You cannot govern AI you cannot see. That’s why the first step is not a policy. It’s an inventory.

Once you’ve found every AI tool in your company, including the shadow ones, sort them into tiers.

High-risk tools that make decisions about people or money, with human review of every output. Moderate risk, customer-facing tools with sampling and disclosure. Low-risk internal productivity tools on approved platforms.

Then build your guardrails: a short, concrete, acceptable use policy that tells employees what they can and cannot paste in.

Vendor diligence that asks who owns the model, where it’s hosted, and whether it trains on your data.

Verification scaled to risk, because in the Avianca case, the court sanctioned the lawyers, not the chatbot.

And an incident plan that covers AI-specific events like a data leak or a deepfake executive call.

Here’s the 90-day plan.

First 30 days: see it. Inventory and brief the board.

Next 30: govern it. Tier and adopt policy.

Final 30: use it. Pilot one compliance AI use case with validation.

Govern first, deploy second.

The Ethics and Compliance Q and A show is produced by One Stone Creative.