Case Study: Building AI Governance from the Ground Up

The Brief That Wasn't the Real Job

I was brought in to train staff on AI tools. Straightforward, right? Show the admin team how to use AI effectively, tick the productivity box, move on.

Except the first thing I did was ask to see the AI policy.

Shocker. There wasn't one.

No rules on what could be entered into AI tools. No position from the Executive Leadership Team. No visibility for the Board on what staff were actually doing with AI day to day. People were already using it, that part was never in question. What was missing was any governance around it. No owner, no boundaries, no reporting line back to leadership.

And that’s the governance gap a lot of organisations are sitting in right now, whether they know it or not.

Why This Matters More Than Leaders Realise

This isn't a niche concern. The BoardPro AI Governance Pulse Survey which polled 485 directors, executives, and governance professionals across Australia and New Zealand in 2026, found that 79% of governance professionals use AI at least weekly. Nearly half are using it as a genuine thinking partner for strategy and scenario planning, not just admin.

Now these stats should stop every Board Chair and CEO in their tracks.

• Only 2% of those same organisations have a formal AI governance framework with clear accountability and regular reporting.

• 44% of boards have no agreed position on AI at all.

• 29% have absolutely nothing in place, no policy, no training, no oversight.

  
  

The same survey found that:

• 41% of organisations have staff using AI with zero oversight

• 75% of boards receive AI risk reporting on an ad hoc basis, or never.

• Only one in five organisations has a named person accountable for AI governance.

• Fewer than 1 in 10 directors feel highly confident in their own AI use, even as they read board papers increasingly shaped by it.

  
  

New Zealand's own governance data tells the same story. The Institute of Directors' 2025 Director Sentiment Survey found AI and digital acceleration jumped to the second-most significant strategic issue for boards, up from fifth place the year before. Yet only 30% of organisations have policies governing ethical AI use, and 38% report having no AI expertise at all on the board.

Adoption is racing ahead of accountability.

What’s that old saying? Don’t run before you can walk?

Staff and executives are using AI, often well but without any ownership, without boundaries on what data goes in, and without a reporting system back to the people legally accountable for the organisation's decisions. And I have two words for that – fiduciary risk. Under New Zealand law, directors' duties of care and diligence are personal and non-delegable so AI can inform a decision, but it can’t absorb the accountability for it.

Boards and ELTs that treat AI governance as optional are gambling with the kind of blind spot that turns into a real incident. Sensitive data uploaded to an unapproved tool, an AI-drafted recommendation acted on without human review, a director unable to answer a straightforward question about how a decision was actually reached.

It’s operational, until it’s not.

What I Actually Did

Training staff on AI tools without governance in place would have been enabling a problem, not fixing it. So, I helped them to overcome arguably one of the biggest risks facing the organisation.

Stood up the working group.

I identified this needed structured ownership from day one, not an ad hoc conversation bolted onto someone's existing workload. I set up an AI working group, chaired it, and built the workplan that gave it a clear mandate, cadence, and set of deliverables.

Wrote the policy.

Not a template pulled off the internet but a real working AI use policy specific to this organisation's risk profile, data sensitivity, and operational reality. It covers what staff can use AI for, what requires sign-off, what's prohibited outright, and what the process of escalation is.

Advised the ELT and the Board.

Governance only works if the people accountable for it understand what they're accountable for. I briefed the Executive Leadership Team on the exposure the organisation was facing and what closing it required. I did the same at Board level translating the operational detail into what directors actually need to know to exercise proper oversight.

Got AI onto the Audit and Risk Committee agenda.

A policy sitting in a drawer isn't governance. I worked to establish AI as a standing item within Audit and Risk Committee oversight, so risk reporting has a fixed home and a proper oversight system instead of only showing up when things go wrong.

Trained the admin team properly.

Once the guardrails were up, the original brief train staff to use AI effectively actually meant something. I trained administrators on practical, safe, and effective AI use inside the boundaries the policy sets, so the productivity gains are real and the exposure is managed.

This is the difference between AI adoption and AI governance. Adoption is people finding a tool that works and using it. Governance is what turns that adoption into something a Board can actually stand behind.

The Real Lesson

I was asked to solve a training problem, and I found a governance problem underneath it. That's not unusual, it's the pattern I see across almost every organisation experimenting with AI right now. Staff move fast because nobody told them not to and leadership assumes someone else has it covered.

The fix isn't complicated. It's visibility, a named owner, clear boundaries, and an escalation line to the people accountable for the organisation. What's complicated is that most organisations haven't done it yet, which, per BoardPro's numbers, puts them in company with roughly 98% of their peers.

I don't wait to be asked twice when I see a gap like this. I identify it, I build the fix, and I embed it with leaderships full visibility.

Book a Chat

If your organisation has staff already using AI and no rules governing how, you have a governance gap, and it's growing every week.

Let's talk about what closing that gap actually looks like for your Board and your ELT.

 Book a chat with Nicole