Who decides what, and how. Six components arranged in four layers so the framework scales with risk, not with bureaucracy.
What: A central AI office sets the guardrails: approved tools, data standards, risk policy, governance cadence. Business units operate freely inside those boundaries.
Why: Pure centralization slows everything down. Pure federation creates risk. Hybrid moves fast where it can and applies rigor where it must.
What: Every use case classified Low, Medium, or High before pipeline entry. Low (internal writing assistants): Champion sign-off, live in days. Medium (automated customer comms): adds legal and privacy review. High (credit, HR, patient data): full DPO and Exec Sponsor sign-off.
Why: The framework scales to the risk, not to the bureaucracy.
What: All AI tools, whether brought in centrally or requested by a business unit, are evaluated against security, privacy, data handling, and procurement standards before deployment. No shadow AI.
Why: Ungoverned tool proliferation is how breaches, compliance violations, and conflicting AI behaviors enter the organization quietly.
What: Documented rules on what data can enter AI systems: what can be used for training, what can be passed to external APIs, what requires anonymization, what is off-limits. DPO review built into the Medium and High tier pipeline.
Why: Most AI governance failures are data failures. Defining the rules before use cases are built prevents costly retrofitting.
What: A defined, binding mechanism for resolving conflicts: a BU wanting a tool the center hasn't approved, two BUs wanting conflicting things, or a use case outside existing classifications. Escalation goes to the Executive Sponsor for a binding decision within 5 business days.
Why: Without an escalation path, governance stalls at the first real conflict. Speed of resolution determines program credibility.
What: AI outputs reviewed against quality and risk thresholds before operationalizing. Threshold scales with tier: Low can be Champion-reviewed; High requires formal pre-production review.
Why: Deploying an AI tool isn't the same as deploying a trustworthy AI tool. Validation closes the gap between "it works" and "we can rely on it."