Safe to Scale: How to Govern AI with Confidence

How can your business adopt AI quickly without losing control of its data, decisions or accountability?

AI is becoming part of everyday business operations, often faster than organisations can put safeguards in place. Employees are using ChatGPT and Copilot, existing software is introducing new AI features, and AI agents are beginning to take on increasingly complex tasks.

But who is checking what these tools do? Where is your business information going? And who is responsible when something goes wrong?

In this webinar, Blue Llama is joined by Rory Forrest, Legal and Governance Lead at Sindry Consulting, to explore how businesses can put practical, proportionate AI governance in place without slowing down innovation.

The discussion covers everything from shadow AI and data protection to managing AI agents, assessing new tools and keeping humans accountable.

Watch the webinar

AI governance is about clarity, not red tape

Rory explained that AI governance isn’t about banning tools, creating endless committees or making IT responsible for every AI decision. It’s about deciding what AI can do within your business, what information it can access and who remains accountable for the outcome.

Done proportionately, governance can actually help businesses move faster. Once the boundaries are clear, teams can adopt approved tools without having to revisit the same questions every time. And those boundaries should reflect the size, sector and risks of the organisation, rather than applying the same heavy-handed approach to everyone.

The risks hiding in plain sight

One of Rory’s biggest concerns was that AI is entering businesses through channels they may not be monitoring. Existing suppliers are adding AI features to CRMs, document management platforms and other everyday software, sometimes changing how information is processed without much warning.

Then there’s shadow AI: employees using personal ChatGPT or other AI accounts to get work done, potentially uploading confidential client information or business data without approval.

Rory grouped AI incidents into three categories: confidentiality, where information goes somewhere it shouldn’t; quality, where inaccurate or invented outputs are relied upon; and action, where AI does something without appropriate authority. His point was that these risks need different safeguards, and businesses need to understand which ones apply to each use case.

Start with the task, not the policy

A written AI policy might seem like the obvious first step, but Rory argued that businesses should first understand how AI is already being used.

When assessing a new tool, start with a few practical questions. What task will it perform? What data will it access? Where will that information be processed? What happens if it gets something wrong? And will it simply draft something, make a recommendation or take action independently?

From there, assign an owner, review the supplier’s terms, decide where human oversight is required and test the tool before rolling it out. Rory recommended starting with dummy data and challenging the system with difficult scenarios to understand its limitations.

For lower-risk applications, this can be a relatively straightforward exercise. More consequential uses, particularly those involving personal data or automated decisions, warrant closer scrutiny.

AI agents still need someone in charge

The audience Q&A brought the discussion into the practical world of AI agents.

Phil shared how Blue Llama approaches an AI-powered email triage system. The AI can read incoming enquiries, categorise them, consult a knowledge base and prepare draft responses. But a human reviews the proposed response before it is sent, with an audit trail showing what the AI did and where its information came from.

Rory added another consideration: who is allowed to create these agents in the first place? As tools like Microsoft Copilot make agent creation increasingly accessible, businesses need visibility over what’s being built, what data agents can access and who maintains them.

Otherwise, organisations risk ending up with critical processes that nobody fully understands, particularly when the employee who created them leaves.

What to do in your first month

Rory’s suggested starting point was refreshingly manageable. Give a senior person responsibility for AI governance, establish some immediate boundaries around tool usage and confidential data, and find out which AI tools employees are already using.

Then select one well-defined workflow, introduce appropriate approvals and testing, and use it to demonstrate what responsible AI adoption looks like in practice.

For boards considering AI, Rory suggested three questions:

• What exactly are we authorising?
• What evidence shows the system will work safely and effectively?
• And who is responsible for monitoring it after launch?

The central takeaway was that governance isn’t something to bolt on once AI adoption is well underway. It’s the foundation that allows businesses to expand their use of AI with greater confidence.

If you’re unsure where AI could deliver the most value in your organisation, Blue Llama’s AI Opportunities Assessment helps identify suitable processes, prioritise opportunities and build a practical roadmap for implementation. Get in touch with Blue Llama to find out more.