AI can move faster than the organisation that governs it.
Teams adopt tools. Vendors add AI features. AI agents gain access to business systems. Processes begin to depend on them.
Then leadership has to answer harder questions: What are we using? Who owns it? What can it do? What risk are we accepting? And who can intervene when something changes?
I help organisations put visibility, accountability and practical governance around AI so they can move forward without losing control of the decisions that matter.
Independent advice · Business-first · Governance designed around your organisation
AI adoption rarely waits for the governance programme.
Marketing is using one tool.
Operations has another.
A software provider quietly adds AI to a platform the business already depends on.
Someone connects an agent to the CRM.
At first, each decision looks small.
Six months later, leadership asks:
- Which AI systems are actually in use?
- What data can they access?
- Who approved them?
- Who owns the business outcome?
- Which decisions can they make or influence?
- Who has the authority to stop one?
If those answers are difficult to produce, the organisation does not primarily have an AI technology problem.
It has a governance problem.
AI governance starts with visibility, not policy.
A policy cannot govern something the organisation does not know exists.
Before adding committees, controls or another approval process, I want to understand where AI is already being used, why the business is using it and what authority has been given to it.
Governance can then follow the risk.
A low-impact productivity tool should not be governed like an AI system influencing a consequential business decision.
And an AI agent capable of acting inside business systems needs different oversight from a tool that simply drafts text.
The stronger the capability, the clearer the accountability should become.
The question is not simply "Can we use AI?"
It is "Where should we use it, under what conditions, and who owns the outcome?"
Good governance should not become the department of No.
It should help the organisation distinguish between AI opportunities worth pursuing, risks worth accepting, risks that need stronger controls and situations where leadership should say not yet.
That means connecting AI governance to the things the business already understands: strategy, value, risk appetite, accountability, investment and consequences.
The purpose is practical governance that gives the organisation enough clarity to use AI with confidence.
From scattered AI use to governable AI.
I do not begin by assuming you need a new committee, a 40-page policy or another framework. We first establish what is actually happening.
AI Discovery & Visibility
Understand where AI is already being used, where it is planned and where important dependencies may be developing. The aim is not merely an inventory. It is to understand which uses matter to the business and which deserve greater scrutiny.
AI Risk & Accountability
Connect AI use cases with business impact, data, security, regulatory exposure and the organisation's tolerance for risk. Then make ownership explicit: who owns the use case, who owns the risk, who can approve it, who monitors it and who can intervene.
Governance & Decision Rights
Define which decision paths should apply to AI without creating an entirely separate bureaucracy. Where possible, governance should strengthen and connect existing structures rather than reproduce them.
AI Lifecycle Governance
AI systems change. Models change. Vendors change. Access changes. Business use changes. Important AI systems need to be reviewed when their scope, performance, risk profile or access changes, and when they are retired.
Executive AI Governance Readiness
Give leadership a clear view of the AI portfolio, the risks it is accepting and the decisions that cannot be delegated to technology teams alone. The board does not need to understand every model. It does need enough visibility to govern the consequences.
Typical engagements
- AI Governance Assessment: A structured view of AI use, risk, accountability and the most important governance gaps.
- AI Governance Operating Model: Roles, decision rights, approvals, escalation paths and governance across the AI lifecycle.
- Executive AI Governance Workshop: A working session for leadership on risk appetite, accountability and the decisions that should not be delegated to technology teams.
When AI starts acting, delegated authority becomes a governance question.
An AI agent begins with one task: update records in the CRM.
Later, another workflow is added. Then another system. Then a broader permission.
Nothing looks dramatic in isolation.
Until somebody asks:
Who authorised the agent to do all of this?
That is where AI governance begins to overlap with identity, access, cybersecurity and business authority.
An organisation should be able to determine what an agent is permitted to do, who delegated that authority, how its actions can be traced, when its access should be reviewed and how that authority can be revoked.
Not because every AI agent is dangerous.
Because autonomy without accountable authority is difficult to govern.
I don't start with the AI framework. I start with the decision.
- What is the organisation trying to achieve?
- Where is AI already helping?
- What could materially affect customers, operations, data, employees or trust?
- Which decisions require human accountability?
- What level of risk is leadership prepared to accept?
Only then do we decide what governance is actually required.
Depending on the situation, the work may produce an AI inventory, a risk assessment, a governance structure, clearly defined decision rights, policies, lifecycle controls, an executive briefing or a prioritised roadmap.
The deliverable follows the decision. Not the other way around.
AI governance can no longer be left for later.
Regulation is evolving alongside AI. The EU AI Act became broadly applicable on 2 August 2026, while some provisions take effect later. Which obligations apply depends on the organisation's role and the type of AI system involved.
But regulation is only part of the reason to act.
The more immediate question for many organisations is simpler:
Can you explain how AI is being used in your business today and who is accountable for it?
If not, that is where I would begin.
You do not need to control every AI decision centrally.
You need to know which ones matter.
With good AI governance, the organisation can see where AI is being used, distinguish between different levels of risk and route decisions to the right people. Business owners understand their accountability. Leadership understands the material risks. Teams know what they may do without escalation and what requires approval. Changes to an AI system do not quietly invalidate the assumptions on which its approval was based.
And governance helps responsible innovation move faster, because people know the boundaries within which they can act.
That is a much better outcome than creating a committee everybody tries to avoid.
Governance is ultimately a leadership discipline.
My work sits between technology, risk and business decision-making.
I bring more than 20 years of experience across technology, security and leadership, including over a decade supporting operations for the Defense Commissary Agency (DeCA), a component of the U.S. Department of Defense.
I am a CISM and ISACA author, and a two-time Cyber Leadership Institute Capstone Winner, having won both its Cyber Leadership Program and Cyber Strategy & Transformation Program Capstones.
Those Capstone projects test the skills that matter here: connecting technology risk with business strategy, establishing executive sponsorship, navigating stakeholders and turning complex analysis into decisions people can act on.
More About André →Start with a clearer view of the AI you already have.
If AI adoption is moving faster than ownership, oversight or decision-making in your organisation, we can start by making the current picture visible.
Then we determine what actually needs governing.
No generic AI transformation pitch. A practical conversation about what your organisation is using, what matters and where accountability needs to become clearer.