Most organisations are already using AI. The problem is that nobody knows exactly where. It's in the CRM, the transcription tool, the marketing team's browser tabs and the vendor contract signed last spring.
Governance starts with an honest inventory. What tools, which data, who approved them — if anyone did. Only then can you assess what the real risks are: privacy, accuracy, bias, dependency, reputation.
The instinct is to write a long policy. Resist it. A policy that people don't read is a liability disguised as a control. Better: a short set of rules, clear human oversight for high-stakes outputs, and a review rhythm that keeps pace with how fast the tools change.
What to do next: run a two-week inventory before you write a single policy line. You can't govern what you haven't found.