In many companies, generative AI is officially banned - and used unofficially anyway: with private accounts, sometimes with customer data in the prompt. The board wants a secure solution; the business units want it now. A ban doesn’t solve this. A roadmap does.
1. Inventory, not blame
First, find out how AI is actually being used - anonymised and without consequences for individuals. Only then do the real use cases surface, and only then can you assess which data is already involved.
2. Classify the risks
Each use case is classified under the EU AI Act and the internal risk model. Most land in the low-risk classes - which creates speed. The few critical ones get the attention they need.
3. Build technology and governance in parallel
An internal assistant with data classification, logging and tenant separation - and the rules for it at the same time. Building the platform first and the governance afterwards costs months of alignment.
4. Rules on one page
Clear usage guidelines instead of a 40-page PDF. What may go in, what may not, whom to ask. What nobody reads protects nobody.
5. All stakeholders in one room
Data protection, information security and the works council are best served assessing the same solution together rather than one after another. Add training for employees, a network of AI champions in the business units - and a repeatable process for assessing new use cases.
How to build regulation as an auditable workflow is shown in our project Regulation as a workflow.
Note: this article provides orientation and is not legal advice.
