AI strategy and governance
Two related pieces of work for two different readers. Strategy is about where AI belongs and in what order. Governance is about who approves it, what is never delegated to it, and how a board can demonstrate oversight.
Book a free 30-minute conversationRelevant credential
I am a serving trustee on a risk and audit committee. The governance half of this page is written from the side of the table that has to sign the assurance statement, not from the side selling the tool.
About »Two halves. Start with the one you came for.
The organisation is being asked two different questions and answering neither
The executive team is under pressure to show progress on AI. The board is under pressure to show control of it. Those pressures pull in opposite directions, and the usual outcome is a policy document nobody uses and a pilot nobody governs.
They are separable problems. Strategy decides what is worth doing. Governance decides what happens when someone does it. An organisation needs both, and they are rarely written by the same hand.
Half one
Strategy
What is worth doing, and in what order.
A prioritised position on AI that a leadership team can defend: which processes are genuinely improved by it, which are not, what the sequence is, and what the organisation should decline to do for now.
The output is a short strategy paper and a sequence, not a transformation programme. It is deliberately reversible. Every stage in it can be stopped without stranding the one before it.
Where AI belongs
Named processes, with the expected effect stated in cost, revenue or risk terms rather than in capability terms.
Where it does not
The list of things you will not do yet, with the reason. This is usually the most useful page.
The sequence
What comes first, what depends on what, and where the stopping points are.
The build-or-buy view
Which of these should be bought, which configured, and which genuinely built.
Half two
Governance
Who decides, and how you evidence that you did.
A governance framework proportionate to the organisation: an approval route for AI use, a register of where it is in use, a set of decisions that are never delegated to a system, and a reporting line that gives a board something real to review.
Written to be used at a committee meeting rather than filed. For charities and regulated organisations it is written so it can be referenced in an annual report or an assurance statement.
An approval route
Who can authorise an AI use, at what threshold, and what evidence they need in front of them.
A register that is maintained
Where AI is in use, by whom, on what data, and who owns each entry.
Reserved decisions
The decisions that are never delegated to a system, agreed and written down.
A reporting line
What comes to the board, how often, and in what format. Usually one page a quarter.
Twelve questions a board should be able to answer about AI
Useful whether or not you engage me. If your board cannot answer most of these, that is the finding, and you do not need to pay anyone to reach it.
Approval and accountability
- Who in this organisation can authorise a new use of AI, and at what value?
- Which decisions have we agreed are never made by a system without a person answerable for them?
- If an AI-assisted decision harmed someone, who would be accountable, by name?
Data and suppliers
- What data leaves the organisation when staff use AI tools, and who agreed to that?
- Which of our suppliers use AI inside services we buy, and were we told?
- If a supplier withdrew an AI feature we depend on, what would stop working?
Oversight and evidence
- Where is AI currently in use across the organisation, and how do we know that list is complete?
- What comes to this board about AI, how often, and who writes it?
- How would we detect an AI system producing consistently wrong output?
Risk and limits
- What are we deliberately not doing with AI, and is that written down anywhere?
- What would we do in the first hour of an AI-related incident?
- If we are asked in twelve months to evidence our oversight of AI, what would we produce?
Take these into your next meeting and use them. They are on this page in full, deliberately: there is no form to complete and no email address to hand over.
What you get
- A short strategy paper: where AI belongs, where it does not, the sequence, and the trade-offs made explicit
- A governance framework with an approval route, a register, reserved decisions and a reporting line
- A board or committee session taking the framework through the people who have to operate it
- The reserved decisions list, agreed with the board and written to survive a change of chair
- A reporting template of one page a quarter, designed so whoever inherits it can complete it
How this is scoped
No published price. Both halves are scoped individually, and either can be bought without the other, though governance without a strategy tends to govern nothing, and strategy without governance rarely survives its first incident.
One half or both
Strategy alone, governance alone, or the pair. The pair is less than the sum, because most of the discovery is shared.
Regulatory exposure
Regulated, charitable and data-sensitive organisations need a framework that stands up to external scrutiny, which is more work.
How many decision bodies
One executive team is straightforward. An executive team, a board and a committee structure with delegated authority is not.
Fees are agreed in writing before work starts. If the honest answer is that you need a two-hour board session rather than an engagement, I will say so and charge for the two hours.
Who this is for, and who it is not for
This is for you if
- You are a chief executive who needs a defensible AI position rather than a pilot
- You are a board, trustee group or audit committee that has to demonstrate oversight of AI
- You are a charity where AI use has started informally and the trustees have become aware of it
- You are regulated, and an AI policy has to survive external scrutiny
This is not for you if
- You want a policy document to file. If it is not going to be used, it is not worth paying for
- You need a tool selection or an implementation partner
- You are looking for reassurance rather than an assessment
- You have not yet established whether you can adopt AI at all. Start with the readiness assessment
Why this is worth having from me
No software to sell
I do not own, licence or resell a product. Nothing in a recommendation points at something I profit from.
No reseller agreements
No partner tiers, no referral fees, no vendor relationships that need feeding.
No platform commissions
If the right answer is the system you already have, that is what I will tell you.
Evidence
Governance and strategy work, and what it turned on.
Trustee role
Serving trustee on a risk and audit committee
Oversight written by someone who has to operate it in another organisation, and sign the assurance for it.
About »Case study · charity
A trustee group given a digital risk picture it could act on
Written for the committee cycle, in the language of the annual report rather than the technology press.
Care home charity digital strategy »Case study · legal
A digital strategy that survived contact with the partnership
The trade-offs were made explicit early, which is why the sequence held.
Lawyers digital strategy »What happens next
Book a 30-minute conversationRelated services
Not sure where to start?
Most clients begin with a conversation. No pitch, no hard sell.
Just a straightforward discussion about where you are and whether I can help.
Book a free 30-minute call