Governance is a product decision, not a paperwork exercise

Every board I sit on wants an AI policy. Almost none of them need one yet.

A policy is the artefact you produce once you have made your decisions. It is not the mechanism for making them. When a board commissions a policy before it has decided its risk appetite, what comes back is a document written by someone who was not in the room when the risk was taken.

The three questions that actually matter are unglamorous. Who is allowed to put a model in front of a customer? What has to be true before they do? And when it goes wrong at 2am, whose name is on it?

Answer those and the policy writes itself in an afternoon. Skip them and you have a fifteen-page document that nobody reads and no engineer has ever been slowed down by.

The failure mode I see most often is a governance function that arrives eighteen months after the first model went live. By then there are forty systems, no inventory, and a compliance team trying to reconstruct decisions from Slack threads. Retrofitting governance costs roughly ten times what building it in costs, and it buys you a worse product.

Treat it as a product decision. Decide what your system is not allowed to do, build the guardrail that makes that structurally true, and write it down afterwards.