Use AI with clear boundaries and human control.

Governance should make AI usable.

Weak governance creates two poor outcomes. People use AI inconsistently without clear boundaries, or they avoid useful AI because they are unsure what is allowed.

A practical governance model should give staff enough clarity to use AI confidently while preserving professional control.

The goal is not to eliminate risk. It is to understand, control and manage it.

A written policy is only one part of governance.

Governance is not just a document. It is the operating model that influences how people work, which tools they use, what information they may enter, what they can do, when they escalate and how staff learn the boundaries.

Not every AI capability should have the same level of authority.

A practical governance model distinguishes between assistance, recommendation and action. The greater the consequence of an action, the stronger the control should be.

Human review is not one thing.

Review depth should depend on the nature of the task, the consequence of error, the quality and completeness of inputs, whether professional judgement is involved, whether the output reaches a client, whether the system takes an action and whether an exception is present.

Some decisions remain fundamentally professional.

Firms should be especially careful where work involves material professional judgement, ambiguous facts, consequential tax or accounting interpretations, client-specific advice, final approval, sign-off, exceptions outside defined rules or ethical or sensitive matters.

AI may help prepare the decision. It should not be confused with the accountable professional making the decision.

Good governance is tested when the workflow stops being normal.

A robust agent or workflow should know when to stop, flag uncertainty, identify missing information, escalate, request human review and avoid taking an action.

A reliable system is not one that always produces an answer. It is one that knows when not to proceed.

Control what information AI can use.

Firms should define approved systems and sources, what client information may be used, where information is stored, who may access it, whether information may leave an approved environment, what outputs are retained and how sensitive information is handled.

This is a business governance question before it becomes a technical one. The important point is clarity of use, access and handling rather than a generic statement about “security”.

An agent should know its boundaries.

Governance should be designed into the agent itself rather than added as an afterthought. A well-designed agent should have explicit rules around purpose, approved inputs, available tools, output format, prohibited actions, uncertainty, escalation, human approval and stopping conditions.

This connects directly to AI Agents for Compliance, where practical boundaries are essential to a useful operating model.

Clarity helps people adopt AI confidently.

Staff need practical answers to questions such as: What tools may I use? What information may I enter? What should I check? What requires approval? What should I do if I am uncertain? What should never be delegated to AI?

That is where governance becomes real. It is not just a policy statement on a page. It is a model people can apply while doing ordinary work.

This connects directly to Education & Training and the practical challenge of equipping staff with the right judgement and operating model.

Someone should own the operating model.

Firms should have clear responsibility for approved AI use, governance standards, workflow approval, incident or exception escalation, review of material changes and ongoing monitoring. Smaller firms may combine these responsibilities, but the ownership still matters.

Governance sits across every AI-enabled compliance workflow.

It is not a separate destination. It is a layer across the wider compliance model: from readiness and workflow support, through decision support and agent design, to the broader operating model of a firm.