Governing AI without becoming captive to it

Artificial intelligence entered organisations through the demonstration: an assistant that drafts, a model that classifies, a pilot that impresses. Scaling up follows another logic. What was an experiment without consequence becomes an infrastructure dependency: critical processes rest on models the organisation did not build, fed by data it does not always govern, supplied by players whose terms can change.

The question is not whether to go ahead. It is which decisions must be taken before becoming dependent. There are five, and they belong to executive management, not to the technical teams alone.

First decision: who decides what the AI does

Before any deployment, an organisation must be able to name the uses it authorises, those it forbids and those it puts under review. Without this governance, uses decide themselves, at the pace of the teams and the suppliers. A clear body, a use-case approval process, explicit criteria: less spectacular than an AI strategy, and more decisive.

Second decision: what becomes of the data

Every use of AI is a movement of data. Which data leaves the organisation, towards which systems, under what contractual and legal regime? Which data serves, or could serve, to train a third party's models? The answer cannot be discovered after the fact in a supplier's terms and conditions. Data classification, circulation rules, negotiated clauses: data sovereignty is decided before signature.

Third decision: which models and which suppliers

Choosing a model is choosing a dependency. Proprietary or open model, hosted at the supplier or in the organisation's own infrastructure, general-purpose or specialised: each option distributes cost, performance and control differently. There is no single right answer; there are choices consistent with how critical the use is. One principle holds: the more critical the use, the more the organisation must understand what it depends on and be able to change it.

Fourth decision: where the human remains

Automating a recommendation is not automating a decision. For each use, the organisation must set the exact point where human responsibility is exercised: who validates, who can overrule the system, who answers for the result. This clarity protects in two ways: it avoids automated decisions that no one owns, and it avoids the opposite excess, supervision for show where the human approves without examining. Real control requires trained operators, time to exercise judgement, and systems designed to be challengeable.

Fifth decision: how you get out

This is the decision no one wants to take in the moment of enthusiasm, and it is the most important. What happens if the supplier changes its prices, its terms, its data policy, or disappears? Can the organisation recover its data, its configurations, its histories? Can it switch to an alternative within a bearable time? The ability to exit is designed at entry: open formats, documented integrations, a replacement scenario tested at least on paper. A system you cannot get out of is not a tool; it is a form of subjection.

Useful AI is AI under control

There is nothing of a brake in these five decisions. The organisations that take them early deploy faster, because they do not have to stop at every alert, and negotiate better, because they know what they are accepting. Those that defer them discover their dependencies at the worst moment: when the use has become critical and the balance of power has shifted.

Governing AI does not mean slowing it down. It means ensuring that, in five years' time, the organisation can still choose: its uses, its models, its partners. Captivity, for its part, is contracted today, in decisions that look purely technical and are not.