AI is not delegated. It is governed.

“Understanding AI” series, note 12 of 12. This note closes the series. It is written for whoever has to decide, and takes the previous eleven as read, although it begins by summarising them for whoever arrives here first.

Tuesday, 4 pm, the board of a family-owned distribution company in Lausanne, third generation. Last item on the agenda: “Artificial intelligence”. The chairwoman put it there because a competitor has announced something, because her son showed her an assistant on his phone and because the chief financial officer has been saying for months that something has to be done. She asks the board: “So what do we do about AI?”. Forty minutes follow in which agents are discussed, a provider who called last week and a pilot the German subsidiary ran. At the end, the minutes say: “It is agreed to keep studying the matter”. It is the third time this year.

The scene is imaginary. The minutes are not. The question “what do we do about AI?” has no answer because it is not a management question: it is a technology question in disguise. The management questions are different, there are seven of them, and they fit in a one-hour meeting if you arrive with what this note provides: an honest summary of what it is, a list of what only management can decide, a framework so as not to reinvent the wheel and an agenda.

Whoever is in charge does not need to understand how the model works. They need to decide where it is used, who answers for it and what is not automated. That cannot be delegated.

What you need to know, in seven sentences.

• A language model predicts the most probable text. It does not seek the truth; the two almost always coincide. (Notes 1 and 2.)
• It makes mistakes with confidence, and it agrees with you. That is why every decision with consequences stays with a person, and every analysis is asked for the counter-argument. (Note 2.)
• Most of what your company needs to automate is still classic software. The model is reserved for what no rule knows how to do: read, classify, extract, summarise, draft. (Notes 3 and 4.)
• It helps a great deal in some tasks and harms in the one next door, without the line being visible from outside. Serious studies measure a 14% to 40% improvement inside the frontier and a fall outside it. (Note 4.)
• Short chains, checks between steps, permissions one by one. A fourteen-step agent that gets 95% right at each step fails half the time. (Note 5.)
• The project starts before the provider: a process with a number, clean documents, fifty gold cases, shadow mode, risk-based review, and someone from the business with the number in their objectives. What is not done that way is part of the 95% without a return. (Notes 6, 7 and 8.)
• The law already applies, security is above all permissions and data, and the blind spots are the watching nobody budgets for. (Notes 9, 10 and 11.)

What only management can decide.

There are six decisions which, when left to the technical team or the provider, turn out badly, not because they are bad, but because they are not theirs.

• Where, and where not. Which processes are automated first and which are not touched: recruitment, decisions about customers with legal effects, anything in which the company would not want to explain to a customer that a machine decided it. It is a decision of judgement and brand, not of technology.
• How much error is accepted, and in exchange for what. No system is always right. Management sets the threshold per process: 99% on invoices with review of the rest, 100% with a human signature on everything that goes out to a customer. Without that number, the technical team will set its own.
• Who answers for it. One name per system, from the business, with the number in their annual objectives and with authority over how their team works. The technical owner helps; the business owner answers.
• Which data leaves the building, to whom and under which contract. With the list of providers, where they process, whether they train on your data and how it is deleted. It is the decision the law requires you to take, and the one you later most regret having delegated.
• What people know. What training each person who uses a system receives: what it does, how it fails, what they check. In the European Union it has been an obligation since February 2025 (Article 4 of the AI Act); in Switzerland it is common sense with an expiry date.
• What happens on Monday if it is switched off. The manual procedure, the connections on open standards and the ownership of the cases, the documents and the logs. It is the decision not to depend, and it is only taken in time if it is taken by whoever signs the contract.

A framework so as not to reinvent the wheel.

There is no need to design a governance system from scratch. In January 2023 the United States National Institute of Standards and Technology, NIST, published a voluntary AI risk management framework that has become the most used reference, in Europe too, because it is not a law but a way of organising the work. It has four functions with verb names: govern, the culture, the roles and the policies; map, the context and the risks of each use; measure, with metrics and tests; and manage, act on what was measured and watch. In July 2024 NIST added a specific profile for generative AI, which lists the risks particular to these models, from inventions to data leakage, with practices for each.

For a medium-sized company, the whole framework fits in four one-page documents, and I recommend they exist before the second process: a register of the AI systems in use, with their owner, their provider, their data and their error threshold; a two-page policy on what may be used, with which data and what is never pasted; the watch book of each system, with the fifty cases and the five weekly checks; and an incident procedure: what is done when a system says something it should not, who switches off, who warns, who corrects. Govern, map, measure, manage. The rest is size.

Seven questions for the committee.

These are the ones that replace “what do we do about AI?”. They are asked in this order, and the answers fit on one sheet.

• What do our people already use, with which data? If the answer is “nothing”, it is wrong: 75% of knowledge workers were using AI in 2024, 78% with their own tools.
• Which number in the company do we want to change first, and by how much? One process, one figure, one date. Whatever does not fit in a sentence is not approved.
• What are we not going to automate, and why? The list of what stays with people, written and signed.
• Who answers for each system, with which error threshold? One name and one percentage per system.
• Where is our data and under which contract? Providers, countries, training, deletion. If nobody knows, it is the first task.
• How much have we spent and what is in production? Licences, consulting, internal hours, against systems that work on a Tuesday at 6 pm.
• What would we do on Monday if all of this were switched off? If the answer takes more than a minute, there is an unmanaged dependence.

What those who have already decided say.

It helps to decide knowing how it went for others. In May 2025 IBM published its survey of 2,000 chief executives worldwide. Only 25% of AI initiatives had delivered the expected return; 16% had been extended across the whole company; 64% admitted having invested before understanding the value, for fear of falling behind; 61% were adopting agents; and half pointed to the accumulation of disconnected technologies as a brake. Read it as a map of what not to do: investing out of fear, without a number, without extending what works and adding tools that do not talk to each other. Each of the seven questions above avoids one of those figures.

A twelve-month agenda.

I give a model agenda for a company of between 20 and 300 people, with a budget that is not decided in January but in October, on numbers.

1. Months 1 to 3

   Know and order

   Inventory of what is already used. Two-page policy and official tool with protected data. Map of the nine verbs by department. Choice of the first process with its number. Half-day training for management and owners.

2. Months 3 to 6

   The first process

   Clean documents, fifty gold cases, the simplest thing that solves the case, four weeks of shadow mode, tiered switch-on. Business owner named. Register of systems created with one line.

3. Months 6 to 9

   Measure and repeat

   The sum from note 7 with the real numbers. Watch book running. Second process chosen with what was learnt, in administration or operations, not in the showy part. Review of provider contracts: data, training, deletion, exit.

4. Months 9 to 12

   Decide on numbers

   Two systems in production, measured. Incident procedure tested once. Monday drill. Next year’s budget decided on measured return, not on fear. And a written list of what is not automated.

What I have not said in twelve notes.

I have avoided two things on purpose. I have not said that AI is going to change your sector, because I do not know and because whoever claims it is usually selling something. And I have not said that nothing needs doing, because your people are already doing something, and because the boring administrative processes, the ones nobody looks at, return real money when they are automated with judgement. Between enthusiasm and paralysis there is a narrow and fairly boring path: one process, one number, fifty cases, four weeks of shadow, one owner, two hours of watching a week. It is less exciting than a presentation. It is what works.

How I approach it.

My work with a company starts with the seven questions, not with a demonstration. The Strategic Diagnostic is the answer to the first three, with the map and the company’s numbers. The Automation Assessment is the first process taken as far as the fifty cases and a fixed budget. Then it is built, in shadow, with a watch book and with an owner who is not me. Because what this series has tried to say, in twelve ways, is one thing: AI is a very good tool in the hands of whoever understands what it is and who answers for it. And that, in your company, is you.

One last test, the shortest of the series. Write on a sheet of paper the name of the person in your business who answers for it if an AI system gets something wrong with a customer. A name, not a department.

If you wrote it without hesitating, show it to that person and check that they know. If you hesitated, you have the committee’s first decision. And if you wrote your own, the question changes: what do you need to know to sign for that responsibility with a clear mind? These twelve notes have tried to answer it. Only you know whether they have.

End of the series. The twelve notes are in the “Understanding AI” category, in order, in the five languages of this website. If you want to start with the first: “What is artificial intelligence?”.