In brief
What is proportionate AI governance?
Proportionate AI governance classifies each AI use by its potential for harm and applies controls matched to that level. A low-risk internal drafting tool needs basic guidance and logging; an AI system influencing credit or clinical decisions needs impact assessment, validation, human oversight, monitoring and senior approval.
When organisations first respond to AI risk, they often create a single review process for everything. Every AI use, from a meeting summariser to a customer eligibility model, goes to the same committee with the same forms. Reviews back up, teams wait, and before long people start using AI tools without asking. Governance intended to reduce risk ends up increasing it.
Start with an inventory
You cannot govern what you cannot see. An AI inventory records every AI system in use or in development, including third-party tools and AI features embedded in existing software. For each entry, capture the purpose, owner, users, data used, degree of autonomy and the decisions it affects. Keep registration simple so that people actually do it.
Classify by potential harm
| Criterion | Lower risk | Higher risk |
|---|---|---|
| Effect on individuals | No direct effect on people's rights or opportunities | Influences access to credit, jobs, services, healthcare or legal outcomes |
| Autonomy | Suggests or drafts for a person to review | Acts or decides without routine human review |
| Data sensitivity | Public or non-personal data | Sensitive personal, financial or health data |
| Reversibility | Easy to correct | Hard or impossible to reverse |
| Scale and exposure | Small internal group | Large numbers of customers or citizens |
Three tiers are usually enough
| Tier | Examples | Typical controls |
|---|---|---|
| Tier 1: Low | Internal drafting assistants on approved tools, code suggestions, summarising non-sensitive documents | Acceptable use policy, approved tools, basic logging, user guidance |
| Tier 2: Moderate | Customer service copilots, document extraction feeding operations, internal forecasting | Named owner, evaluation before release, data protection review, monitoring, human review of exceptions |
| Tier 3: High | Eligibility, credit, hiring, clinical support, autonomous agents with financial authority | Impact assessment, validation and fairness testing, security testing, defined human oversight, senior approval, periodic audit |
Some uses may be prohibited outright by policy or law. List them explicitly so that teams do not need to ask.
Make the fast path genuinely fast
Governance succeeds when the compliant route is also the easy route. Pre-approve tools for Tier 1 uses. Provide templates for Tier 2 evaluations. Give Tier 3 reviews dedicated capacity and clear timelines. Publish decisions so teams can learn from precedent.
Governance does not end at approval
- Monitor performance, drift and incidents in production, with depth matched to tier.
- Reclassify when a system's use, data or autonomy changes.
- Review Tier 3 systems at fixed intervals.
- Provide a route for users and affected people to raise concerns.
- Retire systems formally, including data and access removal.
Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 provide useful structure for these activities, and legal advisers should confirm obligations under data protection and sector rules. The practical design choices, including tiers, templates and approval routes, determine whether governance is followed.
Sources and further reading
About the author: Dr. RohitCo-Founder, Director and Chief Technology Officer, AARHIT Systems. Writes on technology strategy, AI architecture, agents, evaluation and AI governance. More articles by Dr. Rohit