Practical guide to govern AI in a 300 FTE organisation
The main struggle we see people face is not physically getting access to a ChatGPT account. It is much more about how you allow parts of the organization to innovate and build skills, like playbooks for orchestrating processes that touch different parts of the company.
How do you ensure they aren’t blocked by their access to connectors? If you are tech-forward and your stack is basically Notion, Linear, and modern Web3 tools, it is pretty straightforward for an employee to get autonomous access. However, it becomes much harder when you have a more complicated stack.
For example, if you have a Microsoft stack, plugging into the right APIs via MCP might be quite difficult. The Claude default connectors do not allow you to write emails today, so you would need a custom connector if you want to connect to your Outlook outbox. Even with just custom software, figuring out how to do that is really difficult.
The other big governance issue is ensuring people do not interpret AI enablement as an invitation to build tons of random apps and dashboards, expecting IT to deploy them.
Setting a clear strategy is essential:
- Apps should only be for really high-volume use cases.
- For most things, manage tasks using a combination of skills that can contain code, perform deterministic actions, and run on end workstations using user permissions.
- Maintain appropriate governance over those skills, including the ability for central teams to risk-manage, scan, and approve them.
- Allow teams a degree of autonomy in building these skills.
We talk a lot about AI governance at enterprise scale, but what does it actually mean for a 300-person organisation?
They may not have an AI governance team, a Chief AI Officer or multiple committees, but their people are still adopting AI and the risks around data, security and accountability haven’t disappeared.
For me, the interesting challenge is finding that balance between having enough governance to protect the organisation without creating so much governance that people simply work around it.