Govern the AI portfolio, not each project separately

Once an organisation has more than a handful of AI initiatives, governance usually arrives as a gate. Each project fills in an assessment, waits for the committee, answers the same questions about data and oversight as the project before it, and is approved weeks later with conditions nobody checks afterwards.

Delivery teams experience this as delay. The risk function experiences it as a queue. Neither gets what it needs: the committee sees documents rather than systems, and the projects learn to describe themselves in whatever way gets through.

Why project-by-project review fails

Everything gets the same scrutiny. An internal drafting aid and a system that ranks job applicants go through the same form. Low-risk work is slowed down, and high-risk work gets no more attention than the form has room for.

The evidence is written for the gate. An assessment describes intended behaviour. What the system actually does on real inputs, after the third prompt change, is not in the document, and nobody comes back to check.

Nobody sees the whole. Fifteen approved projects may share a data source nobody owns, a supplier dependency nobody has priced, or the same three overloaded experts. Each of them passed. The portfolio was never reviewed.

Lanes proportionate to what can go wrong

Classify by consequence rather than by technology, and let the lane decide how much review a project gets.

Infographic

Review proportionate to consequence

Internal drafting aidsAnswers staff act onContent for customersDecisions about people

Light registrationFull assessment

Internal aids, where a person sends everything, get a short registration and a standard pattern.

Answers that staff act on get an agreed quality bar and a named outcome owner.

Content that reaches customers adds a fallback, a list of things it must never do, and monitoring in use.

Systems that inform decisions about people get the full assessment, human oversight designed in, and a decision log. Depending on the use, some of them may fall into what the EU AI Act treats as high-risk, where obligations such as technical documentation, logging and human oversight are far easier to meet when they are designed in than when they are added at the end.

Approve patterns once. Each lane comes with patterns approved in advance: a sanctioned way to call models, standard logging, a standard fallback. A project that uses them inherits the approval for those parts and is reviewed only on what is new. This is where most of the speed comes from.

Evidence the delivery already produces

The best input to governance is not an assessment form. It is what a well-run AI team produces anyway: the evaluation set and its results over time, the quality bar and who signed it off, the list of things the system must never do, the decision log, the incidents and what was done about them.

If governance asks for those, it costs teams almost nothing and shows the committee the system rather than a description of it. It also fits the way ISO/IEC 42001 frames the problem: as a management system at the level of the organisation — objectives, risk and impact assessment, controls and their regular review — rather than a separate approval for every system.

One review for the whole portfolio

On a cadence the organisation can actually keep, look at every initiative in one sitting, with the same evidence for each: measured level against the bar, actual use, cost per task and open incidents. Three possible decisions: continue, scale, stop.

Stop is the decision that frees capacity. The pilot that has been nearly there for three quarters is often the most expensive item in a portfolio, because it holds the people every other initiative is waiting for.

Scale on evidence, not enthusiasm. An initiative earns more users, a riskier lane or more autonomy when its numbers cross the bar, not when its sponsor makes the better case.

Where this leaves governance

Governance built like this does not slow delivery, because most of it is delivery. In AI transformation work, decision rights and escalation are sized to the organisation — a small company does not need a steering committee, a large one will not move without one — and the portfolio review is where stopping something usually turns out to be the most valuable decision on the table.