Governing AI in the workplace

Artificial intelligence is now part of everyday work. It is embedded in HR platforms, decision-support tools, and recruitment systems, and it arrives directly through employees using generative AI on their own. Many organisations are experimenting, but very few have set clear rules. The gap between adoption and governance is where most day-to-day AI risk lives.

Start by accepting that shadow AI already exists

The honest starting point is that employees are already using AI tools, whether or not anyone approved them. A marketing analyst summarising customer feedback in a free chatbot, a recruiter using an AI screening feature, an engineer pasting code into an assistant: each is a potential data protection and security exposure, and none of it shows up unless you look.

You want the tools people use to be known, and the compliant path to be the easy one.

A workable acceptable-use policy

A good policy is short, specific, and actually communicated. It answers the questions people have:

• Which tools are approved, and for what kinds of work.
• What must never be entered into an AI tool, in plain terms, things like personal data, confidential information, source code, anything covered by an obligation of confidence.
• When a human must review and own an AI-assisted output, especially decisions that affect people.
• How to request a new tool or use case, so adoption goes through governance rather than around it.

The test of a policy is not its length but whether a busy employee can remember and follow it.

Human oversight that is real, not nominal

Where AI supports decisions about people, hiring, performance, access to services, the oversight has to be meaningful. That means a named person who understands the system well enough to question it, the ability to explain why a decision was reached, and a genuine route to override it. A human signing off is not oversight if that human cannot see or challenge the logic.

This is also where AI governance meets employment fairness and data protection. An AI tool that screens candidates is high-risk under the EU AI Act and almost certainly needs a DPIA. Workplace AI is rarely just an AI question.

Make the compliant path the easy path

The organisations that govern workplace AI well do not rely on willpower. They make registering a tool quick, they train people on the few rules that matter, and they give a fast answer when someone asks "can I use this?". When the compliant path is the path of least resistance, shadow AI shrinks on its own.