The Business Decides: The Rules Worth Following, and the Right People to Make Them

In the first article of this series we described the moment most organizations are actually in. AI is arriving along two legitimate tracks, a healthy decentralized wave of productivity tools and a deliberate centralized track that runs from bought point solutions to redesigned core workflows, and one governance discipline has to hold both. We also introduced the five-level methodology that answers this moment, every level behind a gate, from the decisions only leadership can make to the annual loop that keeps them honest. This article walks the first half of that methodology, Levels 1 through 3. We call it the deciding half. Its entire job is to get the right rules made by the right people and carried to the place where work is designed.

A useful thing to notice before we begin is that almost every organization already has pieces of this. An executive has been informally fielding AI questions. An AI policy possibly sits somewhere in legal. A security team has quietly set some sensible boundaries. None of that work is wasted, and none of it was wrong. What the methodology adds is arrangement. Each decision gets made once, at the right altitude, in writing, so that nobody downstream ever has to guess what the organization intended. When governance feels heavy, the usual culprit is decisions being remade over and over by people who were never given the authority to settle them. The deciding half exists to end that quietly exhausting cycle.

Governance does not begin with committees or tools. It begins with five decisions taken in a deliberate order, each recorded in a short, signed artifact. Most fit on a single page. Every rule the program will ever create must trace back to a person with the authority to make it stick. Authority that is merely assumed is borrowed, and borrowed authority fails the first time it is tested.

The order is part of the design, not a formality. The sponsor comes first so that the four decisions that follow have someone to convene them. The appetite precedes the hard lines, since boundaries calibrate to appetite. An organization cannot say what it will never do until it has said how much risk it is willing to carry and for what. The operating structure comes last, and deliberately so. It is the moment the sponsor’s solo authority gets its planned end date, and the structure decided there is what the sponsor has been holding the seat for. Executive teams that take these five in order find each decision easier than the one before it. Each arrives with its inputs already made.

Level 1 is short, inexpensive, and decisive. It requires no new technology and no reorganization, just leadership putting its name to the questions only leadership can answer. Many executive teams find it clarifying in a way that surprises them. A diffuse sense of shared responsibility becomes five specific commitments, each with a name attached.

With leadership’s decisions in hand, Level 2 writes the organization’s rulebook, and writes it as architecture. The result is a connected set of frameworks that everything downstream will apply but never have to re-decide.

One clarification is worth making before the walk. Two bodies in this methodology both get called “the board” in casual conversation. The board of directors is the fiduciary body the organization already has. In this methodology it affirms and ratifies, and the only decision it makes for itself is the shape of its own oversight. The governance board is the cross-functional executive body the methodology creates to run AI governance day to day, designed by the CEO at Level 1 and chartered here at Level 2. Keeping the two distinct in writing prevents a whole family of confusions later, and this series will always say which one it means.

The level begins by chartering the governance board. The structure the CEO chose becomes a standing cross-functional body with written decision rights, a meeting cadence, quorum, and the authority to grant exceptions. Every exception carries an owner and an expiry date. A small permanent team becomes the board’s operating arm and carries governance between meetings. Chartered decision rights are what convert governance from a meeting into a mechanism. The exception authority alone justifies the effort. Every real organization needs a way to say yes to something unusual without breaking the rules quietly, and an exception with an expiry date and an owner is governance working, not failing.

The board’s first product is risk classification, and everything keys off it. The board adopts written criteria that sort every AI system, present and future, into tiers of consequence. The criteria weigh impact on people, reversibility, data sensitivity, regulatory class, and how much the system acts on its own. Calibrated against the organization’s real inventory, the tiers become the load-bearing frame of the whole program. The criteria are written as criteria rather than case-by-case rulings, which lets them classify systems that do not exist yet. That includes the agents arriving now, whose autonomy is itself a classification dimension. The working test is usability. An intake analyst should be able to classify a proposed system in minutes, without the framework’s author in the room.

Two frameworks then make the tiers operable. Named owners attach to every tier, with response times in hours and days, so accountability belongs to people rather than committees. A permission table binds each tier to how much autonomy a system may have, with every combination decided in advance as permitted, conditional with a named approver, or forbidden. The table embodies a design choice worth making explicit. Below the highest tiers, the workable pattern is escalation. AI acts within boundaries, and humans handle the exceptions. A reviewer asked to approve every output will, through no fault of their own, end up approving without reviewing. Good governance protects its reviewers from that position rather than pretending diligence will overcome arithmetic.

One policy carries it all to the board of directors. The Level 1 and Level 2 decisions fold into a single AI policy, deliberately thin, and the board of directors formally ratifies it. This is the document the organization answers for, readable by a regulator, a customer, or a donor. It also opens two doors on purpose. Anyone inside the organization gets a protected way to raise a concern, and the people its systems affect get a named way to report a problem from outside. A policy the board has actually voted on carries a legitimacy no departmental memo can, and that legitimacy is what makes rules followed rather than bypassed.

Alongside whatever has been formally rolled out, nearly every organization also carries shadow AI. These are tools employees adopted on their own, without sanction. The tools help, and asking felt slower than doing. IT leaders will recognize this as shadow IT’s newest generation, larger, faster growing, and touching real data from day one. It deserves a careful response. The people involved are usually among the organization’s most motivated adopters, doing their jobs better with the best tools they could find.

The methodology’s position is channel, never ban. It opens with an amnesty the governance board formally stands behind. Whatever happened before today carries no consequence. Every boundary is paired with a sanctioned alternative that genuinely substitutes, live before any restriction lands. The few hard limits on data are stated in plain language and drawn only where the data truly demands them. Shadow use itself is treated as evidence rather than violation. What people adopted on their own is the most honest map of real demand the organization will ever get, and the program routes it into its priorities. The rules are explained by role, in each audience’s own language. Employees follow rules they understand far better than rules they merely received. This is where the decentralized track from our first article is governed. Nobody’s work gets redesigned. The track receives clear boundaries, better sanctioned tools, and legitimacy for the personal solutions people build within them.

Working registers make the rest operable. Counsel signs a register of which laws apply to which systems and in which role, maintained as rows rather than essays. Compliance, in practice, is mostly careful bookkeeping done consistently. An impact assessment step asks, before any system is built or bought, whom it could affect and how badly. Routine cases take about thirty minutes, so the asking is built in rather than hoped for. A reasoned control list records which safeguards the organization runs and why, and later becomes the backbone of any certification effort. The stakeholders at this level are deliberately senior. Level 2 is where the organization decides its rules. Every level after applies and enforces them.

AI is entering the organization along the two paths this series began with, and Level 3 is where they part ways. The decentralized wave has already met its governance at Level 2 through clear boundaries, sanctioned alternatives, and rules explained by role. Nobody is redesigning that work, so it largely does not appear in this level. Level 3 exists for the transformational track, the workflow redesign work. It carries the rules to the most economical place governance will ever operate, the design table. A concern caught while a workflow is still on the whiteboard costs a conversation. Caught at deployment, it costs a rebuild. Caught in production, it costs an incident. Nothing in that arithmetic is a criticism of any team. It is simply where the leverage lives, and the methodology puts its weight there deliberately.

The people who own the work make the calls. Domain owners, the executives whose departments the workflows belong to, classify every AI-enabled step as their teams design. They apply the Level 2 frameworks as a constraint that shapes the design rather than a review that rejects it. Their designers are taught the governance vocabulary first, before the design work begins, so classification becomes something designers do naturally. Reviews happen inside the design checkpoints that already exist rather than in a new bureaucracy. Governance that lives inside the templates teams already use gets applied. Governance that arrives as a separate form becomes a separate thing to skip, and the methodology is built with that human reality in mind.

The design reviews the organization already runs are where the discipline is confirmed. Each existing quality checkpoint adds three governance questions. Are the classifications present and plausible? Are the oversight specifications real? Do workflows that cross department boundaries carry agreed terms on both sides of the line? No new gate is added to anyone’s calendar. The point of reviewing at all is the integrity of what comes next. The register that closes this level is only as trustworthy as the designs that feed it, and a register everyone can trust is what lets the enforcement layer build with confidence instead of double-checking upstream work.

Every step declares the data it runs on. While the design is still soft, each AI-enabled step records the source systems its data comes from, the quality that data must meet for its tier, how an output can be traced back to what went into it, and where its own outputs land. Where a step’s data will train or tune a model, those rules are written down too. All of it answers one question every organization eventually faces about an AI output. What went in, and where did it come from? Answered at design time, that question takes minutes. Reconstructed after an incident, it takes an investigation.

The level closes with a contract. Every classified step, with its tier, its autonomy, its oversight, and its data requirements, is delivered to the CIO’s organization as one register, and the CIO’s team confirms in writing that it can be built. There are two signatures on purpose. The business attests the content is true. IT attests it is buildable. Neither can honestly give the other’s attestation. That written confirmation turns a handoff into a contract, and it is the moment the deciding half completes its work. The business has decided. Now IT can enforce.

Notice what Levels 1 through 3 did not require. No new technology, no reorganization, and no pause in the work already underway. They required decisions, made once, at the right altitude, by people with the standing to make them, then carried in writing to the place where work is designed. Organizations that do this discover something that sounds paradoxical until you have lived it. Governance speeds them up. Approvals move faster where criteria exist. Design teams move faster where boundaries are known. Leadership moves faster where exceptions are a process rather than a crisis, and where nobody is relitigating a decision that was made properly the first time.

What remains is the half that runs at machine speed. In the third and final article of this series, we walk the enforcement layer, where every rule made here becomes a protection that works automatically across the entire AI estate. We also walk the annual loop that keeps the whole arrangement honest year after year, and we show the on-ramp for the situation most readers are actually in. Governance can be built mid-flight, with AI already deployed, honestly and without a restart.