Companies do not need an abstract AI policy without operational ownership. They need clear responsibility, a transparent use-case inventory, risk-based approvals and a documented link to data protection, information security and contracts.
Key takeaways
- Governance begins with an accountable decision process.
- Use cases and data flows should be visible.
- Contract, data protection and security questions belong in one control logic.
Who this affects
From tool adoption to corporate decision
AI adoption often begins in a decentralised way. Governance should create transparency before it creates approvals or prohibitions.
The board need not define every technical detail, but should establish responsibility, risk tolerance and reporting logic.
Five decisions to document
A practical governance framework answers at least the following questions.
- Who approves which category of use?
- What data may be used?
- Which vendor and contract controls apply?
- How are incidents and erroneous outputs escalated?
- How is effectiveness reviewed periodically?
Sources and notes
- Art. 716a OR – Unübertragbare Aufgaben des Verwaltungsrats (inkl. Risikomanagement) — Schweizerische Eidgenossenschaft (Fedlex)
Contact lawyer
