Most AI governance frameworks fail the same way: every use case gets the same review, the queue backs up, and teams route around it. Risk tiering is the fix, and it is not complicated.
The failure mode is predictable. Legal and security, reasonably alarmed, stand up an AI review process. Every proposed use goes through the same intake. The intake takes six weeks. Within a quarter, half the AI in the company is running outside the process, because a marketing team summarising public documents is not going to wait six weeks for the same review as a model making clinical recommendations.
Governance that people route around is worse than no governance, because it produces the illusion of control plus the reality of shadow usage.
Tier by consequence, not by technology
The useful variable is not which model or which vendor. It is what happens when the system is wrong, and what data it can reach. A workable three-tier split:
- Low: public or internal non-sensitive data, human reviews every output, no automated action. Self-service registration, no review. Approve in a day.
- Medium: confidential data, or output that materially informs a human decision. Lightweight structured review against a checklist. Days, not weeks.
- High: regulated or personal data, automated action without a human in the loop, safety or legal consequence, or external-facing autonomy. Full threat model, named accountable owner, monitoring and a kill switch.
Most usage lands in the low tier. That is the point: it frees your reviewers to spend real time on the ten percent that deserves it.
The controls that matter for agentic systems
Agents change the calculus, because the blast radius is no longer the answer text , it is whatever the tools can do. Scope tool permissions to the minimum, and scope them per agent rather than per platform. Require human confirmation for any irreversible or externally visible action. Log the full chain: prompt, tool calls, arguments, results. You cannot investigate what you did not record. And test with adversarial inputs, since prompt injection through retrieved content is the practical attack, not the theoretical one.
Map to a framework so it survives audit
NIST AI RMF gives you the functions and language. ISO/IEC 42001 gives you a certifiable management system if customers are starting to ask. OWASP's LLM Top 10 gives your engineers a concrete threat list. You do not need all three on day one, but pick one to anchor on early, retrofitting structure onto an improvised process costs more than starting with it.
The test of an AI governance program is not whether it has a policy. It is whether the fastest path to shipping an AI feature runs through the process rather than around it.