13 questions to test your AI governance, right now

TL;DR

• AI doesn’t spread through your organization the way other enterprise software does, it skips most of the usual procurement process. 

• Most organizations have a real gap between what their AI policy says and what’s actually happening on people’s laptops. 

• Four questions define real AI governance: visibility, control, value, and risk. 

• A 13-question checklist below shows you exactly how much of your own AI usage you can currently account for. 

• Knowing the gap is step one. Closing it takes an actual plan, more on that at the end. 

AI doesn’t get adopted the way other software does

Most enterprise software arrives through a process: a vendor pitch, procurement, a rollout plan, training. AI mostly skips all of that. 

Your employees can open a browser and start using a tool directly. Install a local assistant. Flip on an AI feature that’s already embedded in something they use every day. Try a brand-new product before IT even knows it exists. 

That’s how you end up with a gap between what your AI strategy says and what’s happening on people’s laptops. Most of the time, it just means someone found a real problem and solved it faster than your process could. 

The four questions that matter

Real AI governance comes down to four questions, and most organizations can only answer one or two of them with any confidence: 

1. Visibility: which AI tools are your employees actually using? 

2. Control: which of those are approved, tolerated, restricted, or a total unknown? 

3. Value: which tools are earning sustained use, not just a one-time try? 

4. Risk: which tools could expose sensitive data or create compliance problems? 

Most governance conversations start and stop at question two. That’s a mistake. You can’t control what you can’t see, and you can’t tell if something’s worth the risk without knowing whether it’s actually delivering value. 

The checklist: how much can you actually answer?

Here’s a real test. Go through these 13 questions and count how many you can answer right now, honestly, without guessing. 

• Which AI tools are used in our organization? 

• Which are approved, unapproved, restricted, or unknown? 

• Which tools are growing fastest? 

• Which have the highest engagement? 

• Which paid tools are underused? 

• Which shadow AI tools actually matter? 

• Which departments are adopting AI fastest? 

• Which tools create the most risk? 

• Which vendors are becoming strategically important? 

• Are people moving from one AI assistant to another? 

• Are desktop AI tools becoming more important than web AI tools? 

• Are local or private AI instances starting to emerge? 

• Are your policies changing behavior? 

If you got through most of these without hesitating, you’re ahead of most organizations we talk to. 

If you got stuck by question four or five, here’s the good news: we can help. 

What it takes to fix this

Knowing the gap exists is useful. Closing it takes a real plan. 

We’re working on one: a five-phase approach that takes you from “we have no idea what’s happening” to governed AI adoption. 

1. Discover: figure out what your current AI footprint looks like 

2. Classify: sort every tool into a clear governance category 

3. Optimize: get your AI spend matching real usage 

4. Govern: bring unmanaged risk under control 

5. Enable: turn AI adoption into actual business value 

We’ll be sharing the full breakdown soon, the specific KPIs and dashboards to build, and a model for who should actually own AI governance across IT, SAM, procurement, security, and finance.  

Stay tuned!