AI governance needs clear decision rights for business owners, security, operations and other control functions. You jointly design approval and ongoing controls for an AI use case. Using a case, you practise reviewing results, handling deviations and repeating checks after changes.
In the exercise case, security requires central approval of every AI draft. Assess error consequences and existing approval routes, then design a process with business review, responsibility and escalation. In this planned two-day workshop, you jointly define an AI use case and map risks, decision rights and required evidence. You clarify which risk questions security leadership assesses and which decisions sit with business, risk or operations functions. You then design an approval and ongoing control process. Using a case, you work through recording test results, handling deviations and repeating checks after a change. Each participant explains a proposal and improves it after professional feedback. The result is an approval and ongoing control process worked through together, with decisions, evidence and responsibilities. Organisational information or an example case provides the basis. Jurisdictional and sector-specific requirements are assigned to the relevant roles. Any required legal review is carried out separately by the responsible legal or compliance function.
What you will work on
Define AI risks and their business and domain consequences for a use case
Connect approval decisions with responsible roles and evidence
Trace a change of use through existing approval and operating procedures
Who it is for
CISOs and security leaders
Business and application owners of AI systems
Risk, compliance and operations leads
Topics
AI use case and responsibility boundaries
Risks, business and domain consequences
Decision rights and control functions
Approval evidence and risk treatment
Operational control and changes in use
Your result
Your approval process, worked through together in a case, and the completed control sheets show who checks evidence, handles deviations and decides when the use changes.
Prerequisites
Experience in security or risk management and a defined AI use case. Relevant business and control roles should be involved; an example case can be used.
Format and approach
Two planned in-person days working together on approval and controls, with individual contributions and case testing. Analogue boards and paper records support work without software dependencies.
Set up an AI team with at least three distinct roles for a workflow. Define handovers, information access and human decision rights, then test the workflow. A record shows errors and changes to make before further use.
An AI system sorts applications. An incorrect rejection can leave an eligible application unprocessed. Test whether a second professional review catches that error before dispatch, and prepare a control sheet for your own use case.
Build an AI-supported tool to check records of periodic access rights reviews. It compares the records with an internal policy, flags missing or outdated evidence and checks newly received records again. Configure the workflow, test error cases and keep your configuration.