trust. It also builds better governance, because the people closest to the risk understand it in ways that boardroom theorising cannot replicate.

3. Frame governance as enablement

The most effective AI governance starts with “here’s how” rather than “don’t.” Frame it around use cases: the ten most common AI scenarios your people actually face, with clear, practical guidance for each. Test it with the people who’ll use it. Iterate based on their feedback.

This approach works because people engage with systems designed to help them succeed. It’s also why your AI policy needs examples, not just principles — concrete scenarios give people something to act on, where abstract principles leave them guessing. BCG’s AI at Work 2025 survey of over 10,600 employees found that leadership support raises positive AI sentiment from 15% to 55% among frontline workers. When people feel supported, they adopt the sanctioned tools. When they feel restricted, they find alternatives. The 12-page acceptable use policy that nobody reads is a restriction. Practical guidance for real scenarios is support.

Think about the Registrar at a university reconciling student data handling with AI assessment tools, or the Head of Fundraising at a charity wanting to use AI for donor communications. Neither needs a policy document. Both need specific, contextual guidance they can act on immediately. That’s what enablement-framed governance provides.

4. Close the training gap

Training is governance infrastructure. People who understand the tools make better decisions about when and how to use them. They recognise the risks in the moment, without needing a policy document to spell out every scenario. They become the governance framework’s most effective enforcement mechanism, because they’re equipped to exercise good judgement where the work actually happens.

The opportunity here is significant. BambooHR’s data showed that 72% of all employees want to improve their AI skills, while only 32% have received formal training. Among individual contributors, just 23% receive training compared with 50% of managers and senior titles. The appetite is there. Organisations that invest in training across all levels gain a workforce that self-governs well, because understanding creates responsibility.

Consider the difference this makes in practice. The operations team trained in responsible AI use spots the data risk before it becomes an incident. The marketing coordinator who understands disclosure requirements handles AI-generated content correctly as a matter of course. Training turns compliance from a document people are supposed to read into a capability people actually have.

5. Make the compliant path the easiest path

When the sanctioned AI tools are slower, less intuitive, or less capable than ChatGPT with a personal account, the governance framework has a design problem. Fix the tooling. Reduce the friction. Make the safe path the obvious path.

As CIO.com noted, the most effective CIOs now frame AI governance as responsible empowerment: turning employee creativity into lasting enterprise capability. When Daria Rudnik, an executive leadership coach, told the Senior Executive AI Think Tank that “employees use unauthorised AI tools because what the company provides isn’t enough,” she identified the design principle: every instance of unsanctioned tool use tells you where the approved path needs improving.

This is how organisations convert shadow AI from a compliance headache into a governance design tool. For a concrete example of what this looks like in a technical domain, consider how guardrail-based governance applies to AI-generated code — the same principle of making the compliant path the easiest path, applied to platform-embedded AI tools. BCG found that 54% of employees would use unauthorised AI tools, rising to 62% among younger workers. Microsoft’s research found 71% of UK employees already have. Each of those instances is a signal: here’s a workflow that needs a better sanctioned option. Listen to the signal, and the governance improves.

What bottom-up governance produces

Six months after implementing these shifts, organisations report a recognisable pattern. The acceptable use policy is shorter, because it’s built from actual scenarios rather than imagined ones. Shadow AI usage drops, because the sanctioned tools now address the workflows people actually have. Training attendance rises, because the content answers questions people have been asking. And the steering committee produces guidance that people three levels below can describe and follow.

The competitive separation here is real. BSI’s October 2025 research found that only 24% of organisations have an AI governance programme, despite 62% planning to increase AI investment. Only 30% have processes to assess AI-related risks. Susan Taylor Martin, BSI’s Chief Executive, described this as “overconfidence coupled with fragmented and inconsistent governance approaches.” The organisations that build governance from practitioner intelligence are operating in open space.

The Gallup Q3 2025 workforce data helps explain why this space is so wide: 26% of individual contributors can’t even tell you whether their organisation has implemented AI, compared with 7% of leaders. When a quarter of your workforce is disconnected from the AI strategy, simply including them in the conversation creates immediate advantage.

From control to stewardship

The role of senior leadership in this model is stewardship, not authorship. Strategic direction comes from above. Operational intelligence comes from below. Governance that works sits at the intersection.

This means senior leaders hold the boundaries: the risk appetite, the regulatory requirements, the strategic priorities. And practitioners shape the substance: the specific use cases, the workflow guidance, the practical scenarios that determine whether governance is followed or ignored. Both contributions are essential. Neither is sufficient on its own.

The test for whether your governance committee is functioning in this mode is straightforward: can the people three levels below describe what the committee has produced that has changed their working lives? If the answer is clear and specific, the model is working. If the answer is a blank stare, the committee is operating in isolation, regardless of the seniority of its members.

McKinsey’s Superagency report (January 2025) concluded that employees are ready for AI, and that the biggest barrier to success is leadership responsiveness. That finding reframes the governance question entirely. The capability exists across the organisation. The governance framework’s job is to connect it, channel it, and keep it within appropriate boundaries. When it does that well, the steering committee becomes the most valuable group in the building. When it doesn’t, it’s a line on a LinkedIn profile.

The craft of governance

There’s a reason the most effective safety systems in high-risk industries are built from frontline observation. The people closest to the work understand the risk in ways that strategy documents cannot capture.

AI governance follows the same principle. The organisations that build it from practitioner intelligence upward will produce frameworks that are followed because they’re useful, not because they’re mandated. They’ll close the gap between strategy and operations. And they’ll turn the steering committee from a governance formality into the connective tissue between what the organisation intends and what it actually does.

Worth considering whether your own AI governance has been shaped more by the people who approve the budget, or by the people who do the work.