AI governance in a company – how to set rules for using AI and what the law already requires

The term AI governance simply means the rules and oversight for using AI in a company. It is not a thick document for lawyers, but answers to a few practical questions that each employee currently settles on their own.

Take a hypothetical 150-person trading company. A salesperson pastes a price list with discounts into a personal ChatGPT account to write a quote faster. An accountant asks another tool to summarise a supplier contract. No one has broken any rule, because there were none.

Rules for using AI should answer the five questions listed below. If no one in your company knows the answer to one of them, that is where to start.

The AI Act, the EU regulation on artificial intelligence, has been in force since 2024, and its obligations are being phased in. Some already apply; others were postponed by the 2026 Digital Omnibus package of amendments. The table below shows the dates that most often affect a mid-sized company.

An important caveat: the AI Act does not oblige every company to have an “AI policy” or an “AI systems register”. However, written rules and training are the simplest way to show that the company is building its employees’ AI knowledge as required by Article 4.

In Poland, the application of the AI Act is supervised by the Commission for the Development and Safety of Artificial Intelligence (KRiBSI). Its inspection powers and its ability to impose penalties apply from 28 October 2026. Independently of the AI Act, the GDPR still applies – any processing of personal data in an AI tool must have a legal basis.

When a company does not give employees AI tools, or bans them, people use them anyway – just on personal accounts. This is called shadow AI: using AI without the company’s knowledge or control.

The scale is large. According to a 2024 study by Microsoft and LinkedIn, 78% of people who use AI at work bring their own tools. Company data then ends up in services whose terms no one in the company has checked.

The answer is not a block but a secure alternative. Business versions of the tools have different terms from personal ones. For example, in Microsoft 365 Copilot prompts and responses are not used to train models, and Copilot only sees documents the user already has access to.

That last point has a flip side. If the payroll folder is open to the whole company, Copilot can find it. So permissions in SharePoint and Teams need to be reviewed before the tool is launched.

The rules are based on dividing data into a few classes and assigning permitted tools to each one. Employees do not need to know the law – they just need to know which class the document they want to paste belongs to.

The table below is an example for a mid-sized company. Adapt the class names and examples to your business, but do not create more than four or five, because no one will remember them.

In a company of several dozen or several hundred people, you do not need new positions or a special committee. You need a clear division of tasks among people who already work in the company.

The most common mistake is treating AI as “everyone’s business”. In practice this means no one makes decisions, and the rules go out of date after a few months. Below is a division of responsibilities that works in a mid-sized company.

Introducing the rules in a mid-sized company usually takes a few weeks of work, not a project lasting many months. The order matters: first you check how things are, then you set the rules, and finally you give people tools and training.

After the first three months, review the reports and incidents. That is the best moment to improve the rules based on how people actually work.

The mistakes made with rules for using AI are the same whatever the industry. Most of them come from writing the rules for an auditor rather than for employees.

If you recognise any of the points below in your company, you do not have to start from scratch. Usually it is enough to simplify the document and appoint a person responsible for it.

For most uses, such as writing emails, summarising documents or helping with data analysis, rules, a company tool and training are enough. However, there are situations that call for more.

The first is high-risk systems under the AI Act, e.g. AI that assesses job candidates. From 2 December 2027, a company that uses them must, among other things, ensure human oversight and keep event logs. It is worth planning for this early, because it also applies to tools bought from vendors.

The second is highly sensitive data, e.g. medical data or data covered by professional secrecy. In that case the decision also covers where the AI processes the data: in the provider’s cloud or on the company’s own servers. We describe this choice in a separate comparison.

The third is companies that want to formally confirm their approach, e.g. for large customers. This is what ISO/IEC 42001:2023, the standard for AI management systems, is for. Certification is voluntary and mainly makes sense when customers expect it.