You don't want an AI governance framework.
You want to stop being the person at the board table who says "I'll come back to you on that" every time AI comes up. You want a short, true answer when a client asks whether their information goes anywhere near a chatbot. And you'd quite like someone else to be keeping track of all this, someone you can name, who'll put it in writing.
That is exactly the right thing to want from governance. My industry has just been very bad at saying so, and I include us in that.
So what is AI governance, really?
Strip away the frameworks and the diagrams and you are left with five things, done regularly and written down.
Knowing what you use. Every AI tool in the firm, including the ones built into software you bought for something else.
Deciding who can use what. Which tools are approved, for which work, by whom.
Knowing what each tool touches. What information goes in, where it's processed, what the provider is allowed to do with it.
Checking the output. Who reviews what AI produces before it affects a client, and what they're accountable for.
Being able to show it. To a board, a client, an insurer or a regulator, without a week's notice.
That is the whole of it. If someone's definition takes longer than five bullet points, they are probably selling you the long version.
Why it gets explained so badly
This is the bit that irritates me.
Ask most providers to define it and you get an acronym tour. NIST. ISO 42001. Risk tiers. Responsible AI principles with five pillars and a nice graphic. All of it real, some of it useful, and almost none of it what a 40-person advice firm needs on a Tuesday.
ISO/IEC 42001, for instance, is a genuine international standard for managing AI, and for some firms getting ready for it makes good sense. For most professional services firms around the Melbourne CBD, it is the equivalent of preparing for an Olympic medical when what you need is a GP who knows your history.
And that is the better comparison, so I will stay with it. The annual check-up is useful. What actually keeps you well is a doctor who has seen you for ten years, notices the mole that has changed shape, and knows your father's history without being told. Governance is that ongoing attention from someone who knows what normal looks like for you, and spots it when normal moves.
What most firms are doing instead
The National AI Centre's latest SME adoption tracker put small and medium business AI adoption at 44% in February 2026. Among businesses already using AI, the most common safeguard was checking AI outputs before they affect customers.
That is a good habit, and it is also proofreading.
It is the fourth item on the list above, on its own. It tells you nothing about which tools are in use, what information went into them, or what you would say if a client asked. A firm whose only control is "someone reads it before it goes out" has a quality check. Most of the time the gap between that and governance never shows. The one time it shows, it is the only thing anybody asks about.
Beware: The AI you're least aware of is usually the AI built into tools you already pay for. Your practice management system, your CRM and your document platform have all been quietly adding AI features. If governance only covers the chatbots, it's missing the larger half.
What it looks like when it's working
For a firm of 10 to 100 people, governance done properly is a rhythm rather than a department.
A register of approved AI tools, kept current, with a quick vetting process for new requests. A monthly look at what's actually being used on company devices, compared against that register. A watch on regulatory change, so that something like the automated decision-making rules commencing on 10 December 2026 arrives as a briefing rather than a surprise. Entries in your risk register that name AI risks specifically. And a quarterly conversation with the partners where somebody presents all of that on a page.
That's the shape of the governance service we run, and it sits inside our existing compliance and governance work.
The quarterly conversation is usually led by one of our virtual CIOs, because it is a strategy discussion and belongs nowhere near a help desk queue.
For a small firm with one approved tool, governance might be a single page and a twice-yearly look. The good news is that nobody needs a framework for that. If anyone tells you otherwise, ask them to show you the page.
Tip: Ask one person in the firm to list every AI tool they believe is in use. Then ask a second person separately. Compare the two lists. The difference between them is your governance gap, measured in five minutes.
Neither list is ever wrong, which is the uncomfortable part. Both people are describing the firm as they see it, and they are describing different firms.
Who should own it
Someone you can name. That's the part most partners care about, and they're right to.
It doesn't have to be in-house. Plenty of firms our size have made the outsourced versus internal IT decision already, and the same logic applies. What matters is that the accountability is clear, the work is written down, and you'd be comfortable introducing that person or firm to your board.
It also has to be someone who will tell you things you would rather not hear. A governance provider who only ever reports good news has stopped governing and started reporting. That's a theme I keep coming back to when people ask what good service from an IT provider looks like: the willingness to bring you the uncomfortable finding before someone else does.
So here's the question to take into your next partners' meeting. If the board asked tomorrow which AI tools the firm uses and who checked them last month, who would answer, and what would they hand over?
If nobody's sure, ask your IT provider who in their business reads AI regulatory updates and how that reaches you. We're happy to be asked it too.
Where these numbers come from
- AI adoption insights: December 2025 to February 2026, National AI Centre, 7 May 2026
Yener
