GOVERNANCE & SECURITY
NUMEZISADVISORY &
ENGINEERING
Contents
DECISION AID · GOVERNANCE
Match the level of control to the consequences
Risk is not a property of a model name. It depends on the data involved, on what the system is allowed to do and on how easily an error is spotted and put right.
drafting or searching for internal use
approved tool · basic training · data rule · listed in the inventorythe output goes to a client or informs a professional decision
named reviewer · test set before go-live · errors trackedacts in your software, touches protected data or a decision about a person
formal decision · impact assessment if required · least privilege · confirmation · logging · immediate stopA fast track for level 1; the strictest governance for the uses that can cause real harm.
AI governance fails when it stays a policy document. Teams need to know which systems exist, what they are allowed to do, which controls apply and what proof is required before a riskier use goes live. It also fails when it is too heavy: if every use goes through the same committee, the work simply happens elsewhere, on personal accounts.
This framework is for the management of companies running several AI uses and projects. It comes down to six elements.
1. An up-to-date inventory
Start with how AI is actually used, not just with the approved suppliers. For each use, note the business owner, the users, the process concerned, the categories of data, the tool or model, the connections to other software and the effect on decisions. Include AI built into the software you already use, and undeclared use where it is significant.
The inventory becomes the basis for everything else: classification, controls, incident response. It has to keep pace with purchasing and projects (every new tool or project goes into it), rather than depend on an annual survey.
2. Three levels of control
The same model can serve a trivial use or a critical one. So you classify the actual use, with six questions:
| Question | Weak signal | Strong signal |
|---|---|---|
| What data? | Internal | Customer data; protected data (sensitive within the meaning of the nFADP, subject to secrecy, trade secrets) |
| Who sees the output? | A trained person, internally | Customers, staff or third parties, at scale |
| What can the system do? | Draft, search, suggest | Write into software, send, approve, trigger an action |
| Can a mistake be reversed? | Easily corrected | Hard to put right (money, rights, reputation) |
| Is a mistake visible? | Immediately, to a competent user | It can go unnoticed |
| What is the consequence at scale? | Low | Decisions about people, safety, regulatory obligations |
The strongest answer sets the level; you do not take an average, which would hide a real risk.
- Level 1: AI drafts or searches for internal use. An approved business tool, basic training, a data rule, a simple entry in the inventory.
- Level 2: the output reaches a customer or informs a business decision. In addition: a named person checks it, a representative set of test cases is run before going live, and errors are tracked.
- Level 3: the system acts within your software, or touches protected data or a decision about a person. In addition: a formal decision by an owner, an impact assessment where the nFADP requires one, minimum access rights, explicit confirmation of irreversible actions, logging and the ability to stop it immediately.
The result is one sentence per use, not a label on a model. "Claude is safe" means nothing. "The claims assistant drafts replies based on the approved terms and conditions, never sends anything itself, and every reply is checked by a named claims handler" is a sentence you can verify.
3. A library of reusable controls
Each control is a building block that a team attaches to its use, with an owner, a way of putting it in place, the proof it produces and how often it is checked.
- Identity and access. Accounts created from the company directory, administrators kept separate from users, access removed when someone leaves or changes role. For an agent, its technical identity has fewer rights than the person it helps: "the user has access to it" does not mean "the agent may act on it".
- Data boundaries. Permitted sources, exclusions, retention period, place of processing, permitted destinations for the output. Document access rights are enforced at the moment of search, not entrusted to a prompt such as "do not reveal confidential information".
- Quality and testing. A versioned set of test cases: everyday cases, ambiguous cases, trick cases, multilingual cases, known past errors. You record why a test fails, how serious it is and whether a person would have spotted it.
- Control of actions. Keep reading, proposing and executing separate. The parameters of an action are checked by the software, not by the model; a payment, a message to a customer or a deletion is confirmed by a person.
- Traceability. Enough information to reconstruct what happened (use, user, model version, tools called, reviewer's decision, cost), without disproportionate monitoring of staff.
4. Generative AI is an attack surface
Instructions hidden in a document, data leaking through a connected tool, an agent with too many rights, poisoned context: these are system risks that a general call for caution will not fix. Map the whole chain (user, interface, orchestration, connected tools, document search, model, recipients of the output), cut down rights, isolate untrusted content and require confirmation for actions that commit the company. The OWASP Top 10 for LLM Applications is a good starting list.
5. Governance that responds quickly
Governance that can only say no produces undeclared use. It is better to run it as a service, with a known entry point, reusable templates and published response times:
- Level 1: fast track. Approved tool, training completed, entry in the inventory, answer within a few days.
- Level 2: a standard file (a one-page description of the use, a data diagram, test results) and a named reviewer.
- Level 3: a decision by a small committee, with a dissenting view heard.
Publish the questions you will ask before a team starts building: projects then arrive better prepared.
A short monthly review is enough, with four fixed items: changes to the inventory (new uses, changes, withdrawals), the state of controls (access exceptions, test results slipping, overdue reviews, changes at suppliers), incidents and near misses, and decisions to be taken. Every quarter, check that the levels are still right: a use moves to level 2 when its output starts leaving the company.
6. Named owners
Every use has three owners: a business owner for its purpose and results, a technical owner for building and running it, and a risk owner who accepts the controls. Legal, security, data protection and purchasing bring their expertise; they do not become the default owners of every AI output.
The management test
The question is not whether the company has an AI policy, but whether it can show, for each important use, who approved it, with which controls and with what results. Management's minimum pack contains the inventory by level, open exceptions, significant changes at suppliers and in models, incidents and the decisions requested.
Three signals call for immediate action: the inventory lists fewer uses than there are tools available to staff; the rule forbids behaviour that the approved tool makes easiest; nobody can explain why a level 3 use was approved. These are design faults, not training gaps.
Where to start
In a company of a few hundred people, the inventory, the classification of existing uses, the first controls and the monthly review can be in place within a quarter. We do this as part of AI Adoption Support: at a fixed price on quotation, or by subscription (the Deployment plan at CHF 5,100 a month for 30 hours, or Transformation at CHF 9,600 for 60 hours, three months minimum). The technical controls for an agent or an integration (access rights, traceability, confirmations) come under AI Engineering. The legal obligations to build in are set out in our analysis of the nFADP, the AI Act and generative AI.
Discuss this decision
hello@numezis.com ↗