Most organisations now use AI somewhere, often without a single decision to adopt it. A supplier adds a feature. A team signs up for a tool. A model is built into a customer process. By the time a board asks about it, AI may already be influencing decisions about customers, staff or money.
That is why governance of AI is moving up the agenda. The questions are familiar ones applied to a new subject: who is accountable, what could go wrong, how would we know, and what would we tell a regulator or a customer?
Where the board comes in
Operational responsibility can be delegated to management. Oversight cannot. The board retains responsibility for understanding how AI-related risks could affect the organisation’s strategy, obligations and stakeholders.
Where the risk sits
AI introduces concerns about the data that systems learn from and use, bias in outputs, the ability to explain a result, reliance on suppliers, and the reputational cost of getting a visible decision wrong. Directors do not need to understand how a model works. They do need to know that someone has asked these questions and can answer them.
A practical response
- Take an inventory. List where AI is used, including inside tools you buy. You cannot govern what you have not found.
- Name an owner for each system. One accountable person, not a committee.
- Approve by risk. A tool that suggests meeting times and one that screens job applicants should not go through the same process.
- Report regularly. A short, standing item on AI risk gives leadership a view before there is a problem.
- Use a framework as a guide. Recognised references include the NIST AI Risk Management Framework and ISO/IEC 42001, the standard for an AI management system. They are voluntary aids to structure your thinking, not legal requirements for every organisation.
Keep the law in view
Rules on AI and on the personal data it processes differ between countries and sectors and are changing. Where AI systems process personal data in Nigeria, the NDPA and GAID apply to that processing. Check what applies to you in the places you operate.
Consider an organisation where different departments have started using publicly available AI tools to draft reports, analyse customer information and support recruitment decisions. However, there is no central inventory of these tools, no clear guidance on what information employees can submit, and no assigned accountability for reviewing AI-generated outputs. When leadership eventually asks how AI is being used across the organisation, there is no reliable way to establish the extent of adoption or the associated risks. The problem is not necessarily the use of AI itself, but the absence of governance around it.
