Responsible AI & Governance for Business
Governance for most businesses is a page: who decides, what is permitted, what is restricted, and what happens when something goes wrong.
Objectives
- Explain what business AI governance covers, in proportionate terms.
- Decide who in the business is accountable for AI-related decisions.
- Write a short usage position covering permitted, restricted, and prohibited use.
- Define what must be disclosed, internally and to customers.
- Establish a review path for a new proposed use.
- Describe what should happen when an AI-assisted output causes a problem.
- Recognize where sector or local requirements override internal policy.
Introduction
Governance sounds like something large organizations do with committees. For most businesses it is much smaller and more useful than that: a short written set of decisions about what is allowed, who decides, and what happens when something goes wrong.
A business without those decisions has them anyway — made individually, inconsistently, by whoever is using a tool that afternoon. The purpose of writing them down is not compliance theatre. It is that consistent decisions are cheaper than case-by-case ones, and far cheaper than the first incident.
This module produces a governance position a small business could actually maintain.
Governance, Proportionate to the Business
What a two-person business needs versus a fifty-person one, and why the structure is the same.
Who Decides
Named accountability for approving uses, handling incidents, and answering the questions staff will ask.
Permitted, Restricted, Prohibited
Three categories rather than a long list of rules, and how to place a new use quickly.
Disclosure Inside and Outside
What staff should tell each other and what, if anything, customers should be told.
A Review Path for New Uses
The lightweight route from "could we use AI for this?" to a decision, without a committee.
When Something Goes Wrong
Incident response at business scale: contain, assess, tell whoever needs to know, and change the rule.
Three categories, not thirty rules
A long policy nobody reads governs nothing. Three categories, each with a test, is maintainable.
New uses get placed into one of the three in a conversation, not a process. That is what makes the position survivable in a small business.
Three categories, not thirty rules
A long policy nobody reads governs nothing. New uses get placed into one of the three in a conversation, not a process.
Three governance categories, each with the test that places a use in it and the handling that follows. Permitted covers internal work with no personal data whose output is reviewed by the person using it — just do it. Restricted covers customer-facing work, personal data, or a claim the business must honour — a named approver before use. Prohibited covers decisions about people, regulated advice, and anything the business cannot stand behind — not without a formal change. Three categories with a test each is maintainable in a way thirty rules are not.
Permitted
Handling: just do it.
- Internal work, no personal data
- Output reviewed by the person using it
Restricted
Handling: named approver before use.
- Customer-facing, or personal data
- A claim the business must honour
Prohibited
Handling: not without a formal change.
- Decisions about people, or regulated advice
- Anything the business cannot stand behind
- Permitted — Test: Internal work, no personal data, output reviewed by the person using it · Handling: Just do it
- Restricted — Test: Customer-facing, personal data, or a claim the business must honour · Handling: Named approver before use
- Prohibited — Test: Decisions about people, regulated advice, anything the business cannot stand behind · Handling: Not without a formal change
What a written position actually contains
Short enough that a new employee reads all of it. Six items:
A page is enough. Businesses that attempt twenty pages produce a document that exists and is not used, which is worse than a page that is.
- Who is accountable for AI decisions in this business.
- The three categories, with two or three examples each drawn from your actual work.
- What never goes into an external tool — the data boundary.
- What gets disclosed, internally and to customers.
- How to propose a new use, and who answers.
- What to do when something goes wrong, and who to tell first.
Practical exercise
≈8 minName the accountable person. In a very small business this is the owner; write it down anyway. Fill the three categories with two or three real examples each from your own work. Real ones — generic examples make the categories unusable.
Write the data boundary: what never goes into an external tool, stated plainly. Decide disclosure: what staff tell each other, and whether anything is said to customers. It is legitimate for the answer to be "nothing routine, but never deny it if asked."
Write the review path in one sentence: who to ask, and how long an answer should take. Write the incident path in one sentence: who to tell first, and what to stop doing meanwhile.
The learner produces: a one-page written governance position covering accountability, three categories with real examples, the data boundary, disclosure, a review path and an incident path. Expected outcome: the learner discovers that the difficult part is not writing rules but naming who decides — and that most disagreement in a business is about that rather than about AI.
Nothing is submitted or stored — this is yours. If you would rather not use your own material, or cannot right now, use the supplied alternative in the module's no-tool fallback instead; both teach the same skill.
Your progress
0 of 2 required activities complete in this module · course progress 0%
- ○ GlobSynk Lab™ · optional
- ○ Reflection
- ○ Checkpoint
GlobSynk Lab™
optional, ≈5 minAbout GlobSynk Lab™. GlobSynk Lab™ is the hands-on practice experience used throughout GlobSynk Academy. This Lab is optional hands-on practice: complete it now, skip it and continue the module, or return to it later. Skipping this Lab does not prevent you from continuing the course. For these activities you'll use an AI assistant that you already have access to, then return to Academy to continue your reflection and checkpoint.
Take one thing someone in your business is already doing with AI and place it into your three categories.
If it lands in restricted or prohibited and it is already happening, that is the finding — and the useful next step is the conversation, not the policy. Most businesses discover at least one existing use that their own written position would not have approved, which is precisely why writing it down changes behaviour.
Reflection
≈2 minThink about how decisions actually get made in your business when something new comes up. Who decides, and how does everyone else find out? Would AI decisions follow that same path, or does nobody know?
This reflection is yours alone — it is never sent to GlobSynk or stored. Only the fact that you completed it is saved.
Checkpoint
5 questions · unscored gate · instant feedback · retry as often as you like.
Answer all 5 questions to continue.
Key takeaways
- A page that gets read governs more than twenty pages that do not.
- Three categories — permitted, restricted, prohibited — place a new use in a conversation.
- The hardest part is naming who decides, not writing rules.
- Disclosure is a decision; “nothing routine, but never deny it if asked” is a legitimate position.
- External legal, regulatory and contractual obligations override any internal position.
Practice in Prompt Lab — optional
OptionalPractice placing real proposed uses into your three categories.
In Prompt Lab, practice the judgment this module builds: describe several proposed business uses and work out which category each belongs in and why. Use invented business scenarios rather than your real operational or customer details. The value is in the borderline cases — the ones that force the category definitions to become precise.
Optional, and never required. Prompt Lab is not GlobSynk Lab™. Opening it is not part of module completion, the checkpoint, course progress, the Final Assessment, the certificate or Reward Points, and a learner who never opens it completes this course exactly as normal. Academy never depends on Prompt Lab being reachable.
Practice Prompting in the Real WorldOpens in a new tab. Optional practice — never required for this module, the checkpoint, your progress, the Final Assessment, the certificate or Reward Points.
Before you move on
You have a one-page position with a named decision-maker, three usable categories, and a path for both new uses and incidents. One line in that page carries more weight than the rest and deserves its own module: the data boundary. It is where businesses face actual obligations rather than internal preferences.