AI Governance Is Not an Inventory Problem. It is a Decision-Rights Problem.

Knowing which models exist, where they are deployed, what data they use and what risks they present is important. Inventories provide visibility, support audits and create a record of activity. They are a necessary part of any governance programme.

They are not, however, governance.

Previous discussions have explored why AI governance is fundamentally a decision-rights challenge rather than an inventory challenge. The practical question is what comes next. Once an organisation has identified the AI systems it uses and assessed their risks, how should decision-making authority actually be structured?

1. Who approves deployment?
2. Who can stop deployment?
3. Who resolves disagreement when stakeholders reach different conclusions?

These questions become increasingly important as AI use cases become more complex and carry greater operational, regulatory or reputational risk.

The answer is not to create a single governance model that applies equally to every AI deployment. Effective governance recognises that different levels of risk require different levels of scrutiny. Decision rights should become more restrictive as risk increases. Approval authority should become more senior. Veto powers should become stronger. Escalation pathways should become clearer.

In practice, risk tiers provide the structure that makes this possible.

Why Risk Tiers Matter More Than Organisational Charts

Many organisations begin by assigning governance responsibilities according to existing reporting lines.

The security team owns security decisions.

The privacy team owns privacy decisions.

Legal owns legal review.

Product teams own delivery.

At first glance, this appears sensible. The challenge emerges when an AI deployment crosses multiple domains simultaneously.

A customer-facing AI assistant may raise privacy concerns, security concerns, legal concerns and operational concerns at the same time. Each stakeholder may have a legitimate perspective. Each may identify different risks. Yet governance frequently breaks down when nobody has defined how conflicting views should be resolved.

This is why governance structures should be driven primarily by risk rather than organisational hierarchy.

A low-risk internal productivity tool should not require the same approvals as a high-risk system that influences customer outcomes. Equally, a high-impact deployment should not rely on lightweight decision-making simply because it originated within a particular department.

Risk creates the need for governance. Risk should therefore shape how governance authority is allocated.

The Three Rights Every Governance Model Needs

Regardless of industry, geography or organisational structure, every AI governance model requires three distinct decision rights.

The first is approval.

Approval rights determine who has authority to authorise deployment. Without clear approval authority, organisations struggle to establish accountability for decisions that have already been made.

The second is veto.

Veto rights determine who can stop a deployment from proceeding. This right exists to ensure that significant concerns cannot simply be overridden by enthusiasm, deadlines or commercial pressure.

The third is override.

Override rights determine who resolves disagreement when multiple stakeholders cannot reach consensus. Governance structures frequently fail not because stakeholders disagree, but because nobody knows who has authority to make the final decision.

All three rights are necessary.

Approval without veto creates weak challenge.

Veto without override creates paralysis.

Override without clear approval authority creates confusion.

Effective governance requires all three working together.

The question is not whether these rights exist. In practice, they always exist somewhere. The real question is whether they have been deliberately designed or have simply emerged through organisational habit.

Low-Risk AI Use Cases

Low risk use cases typically involve limited organisational impact and minimal potential harm.

Examples might include internal productivity tools, document summarisation, meeting transcription, knowledge management systems or administrative workflow automation.

These systems still require oversight, but governance should remain proportionate.

Approval authority can often be delegated to operational leaders who understand the business context and intended use.

Privacy, security and legal functions may establish baseline requirements that must be satisfied before deployment, but they are unlikely to require direct involvement in every decision.

Veto rights generally remain available where fundamental requirements have not been met. For example, a security team may prevent deployment if basic controls are absent, or a privacy team may intervene if personal data is being processed inappropriately.

Override mechanisms at this level are usually lightweight. Disagreements can often be resolved within existing management structures without escalation to senior leadership.

The objective is not to create unnecessary friction. Governance should provide control without slowing low-risk innovation.

Medium-Risk AI Use Cases

As risk increases, governance structures must become more robust.

Medium-risk deployments often include customer-facing systems, decision-support tools, employee management applications or operational systems that influence important business outcomes.

These use cases create broader exposure.

Errors may affect customers, employees or partners. Decisions may influence commercial outcomes. Regulatory scrutiny may increase. Reputational consequences become more significant.

At this level, approval authority should become more structured and more cross-functional.

A single business owner may no longer be sufficient. Governance decisions may require input from privacy, security, legal and operational stakeholders before approval is granted.

Veto rights become particularly important.

The purpose of governance is not to ensure that every stakeholder agrees. It is to ensure that significant concerns receive appropriate consideration before deployment occurs.

This is where organisations often discover weaknesses in their governance model.

A product team may believe the system is ready for launch. Security may disagree. Privacy may identify unresolved issues. Legal may raise questions about accountability or transparency.

Without clearly defined veto rights, disagreements frequently become political rather than procedural.

The governance process should define who may challenge a deployment and under what circumstances that challenge can prevent progression.

Equally important is a predefined mechanism for resolving disputes. Governance should not rely on whoever has the strongest personality or highest level of organisational influence.

High-Risk AI Use Cases

High-risk deployments require the most mature governance structures.

These systems may influence significant customer decisions, affect individual rights, operate within regulated environments or create substantial legal, financial or reputational exposure.

At this level, governance becomes a senior leadership responsibility.

Approval authority should typically sit with executives or governance bodies that possess a broad understanding of organisational risk appetite and accountability obligations.

Review processes should be formalised.

Decision records should be documented.

Escalation pathways should be clearly defined before disagreements arise.

Veto authority should also become stronger.

Functions such as privacy, legal, compliance and security may require the ability to halt deployment where unresolved risks exceed agreed thresholds.

Importantly, a veto should not be viewed as an obstacle to innovation. Its purpose is to ensure that serious concerns receive appropriate attention before irreversible decisions are made.

High-risk deployments also create the greatest need for effective override mechanisms.

Consider a situation where a security leader believes a system is ready for deployment, while a privacy leader believes additional safeguards are necessary. Both perspectives may be reasonable. Both may be supported by evidence.

The organisation still needs a decision.

Governance succeeds when the escalation route has already been defined.

Governance fails when stakeholders discover the escalation route during the disagreement itself.

Designing Effective Escalation Pathways

Many governance programmes focus heavily on controls, documentation and review processes. Far fewer invest comparable effort in designing escalation pathways.

Yet escalation is often where governance either proves its value or exposes its weaknesses.

A well-designed governance framework answers three questions before conflict occurs.

Who can challenge a decision?

Who must be consulted?

Who makes the final determination if consensus cannot be reached?

The answers should not change depending on personalities, organisational politics or commercial pressure.

They should be embedded within the governance model itself.

This becomes particularly important as AI adoption expands across multiple business functions. The volume of decisions increases. The variety of use cases grows. Informal decision-making becomes increasingly difficult to sustain.

Organisations that establish clear escalation pathways early are typically better positioned to scale governance alongside innovation.

A Simple Governance Test

For organisations evaluating their current governance maturity, a useful test is surprisingly simple.

For each AI risk tier, ask three questions.

Who approves deployment?

Who can veto deployment?

Who resolves disagreement?

If every answer is clear, documented and understood by relevant stakeholders, governance is likely operating as intended.

If any answer remains ambiguous, governance work remains unfinished.

Inventories may be complete. Risk assessments may be documented. Policies may exist.

But governance is ultimately revealed by how decisions are made when risk, uncertainty and disagreement are present.

That is where accountability becomes visible.

That is where authority matters.

And that is where governance either succeeds or fails.

The DPG helps organisations design practical AI governance frameworks that move beyond inventories and documentation. By establishing clear approval, veto and escalation structures aligned to risk, organisations can create governance models that support innovation while maintaining accountability, oversight and decision confidence.

---

Sources:

OECD AI Principles
Why used: Accountability, human oversight and governance responsibilities.
Source: https://oecd.ai/en/ai-principles

NIST AI Risk Management Framework (AI RMF 1.0)
Why used: Governance functions, risk-based decision making and accountability.
Source: https://www.nist.gov/itl/ai-risk-management-framework

ISO/IEC 42001 Artificial Intelligence Management Systems
Why used: AI governance structures, decision ownership and escalation mechanisms.
Source: https://www.iso.org/standard/81230.html

ICO Guidance on AI and Data Protection
Why used: Accountability and oversight expectations for AI systems processing personal data.
Source: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/

EU AI Act
Why used: Risk-tier governance and proportional oversight requirements.
Source: https://artificialintelligenceact.eu/

IAPP AI Governance Resources
Why used: Practical governance operating models and decision-making structures.
Source: https://iapp.org/resources/topics/ai-governance/

Deloitte State of Generative AI in the Enterprise
Why used: Executive oversight and governance maturity insights.
Source: https://www.deloitte.com/uk/en/issues/generative-ai/state-of-generative-ai-in-enterprise.html

McKinsey State of AI
Why used: Governance adoption and organisational accountability trends.
Source: https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai