AI governance: what teams should document now
Between compliance theatre and ignoring the topic sits a short list of things every team should know anyway. A pragmatic minimum.
Governance has a bad reputation because it often shows up as a form-filling exercise. The useful core is smaller than most guides suggest — and it helps even when nobody is auditing.
The inventory
A list of every AI feature in the company, with purpose, model used, data sources, responsible person and date of last review. A spreadsheet is enough. A surprising number of organisations cannot answer this question.
The data question
- Which personal data leaves the building, and on what legal basis?
- Are inputs stored by the provider or used for training?
- Is there a data processing agreement, and does it cover the actual usage?
- How long are logs retained — and who can access them?
Transparency towards users
Where people talk to a system, they should know it is one. Where content was machine-generated and that matters, it deserves a note. This is less a legal question than one of credibility.
Author
Research, context and fact-checking for everything published on kiprozess.com.
Keep reading
Understanding context windows: why more is not automatically better
A million tokens sounds like the end of all limits. In practice it is not the size of the window that decides, but what sits inside it.
Building a small RAG system: what you actually need
A RAG system sounds like heavy infrastructure. For a small project, four building blocks are enough: documents, an embedding model, a vector database, and a language model. Here's how they fit together conceptually, using Google Gemini and ChromaDB.
Agents in the mid-market: what really happens after the pilot
Almost every company is running an AI pilot by now. Few make it into day-to-day operations. Why that is — and what the exceptions do differently.