AI adoption has moved quickly. For many businesses, governance hasn’t moved at the same pace.
That’s understandable. AI entered the workplace with a compelling promise: help people work faster, improve productivity and find better ways of doing things. Employees were encouraged to experiment.
But, as Phil Bindley, Field Chief Information Security Officer at Intercity, explains at our recent Intercity Unplugged event, that has created a problem. AI adoption has often happened from the bottom up, while governance traditionally comes from the top down.
The result? Businesses can find themselves using AI without fully understanding which tools are in play, where their data is going or who is accountable for the risk.
The problem isn't AI. It's a lack of control
AI risk can easily be treated as another IT or cybersecurity problem. But that's missing the bigger picture.
Phil Bindley argues that AI risk is a business risk. IT can help deliver the strategy and put appropriate technology in place, but accountability ultimately needs to sit with senior leadership.
And the risks aren't limited to deliberate cyber attacks.
AI creates new ways for information to leave an organisation. AI-generated answers can also be wrong, creating problems if people act on them without checking. As AI agents begin completing tasks more independently, questions around oversight become even more important.
So what can businesses do?
8 steps to bring AI back under control
1SURFACE REALITYBefore introducing more controls, understand what's already happening. What AI tools are being used? By whom? For what? And crucially, what data is going where?
2ASSIGN CLEAR OWNERSHIPGive one executive accountability for AI risk. This shouldn't simply fall to IT because AI happens to be technology.
3DEFINE CLEAR RULES FOR DATAEstablish what information can and cannot be entered into AI, including rules for different types of AI tools and models.
4MANDATE HUMAN VERIFICATIONFor high-impact AI outputs, define where human verification is required before something is published, shared or acted upon.
5treat ai as a third-party riskConsider the risks associated with the AI services, models and technologies your organisation uses, just as you would other third-party services.
6train people to understand the riskGood governance isn't about frightening people away from AI. Help employees understand why the rules exist and how their use of AI can introduce risk.
7put guardrails in placePolicy alone isn't enough. Combine clear processes and policies with appropriate technical guardrails, supported by a culture where people actively think about AI risk.
8build ai into existing risk managementDon't create AI governance as another silo. Bring it into the risk-management processes your business already uses, so AI risk can be understood in the context of where and how the technology is being used.
|
The goal isn't less AI. It's better-controlled AI.
These eight steps aren't about putting the brakes on AI. They're about creating the conditions to use it with greater confidence.
And that matters because AI adoption doesn't stand still. What starts with a few employees experimenting with tools can develop into AI supporting business processes and, increasingly, agents taking actions with less human involvement. As that use becomes more embedded, the impact of getting governance wrong can become harder to contain.
That means governance needs to mature alongside adoption.
For some organisations, the immediate priority will simply be visibility: understanding what's already being used and establishing basic policies and ownership. Others will need to formalise governance, assess themselves against standards such as ISO 42001 or work out how to scale successful AI use cases safely.
The point isn't to reach an arbitrary level of AI maturity. It's to make sure your level of control matches your level of adoption.
Moving forward with AI, without losing control
With the right governance in place, businesses can make better decisions about where AI can deliver genuine value, rather than simply restricting its use.
That's where Intercity's approach comes in.
We look at AI through three connected stages: creating clarity and direction around leadership, strategy and risk; moving towards secure adoption with clear use cases and governance; and ultimately scaling AI into a controlled enterprise capability.
Because every organisation is at a different point. Some are still experimenting with individual tools. Others are starting to embed AI into everyday processes. The important thing is understanding where you are now and making sure your governance keeps pace with your ambition.
As Phil Bindley puts it, the risk isn't going away. The opportunity is to get a handle on it now, before AI becomes even harder to control.
Watch: Taming the AI Wild West
In the full on-demand session, Phil Bindley, Field Chief Information Security Officer at Intercity, goes deeper into the real-world consequences of poorly governed AI, the maturity journey organisations can take and the practical steps businesses can put in place now.
