Risk tolerance is not one setting for the whole company. It should vary by use case, informed by how sensitive the underlying data is, how vulnerable the system and its users are, how much damage user error could do, and which regulations apply.

Risk appetite must reside with the C-suite, guided by the Board. This should be set before the use case portfolio is finalized, rather than discovered halfway through a build. It is also essential to revisit as the market moves. A posture set once and filed away will be wrong within a year, because both the technology and regulations are still moving.

Set ownership, decision rights, escalation paths, and meeting cadence at the start of an AI investment, not after something goes wrong. Most governance failures are not disagreements about the right answer. They are nobody being clear on who should decide.

In practice, this runs in three layers:

• A strategy layer sets enterprise priorities and risk posture.
• The central team described in the Organization chapter sits here as the control layer [link to Organization chapter pending]. It owns tooling, AI spend oversight, and keeping shadow AI in check (AI tools your people are already using that never went through approval and are unlikely to have the right safeguards).
• Delivery teams in the business own the use case scope and the KPIs for the outcomes they are accountable for. 

Strategy sets the principles that determine what is supported and what is cut. Governance is the mechanism to exercise those principles. Give the CFO a standing way to reallocate across the big bets as results come in, with a formal gate from pilot to production to make it concrete. This means weak projects stop lingering on life support and promising ones get more resources while they still have momentum. Operate as an active investor, not an accountant.

Govern AI spend with the same discipline as any other capital line. That means cost visibility by business unit and by use case, spending caps, and usage alerts configured before a system goes live, with one named person accountable for the total. Without that, AI spend will grow faster than cloud spend ever did, as it is considerably harder to govern.

Start with an inventory of the AI in use across your business, approved and unapproved. Crucially, nothing ungoverned should be writing to your key records, whether that is pricing, orders, customer data, or your catalog. Design and implement controls that align with your business objectives and risk tolerance, and make sure they run day-to-day rather than existing solely as a policy document.

Set explicit boundaries for what agents can do on their own, make every consequential output traceable to a named person, and outline accountability clearly. Where an agent's speed or complexity outruns what a person can realistically review in real time, add independent machine oversight so a human still governs the outcome, assisted by tools. Treating a human in the loop as sufficient on its own stops working exactly when the stakes are highest.

Cybersecurity is embedded throughout all of this, and it runs in both directions. AI is one of the better tools for defending against an attack landscape that AI is itself accelerating. But deploying AI can also widen your attack surface, introducing vulnerabilities like attacks that trick AI into ignoring its instructions, or into revealing data it shouldn't. AI also hands attackers the same speed advantage it gives your business.

Cybersecurity maturity is what makes scaling safe and sustainable. Extend your controls to third parties, too, remembering that a vendor contract does not transfer your accountability when their model makes a consequential decision.

It starts with leaders fluent enough to make confident governance calls. They don’t need technical depth, but they require sufficient understanding of these systems to avoid deferring every judgment to whoever built the model.

Below that, build a role-based enablement plan covering what each function must know to protect value while moving quickly.

Track adherence and lapses, but treat emerging gaps as something to fix rather than someone to blame. Document the reasoning behind every executive override, too, since a pattern of overrides in the same place usually means the guardrail needs rethinking.

The private equity owner of a $2 billion-plus manufacturer decided they needed to modernize their business using AI. The CEO, skeptical of the value of AI, set a condition: every initiative had to connect in a straight line to EBITDA.

The company was built through acquisition with three autonomous divisions whose presidents owned their own P&Ls. There were countless AI-related ideas, but no mechanism to choose between them, fund them, or prove them.

Leadership fluency mattered as much as the models. The CEO had equated AI with generative tools and was wary when the best answer to certain projects turned out to be machine learning, so we ran small, informal sessions walking senior leaders through how a model is trained and tested on their own order history.

From there, the manufacturer needed a system that would ensure AI investments were aligned with their business strategy. We created a council to set priorities, funding, and risk posture. A center of excellence owned standards and the first gate: data readiness. The business’s divisions owned the scope, baselines, and validation of results. A second gate, run by the council, made the go or no-go call to production based on business case and risk.

That structure turned 115 ideas from across the divisions into a feasible first wave, including two high-priority models: demand forecasting for its German supply operation and predicting customer lifetime value. The demand forecasting model found that large over- and under-forecasts had been canceling each other out, making the headline error rate look acceptable while tying up cash in excess stock and adding expeditement costs. Fixing it was worth around $30 million in working capital.

Crucially, the division presidents signed off on the projected EBITDA impact of each initiative as well as the value of the insights the two models generated. Their endorsement was a clear signal to the CEO that these AI initiatives had real value in the parts of the business they would actually affect, verified by the people accountable for those numbers. The use cases that cleared the gates were sized at $22 to $37 million in EBITDA improvement.

The company now had a governance framework in place that allowed the best AI initiatives to quickly and safely move from prioritization to funding to value generation. The CEO could now respond to the PE firm’s AI request with a sequenced portfolio, two high-priority models proven and ready to deploy, a value figure against each remaining initiative, and a process that showed how every one of them earned its place. By the end, the once-skeptical CEO was pushing the proven use cases into execution and queuing up the next set.