AI Governance Is Not a Compliance Project: How to Turn It into a Competitive Advantage
7 questions companies should answer before their next AI project
AI has arrived in companies. It writes texts, analyzes documents, supports customer service, prioritizes cases, and is increasingly becoming part of decision-making.
This also changes the task of governance. The question is no longer just «Is our company allowed to use AI?», but rather «What do we need to clarify before an AI application can be put into production?».
This is precisely where AI Governance comes in. Not as an additional control function at the end of a project, but as a framework for data, risks, responsibilities, and ongoing operations. When set up properly, governance can help introduce AI applications more quickly and reliably.
From control function to scaling model
In many companies, governance comes too late. A business unit tests a new tool. IT reviews the integration. Then come data protection, information security, or legal. Only then does it become apparent that data may not be processed as planned, access rights are unclear, or no one is clearly responsible for the use.
That costs time.
A robust governance model therefore starts earlier. It creates a shared process for questions that must be asked for every AI application:
- What purpose does the application serve?
- What data is processed?
- What risks arise?
- What controls are required?
- Who decides on deployment, operation, and discontinuation?
This means that not every AI project has to answer the same question from scratch. Governance becomes infrastructure for AI.
AI Governance in Three Layers
To answer these questions consistently across an organisation, companies need more than a checklist for individual AI applications. Effective AI governance connects three layers:
1. Build Company-Wide Governance
The first step is to establish the foundations: Which AI tools are approved? What rules apply to data? Who is responsible for what? How are new applications submitted for review and approved?
This includes AI policies, defined roles, clear risk criteria and employee training.
2. Assess AI Applications Based on Risk
With these foundations in place, individual AI applications can be assessed. Key factors include the data being processed, the intended purpose, potential impact and the level of autonomy granted to the AI system.
Not every application requires the same level of scrutiny. While clear usage guidelines may be sufficient for simple applications, systems that make consequential decisions or perform autonomous actions require additional safeguards.
3. Operate and Continuously Improve Governance
Governance does not end when an AI application goes live. New models, changes in data flows, additional capabilities or evolving regulations may require a reassessment.
Clear responsibilities are therefore essential for monitoring, incident management and regularly updating governance practices.
This approach also reflects the principles of the international standard ISO/IEC 42001:2023, which specifies requirements for an artificial intelligence management system. It addresses not only individual applications but also policies, responsibilities, risk management and continuous improvement.
Companies can use this framework as guidance without necessarily pursuing formal certification from the outset.
Why the topic is relevant now
For companies with activities in the EU market, the topic is becoming even more important. Since 2 August 2026, the transparency obligations under Article 50 of the EU AI Act have applied. Among other things, they concern certain interactive AI systems and requirements for labeling AI-generated or manipulated content. The European Commission has since published specific guidelines on this.
Certain AI systems must therefore inform users that they are interacting with AI. Machine-readable labels are provided for certain AI-generated or manipulated content; additional disclosure obligations apply to deepfakes.
The requirements for high-risk systems under Annex III, application is generally scheduled to begin on 2 December 2027. For Swiss companies, this does not automatically mean that the entire EU AI Act applies. What matters includes the company's role, the specific AI system, and its use or offering in the EU context.
The consequence is nevertheless clear: AI governance should not begin only when a regulatory review is pending.
Not Every AI Application Requires the Same Level of Governance
A key principle of effective AI governance is risk-based assessment.
An AI tool that drafts internal text has different potential consequences from an AI agent that modifies customer data, initiates payments or interacts autonomously with external systems.
The depth of the assessment should therefore reflect the actual level of risk.
Three practical examples:
- Low risk: Employees use an approved AI tool to draft general internal content. Clear usage guidelines, appropriate data handling and human review may be sufficient.
- Elevated risk: An internal knowledge agent accesses confidential company documents. Additional checks are needed for access permissions, data flows and the reliability of its responses.
- High risk: An AI agent autonomously modifies data in a business-critical system. This requires more thorough assessments, technical safeguards, testing, approvals and ongoing monitoring.
These examples illustrate a possible internal risk-based approach and do not represent legal risk classifications. AI systems classified as high-risk under applicable legislation must be assessed separately.
The goal is not to introduce as many controls as possible, but to establish the right controls for each level of risk.
This also allows governance to accelerate implementation. Low-risk applications can follow a streamlined process, while more extensive reviews focus on applications with potentially greater consequences.
7 questions to ask before the next AI project
1. What data does the system process?
Do not start with the model. Start with the data. Clarify:
- Is personal data processed?
- Does the data contain particularly sensitive information?
- Is confidential customer or company data used?
- Is data processed for training, fine-tuning, or only at runtime?
- How long are inputs, outputs, and logs stored?
- Is data transmitted to external providers or subcontractors?
- Is data transferred to countries outside Switzerland or the EEA?
These questions largely determine which data protection, security, and contractual requirements apply.
Practical rule: For every AI application, it should be possible to understand what data flows where and who can access it.
2. Where are models and data processed?
«The data is in the cloud» is not an adequate answer. Companies should know:
- Where is data processed?
- Where are models, backups, and logs located?
- Which subcontractors are involved?
- Who can access the data?
- How is data protected during transmission and storage?
- Is customer data used to train general-purpose models?
- What happens to the data after the contract ends?
The technical architecture plays just as important a role as the contract with the provider. Hosting, data flows, and subcontractors should be documented before approval and reviewed when material changes occur.
Hosting, data flows, and subcontractors should be documented before approval and reviewed when material changes occur.
3. What decisions may the AI make on its own?
Not every AI application needs the same controls. Its impact is what matters. Does the AI merely make a suggestion? Or can it independently initiate a payment, change access, send customer communications, or influence a decision affecting a person?
One simple distinction helps:
The greater the potential impact, the more clearly the boundaries, controls, and escalation paths must be defined.
4. How are AI Outputs reviewed?
AI can generate convincing but incorrect or incomplete answers. This also applies when a system works with corporate data. Every application therefore needs a defined level of review. For example:
- Internal draft: plausibility check by the person using it
- Customer communications: review by a subject-matter expert responsible for the matter
- Legal or safety-relevant statements: additional approval by the responsible authority
- Recommendation relevant to a decision: documented human decision
In addition to reviewing individual outputs, AI applications should be tested with appropriate test cases before deployment. For production systems, companies should also define how performance and output quality will be monitored over time.
Errors cannot be completely ruled out in AI systems. It is therefore all the more important to clarify how errors are detected, assessed, and corrected, and who is responsible for this.
5. Who is Responsible?
An AI does not assume organizational responsibility. It should therefore be clear for every application:
- Who is responsible from a subject-matter perspective?
- Who approves its use?
- Who is responsible for data protection and information security?
- Who monitors the application?
- Who decides on changes to the model or the data?
- Who can take the application out of operation?
- Who responds in the event of an incident?
Responsibility must not get lost between the business unit, IT, procurement, and the provider. A simple role matrix can help. What matters is not the format, but that responsibilities are actually assigned.
Ideally, the fundamental responsibilities are already defined at the company level. This avoids having to renegotiate ownership and decision-making authority for every new AI application.
6. How is AI Usage Documented?
An AI register initially sounds like additional administration. In practice, it can have exactly the opposite effect. When applications, models, data, responsibilities, and approvals are documented centrally, this information does not have to be gathered from scratch for every project.
A register should, for example, record:
- Purpose and business process
- Responsible person
- Provider and model
- Data processed
- Hosting and processing locations
- Risk classification
- Access rights
- Human control steps
- Approval status
- Material changes
- Known limitations
- Emergency and shutdown behavior
Unauthorized use should also be taken into account.
A policy alone does not prevent shadow use. Employees need clear rules, permitted tools, and a simple way to report new use cases.
Equally important is employee enablement. Employees need to understand which AI tools they are allowed to use, how to handle confidential data and when an additional review is required.
7. What Happens When Something Goes Wrong?
Every production AI application needs an appropriate incident response plan in case something goes wrong.
- How are errors reported?
- Who assesses the incident?
- When is the application paused or shut down?
- Which internal and external parties must be informed?
- How are logs and versions secured?
- How is the cause analyzed?
- When may operations resume?
This is not only about classic IT security incidents. Faulty recommendations, unexpected model changes, or the circumvention of human controls also belong in the incident process.
The Governance Checklist
Before deploying an AI application into production, companies should review at least five key areas:
- Purpose and Risk: Is the intended use clearly defined, and are the potential consequences understood?
- Data and Security: Have data flows, access permissions and security measures been assessed?
- Responsibilities: Are owners, decision-making authority and approval processes clearly defined?
- Quality and Control: Has the application been adequately tested, and are the necessary safeguards in place?
- Operations and Monitoring: Are documentation, change management and incident response processes established?
The depth of this review should depend on the application's risk classification.
Answering these questions does not mean governance is complete. But it provides a solid foundation for making informed decisions about the next AI application.
When Governance Becomes a Competitive Advantage
The competitive advantage does not come from having as many governance rules as possible. It comes from reusable decisions.
Once roles, risk criteria, reviews, and approvals have been defined, new AI applications do not have to start from scratch every time. This has three concrete effects:
Faster decisions
Teams know what information is needed for approval and who needs to make the decision.
Fewer surprises
Risks involving data, hosting, permissions, or dependencies on providers become visible earlier.
Simpler scaling
A standardized process makes it easier to assess new use cases and bring them into operation in a controlled manner.
For example, if a company has already defined which AI tools and data categories are approved, a new department does not need to reassess these questions from scratch. It can build on existing assessments and approvals, focusing instead on the specific risks of its application.
The goal is not to rule out every risk. That is neither realistic nor necessary. The goal is to make risks visible and consciously decide which AI application a company wants to use and under what conditions.
Conclusion
AI Governance is more than a compliance project. It connects strategy, data protection, security, law, and operational responsibility, and creates a common framework for the use of AI.
The seven questions are a good starting point for this:
- Which data does the system process?
- Where are models and data processed?
- Which decisions may the AI make on its own?
- How are results reviewed?
- Who is responsible?
- How is usage documented?
- What happens in the event of an error or an incident?
Anyone who answers these questions before the next AI project creates better conditions for applications that not only work technically, but can also be operated within the company.
Companies that address these questions before starting their next AI project, while establishing the necessary organisational foundations, are better positioned to deploy applications that not only work technically but can also be operated reliably over time.
Where Does Your Company Stand on AI Governance?
Many companies are already using AI but still lack a complete overview of the tools being used, existing policies and clearly defined responsibilities.
An initial governance assessment helps identify the most important gaps and prioritise the next steps. The goal is not to introduce a comprehensive set of rules overnight, but to establish governance that fits the organisation, its AI applications and its actual risks.
Dreamleap supports companies in building and continuously improving practical AI governance, from the initial assessment to policies, responsibilities, approval processes and ongoing advisory support.
How well prepared is your organisation to use AI safely and at scale?
Book a free 15-minute introductory call with our experts to discuss your current situation and identify potential next steps.
👉 Book a conversation with Dreamleap
Sovereign AI systems with Dreamleap.
Contact our experts:
Sources
[1] European Commission: AI Act – Regulatory framework for artificial intelligence
https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
[3] Goodwin: EU AI Act Transparency Obligations Are Now in Force
https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations
[9] EU AI Act Service Desk: Obligations for high-risk, transparency-risk and minimal-risk AI systems
[10] EU AI Act Service Desk: Article 13 – Transparency and provision of information to deployers
https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-13
