AI is evolving so quickly that high confidence in any single strategic AI decision can feel out of reach. Confidence that those decisions add up to something that serves your organization’s goals is achievable, and strong governance is the prerequisite.
Governance means clearly identifying the individuals who own decision making in the key areas. At a minimum, good governance requires named people in each of the following five key roles, that together set direction, own the policy, approve tools, and answer for the data: (1) Executive sponsor, (2) AI policy owner, (3) AI review group leader, (4) AI system owner, and (5) Data steward.
Having a good organization-wide AI policy is foundational, and they can be tricky to get right: short enough that people read it, specific enough that it answers real questions that people have, updated often enough to stay current but not so much that updates get ignored, and dated so everyone knows how current it is. Key elements for a policy include:
- Which tools are approved, which are approved for limited use, and which are prohibited.
- What data may be entered into each tier of tool, and what may never be.
- When AI use must be disclosed, to whom, and in what form on deliverables.
- Who reviews and approves a new tool or use case, and how long that takes.
- How AI prompts and outputs are treated under public-records and retention obligations.
- Who to ask when the policy does not cover the situation.
Data governance is an important subset of overall AI governance: it’s the set of policies, standards, and rules defining how an organization acquires, stores, uses, analyzes, shares, and manages data across its lifecycle. Investing upfront in data governance allows organizations to get more from every AI tool they subsequently purchase, especially in an era with not only exponentially more data, but increasing sensitivity over that data. Good data governance means establishing quality standards, access controls, documentation and transparency, and is overseen by the data steward.
Alignment with organizational culture
Three traits are necessary for strong governance:
- Decisiveness: Decisions are made thoughtfully and quickly. Leaders can ensure this by naming decision makers and giving them clear timelines. Junior staff can experience this by seeing gaps in policy get closed visibly and quickly, such as which tools are approved and which aren't.
- Clarity: Decisions are clear and communicated across the organization. Leaders can build this by writing decisions down and selecting the appropriate forum depending on the type of decision. Junior staff notice its absence when there isn't a clear rule for a common behavior, or when different people in the organization give different guidance.
- Adaptation: The organization adapts as the technology changes. Leaders can build this by leveraging healthy internal forums of information-sharing. Junior staff notice its absence when policies don't keep up with what's happening on the ground.
And a successful governance approach needs to be tailored to the strengths of that organization's culture. In a high-autonomy organization, the job is to empower people while providing guardrails for high-risk activities, i.e. broad permission, with a short list of things that require a conversation first. In a high-alignment organization, the job is for leadership to provide direction that is strong, defensible, and clearly communicated. That approach can protect against downside risks, but it risks ceding competitive ground or underusing the potential of staff and the technology. The Fehr & Peers case study below and the TxDOT case study in Secure Use show what this looks like in different types of organizations.
This section sets out an organization-level framework for adopting and managing AI tools: who is accountable, how platforms and vendors are evaluated, how licenses and access are controlled, how policy is written and kept current, and how the data underneath it all is governed.
The tenets in this section can help leaders set strategy. For others they can serve as diagnostic questions: if you don't know who's making decisions, what's been decided, and when topics will be revisited, you may have found something to raise with the leaders.
The distinction between this Governance section and the Secure Use section that follows is that Governance sets decision rights whereas Secure Use sets operating rules. This Governance section refers forward to Secure Use in cases where relevant operating rules apply.
Roles and responsibilities
Leaders in your organization have a responsibility to set clear governance to ensure that key topics are being handled and to establish accountability. We define five essential roles, each held by a named individual. In a small firm one person may hold several of these roles; in a state DOT each may sit with a different office. The five roles listed here are the governance roles, i.e. the people who set direction, own the policy, approve tools, and answer for the data. The operational security roles that sit alongside them (IT and cybersecurity, legal and procurement, program and operations staff, and consultants and contractors) are defined in the Secure Use section, and are not repeated here.
| Role | What they own (see Note 2) |
|---|---|
| Executive sponsor | Sets the organization’s posture on AI, funds it, and resolves disputes between departments. May be advised by a steering committee or through regular communication with leaders in the technical, strategic, IT, legal, and/or other key areas. |
| AI policy owner | Drafts, maintains, and communicates the AI policy; keeps it current as tools and law change; answers the day-to-day “Can I use this?” questions. |
| AI review group leader | Oversees cross-functional group (IT, security, legal, practice leads) that reviews new tools, use cases, and risk assessments. Texas DOT’s AI Risk Workgroup is one working example. |
| AI system owner | Senior role ultimately accountable for an AI system and for the quality, availability, and appropriate use of the data in it. This is often a person within the IT office. |
| Data steward | Specialist in a specific dataset or system who classifies it, sets who may access and export it, decides what may be published to approved AI tools, and corrects it when it is wrong. Usually not the same person as the AI system owner. |
Fehr & Peers: Prioritizing governance
Fehr & Peers, a 450-person engineering and planning firm, has a vision to transform transportation consulting as the most trusted partner in the communities they serve. As AI's potential to transform client service came into focus, how did this mid-size firm with a high autonomy culture establish a governance model to service this vision? The desired outcome was a culture of nimble and delegated decision-making with appropriate leadership gates for key signoffs. This was realized through a multi-layer structure that built accountability and local flexibility to innovate.
In Summer 2025, two mid-career associates, Andy Kosinski and Tim Baird, were tapped to co-lead an AI Working Group to shepherd AI rollout and institutionalization. They crafted a multi-layer structure: (1) a monthly convening of active users from each of its 19 offices for knowledge and signal exchange, (2) a quarterly convening of director-level leaders, dubbed the Strategic Steering Committee (SSC), and (3) several topic subgroups overseen by emerging leaders empowered to examine and recommend actions for topics such as workforce training, responsible use and disclosure guidance, and agentic coding.
Tim and Andy sit at the center of a flattened hierarchy, serving as a highly accessible clearinghouse for constantly emerging challenges, risks, and opportunities. This has demanded high levels of collaboration, coordination, and individual agency. For example, in Spring 2026 the SSC decided to consolidate licensing from three sanctioned LLM platforms to one. Tim convened a multi-disciplinary sprint team to craft a recommendation within two months, which was then signed off by an executive sponsor, the CEO. The same delegated responsibility structure has also accelerated career growth for other future leaders who own roles recommending responsible use policy communications and disclosure (Lauren Beckwith), creative studio applications (Krystle Li), and AI training lead (Meara Breuker).
Fehr & Peers also trialed an "AI Incubator Office" structure to accelerate AI capability, with the company sponsoring agentic licenses to seed entrepreneurialism across all aspects of a local office operation. In Spring 2026, the Oakland office was established as such a laboratory, with license to spontaneously experiment alongside executing on a structured work plan. The office scale (in this case 30 people) has been a microcosm spawning many finished products that include eight client-serving data dashboards built with agentic coding, an overhauled process for invoice review across a complex team of subconsultants, and two internal-facing spreadsheet tools reimagined as browser-accessed portals with higher functionality and automated documentation. Furthermore, the establishment of a weekly opt-in staff forum has fostered a culture of openness, collaboration, and thoughtful deliberation as staff are learning and adapting.
Developing your AI policy
An organization-wide AI policy that each employee can freely reference is an essential step in building a culture of responsible AI use. Keep it short enough that people read it, specific enough that it answers real questions that people have, and dated so everyone knows how current it is. At minimum, the policy should state:
- Which tools are approved, which are approved for limited use, and which are prohibited. Name them, because “use good judgment” is not a policy.
- What data may be entered into each tier of tool, and what may never be. Rather than drafting this from scratch, consider incorporating the data classification and data minimization rules in the Secure Use section by reference, so there is one authoritative statement to maintain.
- When AI use must be disclosed, to whom, and in what form on deliverables.
- Who reviews and approves a new tool or use case, and how long that takes.
- How AI prompts and outputs are treated under public-records and retention obligations, a live question for agencies and for consultants working on their behalf. The operative handling rules are in the Secure Use section.
- Who to ask when the policy does not cover the situation.
Communicate the policy the way you communicate any other condition of employment: cover it at onboarding, revisit it when it changes, and make sure managers can explain it. Texas DOT, for example, adopted an AI Acceptable Use policy that routes AI tool development and procurement through existing technology processes, with an added review by its AI Risk Workgroup, removing a parallel bureaucracy for AI.
Sample AI policies are provided below for inspiration, although be sure to tailor to your organization’s individual needs. Consider using AI to vet your policy against the recommendations above.
- National Association of Counties (NACo), AI County Compass: A Comprehensive Toolkit for Local Governance and Implementation of Artificial Intelligence
- City of San Jose GovAI Coalition, Starter Guide and Agency Resources
- National Institute of Standards and Technology (NIST), AI Resource Center (AIRC)
- Fehr & Peers, Internal AI Guidelines
Evaluating platforms and vendors
New AI products arrive faster than any organization can assess them, so the goal is a repeatable, proportionate review rather than an exhaustive one. Each organization should have an AI review group with a leader as described above in the roles table. Governance is the discipline around that review:
- Name who must run it.
- Require it to be complete before procurement closes and again at renewal.
- Keep the vendor’s written answers with the contract file.
- Make model transparency documentation a procurement deliverable rather than a favor.
You can score each tool against the criteria below, then decide: approve, approve with conditions, pilot, or decline. Security and data-handling questions are assessed under the Secure Use rules. Be highly skeptical of a vendor unwilling to answer these questions.
| Evaluation criterion | What to look for |
|---|---|
| Security and data handling | Security and data-handling requirements are gating criteria. If a tool does not meet the applicable Secure Use requirements, it should not proceed to approval regardless of its potential value. No AI tool should be approved, procured, or renewed until someone has received a written response from the vendor about what happens to the data you put in. |
| Use case and value | A named problem, a named owner of that problem, and a plausible measure of success. Tools adopted because they are interesting could succeed but often waste resources. |
| Integration and duplication | Does it overlap with something you already license? If so, it may not be worth it. |
| Risk level | Consider the likelihood and impact of an incorrect or misleading output reaching a deliverable, decision-maker, operational process, or the public. Uses that could affect transportation operations, public safety, or other high-consequence decisions should receive enhanced risk review. |
| Accuracy and transparency | Can the vendor explain how the model produces a prediction, score, or ranking? Can you verify outputs against a known source? |
| Total cost | Licenses, implementation, training, storage, and the staff time to administer it. |
| Exit | Can you export your data and prompts, and what happens to them when the contract ends? |
Vendor review and approval
The substance of the review (data retention and deletion, use of agency or firm data for model training, data ownership, confidentiality and public records, cybersecurity and access controls, data location and subcontractors, and acceptable use limitations) is set out in the Reviewing Terms of Service and Vendor Conditions subsection of Secure Use.
Applying extra scrutiny to startups. Scrutiny may need to be higher for a small startup vendor than for a widely used AI provider that typically publishes more complete information on these topics.
Critical infrastructure exposure. Where a tool would touch operational technology, intelligent transportation systems, or connected vehicle infrastructure, the cybersecurity requirements in Secure Use apply in full, and the AI review group should treat the selection decision as critical infrastructure exposure.
Monitoring and continuous improvement. Set a review cadence proportionate to the risk of each deployment: revisit the policy on a fixed schedule and whenever the legal landscape shifts, review each tool against the value case that justified it before renewing. Record the outcomes so the next review starts from evidence rather than memory. Operational monitoring (i.e. access reviews, logging, and watching for data drift or degradation in model performance) is specified in Secure Use; governance is about making sure someone owns it and that what they find comes back to the AI review group.
License and access management
Using personal AI tools for work tasks is still commonplace in our industry. According to the ITE AI GIG Pulse Survey, from July 2026, only 52% of respondents stated that their organization had formally approved or permitted Generative AI use in the form of approved tools, guidance, and policy. MIT Project NANDA's 2025 report "State of AI in Business" (MIT NANDA 2025) notes that only 40% of companies say they purchased an official LLM subscription, while workers from over 90% of the companies surveyed reported regular use of personal AI tools for work tasks.
This is problematic for multiple reasons. Allowing individually expensed subscriptions can contribute to hidden costs. This happens when an employee buys a consumer tier on a personal account, and the organization has no centralized records of the spend, no administrative control, and no inventory entry. An enterprise agreement can be cheaper per seat and is always better governed. While the security and records reasons for prohibiting personal-account use are set out in the Risks Associated With Personal Accounts subsection of Secure Use, the following pointers justify the administrative and cost control rationale for centralized control:
License and access management checklist
Data governance
Everything done with data rests on the quality of the data underneath, as the saying goes: “garbage in, garbage out.” Data governance is the set of policies, standards, and rules defining how an organization acquires, stores, uses, analyzes, shares, and manages data across its lifecycle. Most of this guidance applied before AI, but it matters more now given how readily AI tools store, analyze, and generate data. Investing upfront in data governance means getting more from every AI tool purchased afterward. Data classification, both the scheme itself and the work of maintaining it, is treated in Secure Use, since its purpose is to determine what may be entered into which tool.
Four topics make up a working data governance program. The table below sets out what each one means and what it looks like in practice.
| Topic | What it means | What good looks like |
|---|---|---|
| Data quality standards | Quality is measured along several dimensions: accuracy, timeliness, precision, formatting, completeness, and standardization. Established definitions exist for each, which can be adopted rather than re-inventing the wheel. | Quality standards are written into procurement documents, so a vendor can be held accountable for what they deliver. |
| Data access controls | Who has authority to grant access to which datasets, and where the line sits between self-service and control. Limiting access reduces exposure, but there is a trade-off against usability. | Role-based permissions are in an enterprise platform or warehouse, down to the row and column level, plus a governed place (a warehouse or data lake) that AI tools can read from instead of staff assembling inputs by hand. The controls that enforce those permissions are set out in Secure Use. |
| Data documentation and transparency | A data dictionary describes each field in a single system; a data catalog describes what data exists across the whole ecosystem. The dictionary is the recipe, the catalog is the cookbook. Transparency goes above and beyond this and is a record of how a model was trained, on what, and what guardrails constrain it. | Dictionary and catalog are both maintained. Documentation is mandated for internally developed models, and required as a condition of procurement for third-party tools, especially any tool producing predictions, scores, or rankings. |
| Data governance versus data management | Governance is the strategic oversight. Management is the operational handling of the policies, procedures, and rules. Organizations need both, and the training that supports each is different. | Governance sets the standard for how a highway name is recorded. Management harmonizes the variations already sitting in your systems (e.g. different interstate numbering conventions IH-35, I-35, IH 35, IH 0035) into one consistent form, and decides whether historical records get corrected or the standard applies going forward. |
In implementing good data governance, sequence matters. Quality standards and access controls are the foundation: without them, documentation describes data that has unclear trustworthiness and inconsistent accessibility. Start there, then build the dictionary and catalog, and finally set transparency requirements as tools come up for procurement or renewal.
Data governance framework
- Establish policies & procedures
- Define roles & responsibilities
- Implement risk assessment
- Data quality standards
- Data documentation & transparency
- Stakeholder engagement & training