Human oversight: a person owns every decision

The single most important operating rule for AI in your organisation fits in one sentence: every AI-assisted decision and every AI-assisted output has a named human owner who is accountable for it, exactly as if they had produced it themselves.

This rule does most of the heavy lifting in day-to-day governance. It means "the AI got it wrong" is never a complete account of a failure, because the follow-up question is always who owned the output and what their review consisted of. It also protects your staff: someone who knows they own an output reviews it differently from someone who thinks of themselves as forwarding the machine's answer.

Making ownership real

Ownership has to be more than a name on a document. The owner needs three things: enough understanding of the task to judge the output, enough time to actually review it, and genuine authority to reject or change it. Where any of the three is missing, you have decorative oversight, a human rubber stamp on an automated process, which is the arrangement data protection regulators specifically warn against for significant decisions about people.

Keep a record of use cases

Alongside individual ownership, keep a simple register of your organisation's AI use cases: what the tool is used for, what data is involved, who owns it, and what review applies. For a small firm this is a short shared document, not a system. It earns its keep in three situations: a client due diligence questionnaire asks how you use AI and you can answer accurately in minutes; something goes wrong and you can see immediately what else uses the same tool or pattern; and at review time you can see which uses have quietly grown beyond what was originally approved.

Review the register on a schedule. Uses drift, and a use case approved for internal drafting has a way of ending up in client deliverables without anyone deciding that on purpose.