Corporate: AI governance model and tool approval list

Situation

Teams had adopted tools in pockets, legal worried about data leaving controlled places, and IT wanted a catalogue people could actually use. Saying no without alternatives had not worked.

What we focused on

• Data classification: Simple tiers teams could self-apply with examples.
• Approved vendors: Security review once, reuse across business units.
• Incident path: What to do when someone pastes sensitive data, no shame spiral, fix the process.

Outcome

Fewer shadow tools and faster sanctioned adoption where ROI was real.