---
title: "AI governance: the policy is the smallest part | Carl-Uwe Würfel"
description: "AI governance for mid-sized companies: the policy fits on one page. What works is access, permissions, cost per call and sign-off built into the workflow."
url: https://carl-wuerfel.de/en/ai-governance
author: Carl-Uwe Würfel
---

1. [Home](https://carl-wuerfel.de/en)
  2. [Knowledge](https://carl-wuerfel.de/en/knowledge)
  3. AI governance

# AI governance for mid-sized companies: if the system doesn't enforce a rule, it's a suggestion.

AI governance works once permissions, access, cost and sign-off are built into the workflow; the policy that describes them fits on one page.

The EU AI Act says what the law requires, and governance decides who inside the company may do what with AI. The usual approach is a long rulebook, often with a ban on personal AI accounts, and day-to-day work barely changes because nothing makes anyone follow it. At SUMAX we set up users, permissions and access keys for everyone first, and every AI call runs through a layer of our own that logs it with its cost, tens of thousands of calls a month.

[Carl-Uwe Würfel](https://carl-wuerfel.de/en/about)Updated November 7, 2026[Deutsche Fassung](https://carl-wuerfel.de/ki-governance)

## On this page

  1. Governance starts with accounts, permissions and keys.
  2. Banning shadow AI just makes it invisible.
  3. Whoever passes on an AI result answers for it.
  4. A log of every call is the best evidence you have.
  5. Risk depends on where the output ends up.
  6. An AI policy fits on one page.
  7. Frequently asked questions

> We started with users, permissions and access keys, so not everyone can get at everything. Tools for single tasks came after that, all on the same foundation.

## Governance starts with accounts, permissions and keys.

**Takeaway** Set up sign-in, permissions and access keys for everyone before you write rules for individual tools.

The EU [AI Act](https://carl-wuerfel.de/en/ai-act) sets out what the law requires of a company. AI governance settles who inside the company may use which AI for what, with which data and at what cost. It starts with a foundation for everyone: each person signs in, each role has its permissions, and the access keys to AI providers sit in one central place instead of with individual employees. At SUMAX we built that first, with security from day one, so not everyone can get at everything. Tools for single tasks came later and run on the same foundation. Settle access late and you end up chasing down scattered accounts and keys. Every rule needs a point in the workflow where the system enforces it.

Every rule needs a point in the workflow where the system enforces it.

_Figure: The path of one AI use through five checkpoints in the workflow. One, sign-in and permissions: may this role use this tool? If not, no access. Two, data: may this data go into this tool? If not, it stays out. Three, cost tracking: the call is assigned to an application and logged with its cost. Four, review: is the result right? If not, it goes back. Five, sign-off: may it leave the company? At the end the checked result goes out. A personal account skips every checkpoint._

## Banning shadow AI just makes it invisible.

**Takeaway** Run a no-blame survey of the AI already in use and offer an approved route for the most common uses before you ban anything.

[Shadow AI](https://carl-wuerfel.de/en/glossary/schatten-ki) means AI tools employees use on personal accounts, with the company unaware of which data goes where. Germany's data protection authorities assume this kind of unsanctioned use is already a reality in many companies, and they recommend company accounts over personal ones. A ban does little about it. People who find a tool useful keep using it, only now nobody sees it. A personal account skips every checkpoint: no permissions, no data rule, no cost tracking, no sign-off. An approved route that's as convenient as the personal account works better. Start with a no-blame survey across teams: which tools, for what, with which data. Whether it works shows in the share of usage that runs through approved tools. At SUMAX most employees use our own AI tools every month.

## Whoever passes on an AI result answers for it.

**Takeaway** Write review and sign-off into role descriptions as separate steps and budget the time for them.

The most important governance rule isn't technical. Without it, people turn into pass-throughs, forwarding what they haven't read. Review and sign-off are two separate steps. The review asks whether the result is right, the sign-off decides whether it may leave the company. If the review fails, the result goes back. At SUMAX, sign-offs govern what leaves the company, and content for healthcare clients is checked against German health advertising law first. We rewrote our role descriptions. Review and sign-off belong in them, with time set aside, because a rule nobody has time for turns into a checkbox. How much a workflow may do without sign-off on each result is a separate call, and it belongs to [AI automation](https://carl-wuerfel.de/en/ai-automation).

## A log of every call is the best evidence you have.

**Takeaway** Route every AI call through one point that assigns it to an application and logs its cost before you spend money on governance software.

Governance needs evidence, and the best evidence comes out of daily operations instead of a last-minute scramble before an audit. At SUMAX every AI call from our own applications runs through a layer between the applications and the AI models and is logged with its cost. That shows which application used which model for what, and what it cost, long before the monthly invoice arrives. If a bad result turns up, a log like this shows which other calls might be affected. Budgets cap spending. The same layer lets us switch models without rebuilding the applications, so governance isn't tied to one vendor. Extra governance software adds little as long as the calls go around it.

## Risk depends on where the output ends up.

**Takeaway** Classify every application by where its output ends up and set the level of review accordingly.

AI risk management at a mid-sized company doesn't need its own department, but it does need an inventory. For each application it records what it's used for, with which data and where the output goes. The level of review follows from that. A summary for your own team carries little risk. A proposal, an article or a report for clients leaves the company and needs sign-off. Once decisions about people are involved, hiring for example, the EU AI Act adds obligations that IT lawyers should assess. Two frameworks help with structure: the NIST AI Risk Management Framework with its four functions Govern, Map, Measure and Manage, and ISO/IEC 42001, the standard for an AI management system. Both are voluntary. Certification mostly pays off when clients ask for formal proof.

## An AI policy fits on one page.

**Takeaway** Put your current policy next to the eight points and start with access and data, because the rest builds on them.

A checklist for leadership, not legal advice. Eight points belong on that page. One, scope: who it covers, including AI built into standard software. Two, access: company data only through approved tools with company accounts. Three, data: which data may go into which tool, with personal and client data only in approved ones. Four, review and sign-off: whoever passes something on has checked it, and a person signs off on what leaves the company. Five, cost: every call is assigned to an application. Six, new tools: how one gets added and who decides. Seven, errors: where to report one and when a tool gets switched off. Eight, training: on real tasks from people's own work. Everything else belongs in the systems and the role descriptions. Privacy and employment law questions go to specialists.

## From practice.

  * [Read the case**The transformation at SUMAX** Roles and permissions, sign-offs and a log of every AI call: how the rules sit inside SUMAX's workflows.](https://carl-wuerfel.de/en/transformation)
  * [Read the note**AI quality assurance: a glance is not a review** Format, source, expert judgment: three separate checks. The sender stays responsible.](https://carl-wuerfel.de/en/notes/quality-control-for-ai-output)
  * [Read the note**AI cost management: know the cost per call or fly blind** How to assign AI costs per call to each application, with a budget and the value next to it.](https://carl-wuerfel.de/en/notes/controlling-ai-api-costs)

## Frequently asked questions

What is AI governance?

AI governance is the set of rules and safeguards a company uses to decide who may use AI for what, with which data, who reviews and signs off on results, and what it costs. It works when those rules live in the workflow: permissions and access in the system, cost logged per call, review before sign-off. A policy describes all that, but operations have to enforce it.

How is AI governance different from AI compliance and the EU AI Act?

The EU AI Act is the law, and AI compliance means following it and other rules such as the GDPR. AI governance is the in-house rulebook that makes that happen: who may use what, who reviews, who signs off and what it costs. A [use case](https://carl-wuerfel.de/en/glossary/use-case) can be legal and still run with no review and no view of cost, and governance closes that gap.

Does a company need AI governance if employees only use ChatGPT?

Yes. According to the European Commission, a company whose employees use ChatGPT for things like ad copy or translation already falls under the AI literacy duty in Article 4 of the EU AI Act. A few rules are enough to start: company accounts instead of personal ones, a clear rule on which data may go in, and a check before anything is passed on.

What should an AI policy include?

Eight points: scope, access, data handling, review and sign-off, cost, adding new tools, handling errors and training. That fits on one page. Length matters less than whether each point has a place in the workflow where it gets enforced, otherwise the policy stays a PDF.

How should a company deal with shadow AI?

Make it visible first, then replace it. A no-blame survey across teams shows which tools are used, for what and with which data. For the most common uses, offer an approved route with company accounts that is as convenient as the personal one. A flat ban just pushes usage to where nobody can see it.

Is ISO/IEC 42001 certification mandatory?

No. ISO/IEC 42001 is a voluntary, certifiable standard for an AI management system, and the NIST AI Risk Management Framework is voluntary guidance from the US. Both help structure your own rules. Certification mostly pays off when clients or customers ask for formal proof.

## Read on

  * [**EU AI Act for mid-sized firms: training and approval first**](https://carl-wuerfel.de/en/ai-act)
  * [**AI automation: only as much leeway as you can check**](https://carl-wuerfel.de/en/ai-automation)
  * [**Chief AI Officer: the role doesn 't belong in IT**](https://carl-wuerfel.de/en/chief-ai-officer)
  * [**Mid-market AI: workflows before tools**](https://carl-wuerfel.de/en/ai-mid-market)
  * [**Shutting down an AI system: keeping it is a decision too**](https://carl-wuerfel.de/en/notes/when-we-switch-off-an-ai-system)

## Sources

  1. [NIST: AI Risk Management Framework (AI RMF 1.0)](https://www.nist.gov/itl/ai-risk-management-framework)
  2. [ISO/IEC 42001:2023, Artificial intelligence management system](https://www.iso.org/standard/42001)
  3. [European Commission: AI literacy questions and answers](https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers)
  4. [German data protection authorities (DSK): guidance on AI and data protection (German, May 2024)](https://www.datenschutzkonferenz-online.de/media/oh/20240506_DSK_Orientierungshilfe_KI_und_Datenschutz.pdf)
  5. [BSI (German Federal Office for Information Security): Generative AI Models, Opportunities and Risks for Industry and Authorities](https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/KI/Generative_AI_Models.html)
  6. [EUR-Lex: Regulation (EU) 2024/1689 (AI Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)