AI Governance
Your staff are already using AI tools. Governance decides whether they do it under your rules or nobody rules.
What is AI governance?
AI governance is the set of written rules stating which AI tools an organisation permits, what information may be put into them, which decisions require a human sign-off, and how a new tool gets approved.
The realistic risk in most Kenyan businesses is not a rogue algorithm. It is a member of staff pasting a customer list, a draft contract or bank details into a free chatbot because it saved them twenty minutes.
That happens in organisations that have banned AI entirely, and it happens more in those organisations, because a blanket ban simply moves the behaviour out of sight.
Useful governance is specific and short. Which tools are approved. What data may go into each. What a person must still decide. And crucially, how somebody requests a tool that is not yet on the list.
Why we write rules meant to be followed
Duara writes AI policies for Kenyan organisations from Nairobi, usually for businesses that have discovered staff were already using these tools without telling anyone.
We write rules meant to be followed rather than filed. If a policy runs longer than a couple of pages, nobody reads it, and an unread policy offers no protection whatsoever when something goes wrong.
Who this is for
- Staff already use AI tools informally
- You handle customer or patient information
- A client or regulator has asked how you control AI use
- An existing policy is ignored in practice
Industries we serve
- Banking and microfinance
- Insurance
- Healthcare providers
- Law firms
- Accounting practices
- Public sector bodies
Problems this solves
Governance work usually begins after somebody notices one of the following, often by accident.
- Confidential data pasted into free tools. Customer lists, contracts and financial details go into public chatbots because it is faster than doing the work manually.
- A blanket ban nobody obeys. AI is prohibited, so usage continues invisibly and the organisation has less control than before the ban.
- No route to approve anything new. Staff who want a legitimate tool have nowhere to ask, so they either give up or proceed quietly.
- Nobody knows what is in use. The organisation cannot answer a client or regulator asking which AI systems touch their data.
What we deliver
A short written policy naming approved tools and permitted data, a request route for new ones, defined human sign-off points, and a register of what is actually in use.
A written policy short enough that staff will read it
Named approved tools and the data permitted in each
A simple route for requesting a new tool
The decisions that must always be made by a person
A register of AI systems in use and who owns each
Review dates, because the tool landscape changes quarterly
Features
- Two pages, not forty. Length is the enemy of compliance. We write to the shortest document that actually covers the risk.
- Named tools rather than categories. Staff cannot apply a rule about "generative systems". They can apply a rule that names the product.
- A working approval route. Requests get answered within a stated time, because a route nobody responds to is the same as a ban.
- Data classes defined in plain words. What counts as confidential is described using your own examples, not abstract categories.
- A live register. One list of what is in use, who owns it and what data it touches, kept current rather than written once.
Benefits
- Usage comes back into the open. Staff stop hiding tools once there is a realistic way to get one approved.
- You can answer the client question. When a customer or regulator asks which AI touches their data, you have a register rather than a guess.
- Fewer accidental disclosures. Clear, memorable rules about what must never be pasted prevent the most common incident.
- Decisions stay accountable. Defined sign-off points mean no consequential decision is made by a system without a named person behind it.
Technologies we use
- Tool register. A maintained list of approved and requested systems, their owners and the data each may handle.
- Data classification. Simple categories described with your own examples so staff can apply them without training.
- Approval workflow. A request form and a routing rule so new tool requests reach a decision within a stated period.
- Usage visibility. Where your network or identity systems allow it, reporting on which AI services are actually being reached.
- Review scheduling. Calendar-driven reviews, because a policy written against last year tools protects nothing.
Governance is mostly writing and agreement. Where tooling helps, it is for visibility rather than enforcement.
How the process works, step by step
Policy work takes two to three weeks, most of which is finding out what staff are already using.
-
Step 1
Free exposure call
We establish what data you hold, what would hurt if it leaked, and whether anyone has asked you about AI use.
-
Step 2
Quiet usage discovery
We find out what staff are genuinely using, without turning it into a disciplinary exercise.
-
Step 3
Drafting the rules
We write the policy around the tools people actually want, so the rules match reality.
-
Step 4
Approval route agreed
We set who decides on new tools and how quickly, then test it against a real request.
-
Step 5
Rollout and briefing
A short briefing for staff, because a policy circulated by email alone changes nothing.
Quality assurance and how we work
Our commitments on governance work specifically.
- Discovery is not a disciplinary process. We find out what is in use without naming individuals, because otherwise nobody tells the truth.
- We will refuse to write a ban-everything policy. They do not work, they push usage underground, and we will say so rather than write one.
- Rules are tested before release. Every rule is checked against a real scenario from your business to see whether it can actually be followed.
- The register is handed over live. You receive a maintainable list, not a snapshot that is out of date within a month.
- We give the review date. The policy states when it must next be looked at, because these tools change faster than annual review cycles.
Frequently asked questions about AI governance
What is AI governance?
The written rules stating which AI tools your organisation permits, what data may go into them, which decisions need human sign-off, and how new tools get approved.
Is this only relevant to large companies?
No. A twenty person business handling customer data carries the same exposure and usually has less control over what staff install.
Will rules slow our teams down?
Only badly written ones. Rules with no approval route slow people down and push usage out of sight, which is worse than either.
Should we simply ban AI tools?
We advise against it and will not write that policy. Bans move usage into the shadows, where you have no visibility at all.
How long should the policy be?
Two pages. Beyond that it stops being read, and an unread policy provides no protection when something goes wrong.
How do you find out what staff already use?
Through anonymous discovery rather than an audit. If it feels like a disciplinary process, nobody tells you the truth.
What is shadow AI?
AI tools staff use without the organisation knowing, almost always because there was no realistic way to ask permission.
What data should never go into a public tool?
Anything identifying a customer, anything contractual, and anything financial. We write the list using your own examples.
Who should own the policy?
A named person, usually in operations or compliance. Policies owned by a committee do not get updated.
How often should it be reviewed?
Quarterly. These tools change faster than an annual review cycle can track.
Does this satisfy our regulator?
It gives you a defensible position and a register. Whether that satisfies a specific regulator depends on your sector, and we say so plainly.
What is a tool register?
A maintained list of the AI systems in use, who owns each and what data each is permitted to touch.
Can staff request new tools?
Yes, and the route matters more than the rules. A request nobody answers is functionally identical to a ban.
How quickly should a request be answered?
We recommend five working days. Longer and people stop asking.
Do you cover tools embedded in software we already buy?
Yes. Features quietly added to existing products are the most commonly overlooked category.
What about staff using tools on personal devices?
The policy covers the data rather than the device, because that is the part you can actually enforce.
Do we need legal review?
For regulated sectors, yes. We write the operational rules and work alongside your lawyer where an opinion is needed.
Will you brief our staff?
Yes. A policy circulated by email alone changes nothing. A short briefing is part of the work.
What if we already have a policy?
We review it. The usual finding is that it is too long, too abstract, and has no approval route.
What does governance work cost?
It depends on headcount and sector. We quote a fixed figure after the free exposure call.
Glossary of terms
Governance terms, defined in the way we use them.
- AI governance
- The written rules stating which AI tools are permitted, with what data, and who approves new ones.
- Shadow AI
- AI tools staff use without the organisation knowing, usually because no approval route exists.
- Data classification
- Sorting information into categories such as public, internal and confidential so rules can refer to them.
- Human in the loop
- A requirement that a person reviews or approves a decision before it takes effect.
- Tool register
- The maintained list of AI systems in use, their owners and the data each is allowed to touch.
- Acceptable use
- The statement of what staff may and may not do with a given tool.
Related services in AI Consulting
Talk to us about AI governance
If you suspect staff are already using these tools and would rather know than not know, that is the right moment to call.
Start your project