The Cyber Solicitor

The Cyber Solicitor

AI Governance

This is why your AI governance policy sucks

And how to fix it

Mahdi Assan's avatar
Mahdi Assan
Mar 13, 2026
∙ Paid

Lots of organisations are yet to sort out their AI governance.

Many might be excited about adopting AI, or anxious that not doing so will leave them far behind the competition.

So they start ideating and brainstorming about how these systems could be used to improve internal processes or create better products for customers.

In doing so, some will have the foresight to think about the importance of governance - there should be a focus on building the thing the right way and not just building anything.

But then this is where organisations make the biggest mistake when starting their AI governance journey.

They start by drafting a policy.

Maybe they look for a template online. Or maybe they even use AI to generate one for them.

They draft it, put is somewhere on their intranet, and then that’s it. They think they have completed governance and now they can just focus on building or using their AI systems however they like.

Simple, right?

Well not really.

Policies are just words. They might represent the principles, rules, guardrails and standards you want to follow when building or using AI. But these things alone are simply not enough.

These things just represent intentions.

And while crystallising intentions in a formal document that everyone agrees to follow is important, starting your governance journey with a policy means that your policy will not be:

  1. Aligned with how your organisation is using and/or developing AI systems

  2. Backed up by practical measures that implement the policy

  3. Actually known, understood and respected by staff

Without these things, your AI governance framework just never really gets going.

If you want to get AI governance right, do not start by writing a policy. You need to do other things alongside the drafting of the policy that will make your AI governance framework actually work.

You need to at least:

  • Understand the state of play in your organisation

  • Develop an AI strategy

  • Build and implement the right measures (organisational, technical and legal)

  • Establish feedback loops

In this newsletter, I go through each of these steps, including why they are needed and what they entail. If you like this content, make sure to share it with others who might also benefit.

Share

This post is for paid subscribers

Already a paid subscriber? Sign in
© 2026 Mahdi Assan · Privacy ∙ Terms ∙ Collection notice
Start your SubstackGet the app
Substack is the home for great culture