Ã… skape fremragende programvare
La oss bygge noe ekstraordinært sammen.
Stol på Lasting Dynamics for enestående programvarekvalitet.
Michele Cimmino
okt 23, 2026 • 9 min read
The spring of 2023 is a good marker for when AI governance became a board topic. In April, Samsung engineers pasted internal source code into ChatGPT. At the start of May, Bloomberg reported that the company had told staff in one of its biggest divisions to stop using generative AI tools on company devices and networks. Samsung called the restriction temporary and said it was preparing AI tools of its own.
The second half of that sequence is the part worth remembering. Samsung did not conclude that AI was too risky to use; it decided where its people could not use AI for now, and started building the tools that would let it say yes.
Most companies have not written their conditions down yet. Among the 600 breached organizations in IBM's Cost of a Data Breach Report 2025, 63% had no policy for governing AI or were still developing one. One in five reported a breach due to shadow AI, meaning AI tools that staff use without approval, and organizations with high levels of it paid $670,000 more per breach, on average, than those with little or none.
So what is AI governance for a company of 200 or 800 people? It comes down to who decides how AI is used here, on what data, under whose responsibility, and how we show it. Every company that uses AI already has an answer to those questions, but in most companies it is unwritten, so each employee decides alone, and the company learns what it decided only when something goes wrong.
The real choice is between rules someone has written down and rules everyone makes up. For a mid-sized company, good governance is not a committee or a forty-page AI governance framework but five decisions on one page: which tools are allowed, which data may go into them, who owns each use, where a person checks the output, and how you prove it. Once they are written down, a new use can be approved in days rather than debated for weeks.
A disclosure before we go on: Lasting Dynamics builds AI software for clients and uses AI in its own delivery work, so these rules apply to us on both sides, and where a light approach is enough, we will say so.
Shadow AI is the AI your company does not know about, such as a free chatbot account used to summarize a report. It grows wherever people find AI useful and have no approved way to use it, and in the same IBM study, only 37% of organizations had policies to manage AI or detect shadow AI.
That is why an approved list does more against shadow AI than a ban. A ban rarely stops people from using a tool that saves them an hour a day; more often it moves the habit to personal phones, where the company sees even less. An approved list gives people a legitimate route and is the core of any AI use policy, or AI acceptable use policy, provided it names actual tools rather than principles.
Start with the business or enterprise versions of the tools your people already use, because that is where the settings that matter tend to live: training on your company's data switched off, central control over who has access, and an EU data region where the vendor offers one. Check those settings yourself for each tool, because vendors change them more often than they change product names.
Keep the list short, review it every quarter, and name one person who can approve a new tool within a few working days, because a request that waits a month tends to end up on a personal account. That quick answer is where AI governance starts paying for itself. Some workloads also raise a deeper question about where your data goes and whose law can reach it, and we cover that separately.
La oss bygge noe ekstraordinært sammen.
Stol på Lasting Dynamics for enestående programvarekvalitet.
Staff need a rule they can apply in five seconds, so use three groups of data rather than twelve.
Public information, such as anything already on your website, is fine in any approved tool. Internal and personal data, such as customer emails, contracts, meeting notes and HR records, goes only into the approved business accounts, never into personal ones. Regulated or secret data, such as health records, payment and banking data, source code and confidential client material, goes only into systems cleared for that kind of data, and if none has been cleared yet, the answer is no.
The GDPR applies to personal data whether it goes into a spreadsheet or an AI tool, so data in the second group comes with its usual obligations, including a lawful basis for processing and a data processing agreement with the vendor. The three groups mirror the three workload tiers we use for sovereign AI, so you end up with one vocabulary for data instead of two.
You cannot govern what you have not listed, so the third decision starts with an AI inventory, a spreadsheet with one line per use of AI that records the tool, its purpose, the data it touches, its owner and whether customers see the result. The owner is the column that matters most, because a use with no owner is a use nobody will review, update or switch off.
The inventory also tells you which parts of the EU AI Act apply to you, because the law assigns duties by role, as defined in Article 3 of the AI Act. A company using an AI system under its authority is a deployer, while one that develops an AI system, or has one developed, and puts it into service under its own name is a provider, with heavier duties. Most mid-sized companies become providers only when they put an AI system into their own product or service under their own name, including when someone else builds it for them.
The timeline changed this year, when the Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. The prohibitions in Article 5 have applied since 2 February 2025, and two new bans, on non-consensual intimate deepfakes and on child sexual abuse material, apply from 2 December 2026. Transparency duties under Article 50, such as telling people they are talking to an AI system, have applied since 2 August 2026, with a grace period until 2 December 2026 for marking AI-generated content from systems already on the market.
High-risk obligations for the uses listed in Annex III, which include hiring and credit scoring, now apply from 2 December 2027, and those for AI built into regulated products such as machinery or medical devices, listed in Annex I, from 2 August 2028. For many mid-sized companies, the inventory will show few or no high-risk uses, and it will point to the one or two that deserve closer attention, such as an AI tool that screens job applications.
Review effort should follow the cost of a mistake, not the novelty of the tool. An internal draft that its author will edit anyway needs no formal check. Routine answers to customers need spot checks, with someone reading a weekly sample and fixing what goes wrong. Anything with legal, financial or safety consequences, such as a contract clause, a price quote or a product claim, needs a named person to approve it before it leaves the company.
Proportion keeps AI governance affordable, because it puts the strictest review on the fewest outputs. Review matters for experts too: when we looked at the AI productivity paradox, the effort AI saved on writing tended to reappear in review, integration and rework, even for experienced developers, so plan the review rather than hope to skip it.
Fra idé til lansering lager vi skalerbar programvare som er skreddersydd til dine forretningsbehov.
Samarbeid med oss for å akselerere veksten din.
Customer-facing uses deserve the most thought, because a mistake there is public and can be repeated at scale, which is why we have written separately about which parts of customer service should stay with people.
The law and your clients now ask for the same thing: evidence of what you did, in proportion to the risk. Article 4 of the AI Act, as rewritten by the Digital Omnibus, requires providers and deployers to take measures to support the AI literacy of their staff and others who operate AI on their behalf, and adds that this “does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”
That makes it an obligation of effort rather than of result, so keep a record of the effort. A short AI literacy briefing when someone gets access to an approved tool and a yearly refresher, each logged with a date and names, are proportionate for most companies, and the Commission must publish practical examples of how to comply.
The rest of the proof fits in one shared folder holding the policy, the inventory, the training record and a few examples of completed reviews. None of it needs new software, and together it shows a client, an auditor or your board how the company uses AI.
Some clients will ask whether you are certified to ISO 42001, the short name for ISO/IEC 42001, which was published in December 2023 as the international standard for AI management systems. Certification is voluntary and pays off when clients or tenders ask for it, and because the standard shares its harmonized structure with ISO/IEC 27001, a company already certified for information security starts with much of the groundwork in place.
We should be plain about what is not needed. Most mid-sized companies need neither a governance committee, nor a dedicated governance tool, nor a certification in their first year. In an IBM survey conducted in September 2026, 98% of executives at organizations with 1,000 or more employees in Europe and the Middle East said responsibility for AI risk had been formally assigned at board level, but only 26% had a dedicated board-level AI committee. A page, a spreadsheet and a folder, kept current, are real AI governance, whereas a committee that meets without them is not.
The five decisions fit on one page, and the page turns AI from a private habit into a company capability. The template below is an AI governance policy that a mid-sized company can adapt in an afternoon; its entries are deliberately generic, so replace them with your own tools and people.
| Decision | What to write | Example entry | Owner |
|---|---|---|---|
| Tools | Approved tools, account type, who approves new ones | Office suite AI assistant and one AI chat tool, business accounts, training on our data off. New tools: ask the COO, answer within five working days. | COO or IT lead |
| Data | The three data groups and where each may go | Public: any approved tool. Internal and personal: business accounts only. Regulated or secret: only systems cleared for it. | Data protection lead |
| Owners | Where the inventory lives, who owns each use | One line and one named owner per use. No owner, no use. | Head of each team |
| Anmeldelse | Which outputs a person checks | Internal drafts: none. Routine customer answers: weekly spot checks. Legal, financial or safety matters: approved by a named person. | Owner of each use |
| Proof | What you keep, and where | This page, the inventory, the training log and review examples, in one shared folder. | HR or legal lead |
A working AI policy for companies of this size differs from one written to be filed in a single way: people read it and can act on it without asking anyone.
Review the page every quarter, update the inventory whenever a new use starts, and revisit both after any incident. In the September 2026 IBM survey, eight in ten executives said an AI-related incident had reached their board or C-suite in the previous year, yet only 40% said their organization had changed its governance policy in response. When AI moved faster than governance, 56% pressed ahead within agreed risk limits, and agreed limits are exactly what the page gives you.
Vi designer og bygger digitale produkter av høy kvalitet som skiller seg ut.
PÃ¥litelighet, ytelse og innovasjon i alle ledd.
AI governance done well is the reason a company can say yes to the next AI idea in a week instead of a quarter, because most of the questions it raises already have an answer.
Is one of your AI uses becoming a product your customers rely on? Tell us what it does.
This article was written by Michele Cimmino at Lasting Dynamics, an EU-based custom software development company that also builds AI software. We use AI in our own delivery work and build it into software for clients, so which tools, which data and who checks the output are questions we answer for ourselves first. The legal references above are dated and linked to their sources, so you can check whether they still hold when you read this. The five decisions are yours to make, and the page is yours to write.
It is the set of rules a company uses to decide how AI is used: which tools are allowed, which data may go into them, who is responsible for each use, how output is checked and how it is all recorded. For most mid-sized companies those rules fit on one page.
Five decisions: approved tools, which data may go into them, an owner for each use, the human review each kind of output needs, and the records that prove it. One page is enough for most mid-sized companies.
Not as a single obligation. The EU AI Act sets specific duties, such as AI literacy measures under Article 4, transparency under Article 50 and, from December 2027, rules for high-risk uses, while the GDPR applies whenever personal data is involved. A written policy is the simplest way to show you meet them.
Shadow AI means AI tools that employees use without the company's approval or knowledge. In IBM's Cost of a Data Breach Report 2025, one in five organizations reported a breach due to shadow AI. The fix is an approved alternative, not only a ban.
Not to start. ISO/IEC 42001 is a voluntary, certifiable standard that pays off when clients or tenders ask for it, and it is easier to achieve if you are already certified to ISO/IEC 27001.
Forvandle dristige ideer til kraftfulle applikasjoner.
La oss skape programvare som gjør en forskjell sammen.
Michele Cimmino
Jeg tror på hardt arbeid og daglig engasjement som den eneste måten å oppnå resultater på. Jeg føler en uforklarlig dragning mot kvalitet, og når det gjelder programvare, er det denne motivasjonen som gjør at jeg og teamet mitt har et sterkt grep om smidig praksis og kontinuerlige prosessevalueringer. Jeg har en sterk konkurranseinnstilling til alt jeg tar fatt på - på den måten at jeg ikke slutter å jobbe før jeg har nådd toppen, og når jeg først er der, begynner jeg å jobbe for å beholde posisjonen.
