AI Governance: The 2026 Reference Guide for Regulating Business Use

58% of the 1,700 managers surveyed by Nielsen for Monday.com expect to oversee more AI agents than employees in the coming year. This shift makes AI governance less theoretical: who authorizes an agent, who controls its access, who can stop a system, and who is accountable for an error. For a general management team or an IT department, the challenge is no longer to curb usage, but to make it visible, secure, and auditable. This guide details the effective uses, tools, rules, pitfalls, and a plan to get started.

What AI Really Changes for General Management and IT Departments

Generative AI was initially treated as a tool for individual productivity. In the corporate world, the topic becomes an issue of architecture, responsibility, and management. According to data shared by McKinsey and Stanford HAI, 88% of companies were already using AI in at least one function by 2025, but only 39% reported a measurable impact on their operational results. As detailed in our analysis on the ambiguity of AI responsibilities in companies, this gap often arises less from the models than from the lack of a clear owner.

The most sensitive shift concerns agents. An assistant suggests, while an agent acts: it can call an API, read a file, modify a record, launch a script, or trigger a process. Deloitte indicates that 80% of automation leaders plan to accelerate their investments in AI agents, while only 21% of surveyed organizations report having sufficiently mature agent governance capabilities. The issue is therefore not just efficiency, but the power to act granted to non-human identities.

General management must set the risk appetite, while the IT department must translate this line into concrete controls. This requires a usage register, authorizations by use case, human validations where the impact is significant, a data policy, and an ability to stop systems. Recent incidents, such as the data deletion at PocketOS by an agent linked to Claude, remind us that a poorly supervised test can turn into an operational incident in seconds.

A management committee reviews an AI usage register in a meeting room.

AI governance starts with visible, named, and controlled usages.

Effective Uses Today

AI governance is not limited to banning or allowing tools. It involves classifying usages, proportioning controls, and documenting decisions.

Map of AI usages for general management and IT departments

Usages classified by maturity, with expected gains and risks in case of error.

Ready-to-Use Usages

AI Usage Register. Start by cataloging assistants, agents, AI functions integrated into SaaS, APIs, and local experiments. For each usage, provide the business owner, supplier, accessible data, purpose, authorized actions, risk level, and available logs. Without this register, the IT department does not manage AI: it discovers incidents afterward.

Training and Usage Charter. Since February 2, 2025, the AI Act requires any organization using AI systems to ensure a sufficient level of AI mastery among its staff. Training should cover tool limitations, result verification, prohibited data in queries, transparency rules, and escalation procedures. A useful charter should remain short, concrete, and linked to the tools actually used.

Data Classification. The AI policy must distinguish between public drafts, internal information, contracts, customer data, financial elements, trade secrets, and sensitive personal data. Our analysis on securing data exposed to AI recommends reasoning by accessible data, not just by approved tools. An authorized chatbot can become dangerous if it reads too many files.

Review Before Dissemination. The generation of summaries, reports, emails, sales materials, or internal notes brings quick gains but also creates noise and errors. Companies like Polarsteps, Leapsome, and Clay have established rules for disclosure, clarity, and accountability to limit overly long AI-generated texts. The best practice is to request a short version, verify facts, and take human responsibility for sending.

Usages to Manage

Control of AI Agents. An agent acting within a CRM, messaging system, business tool, or cloud environment must have a minimal scope. Writing, deleting, paying, publishing, or sending externally must be separated from simple consultations. Our analysis on governing AI agents in companies recommends defining who authorizes the agent, who monitors its actions, and who can stop it.

Non-Human Identities. Each agent, API key, service account, certificate, or token must be treated as a full-fledged identity. There must be an owner, a purpose, a duration, exact permissions, logs, and a revocation procedure. Our analysis on managing AI identities shows that least privilege becomes the central control when AI can act.

RAG and Business Context. Agents become useful when they have the right context: procedures, contracts, product sheets, tickets, internal policies. However, the value depends on proprietary, authorized, and up-to-date sources. Agent projects often stumble on data fragmentation, security, and lack of knowledge. The challenge is therefore not to add a model, but to organize sources, rights, and metadata.

Emergency Shutdown of Agents. A coalition led by Okta, with AWS, Google Cloud, and Salesforce, recommends a deactivation mechanism for each AI agent. Revoking an OAuth token is presented as a concrete way to cut an agent's access to a sensitive resource. The procedure must be tested before an incident, with a reachable responsible person and explicit activation criteria.

Emerging Usages

Governance in Code. Governance can begin to be translated into technical controls: access rules, deployment policies, audit proofs, automatic validations. Red Hat has launched asago, with NVIDIA and IBM, to convert AI policies into operational and auditable code. The movement remains emerging, but it addresses a real need: to avoid compliance relying solely on documents and manual validations.

High-Risk Preparation. Systems used for recruitment, selection, promotion, dismissal, task allocation, evaluation, or employee monitoring fall under Annex III of the AI Act. High-risk obligations apply from December 2, 2027. Affected companies should prepare now for evidence of human oversight, data quality, documentation, and traceability.

Tools to Know

There is no universal ranking: one must reason by families of tools, according to the data processed, the actions permitted, and the level of risk.

• AI Usage Registers and Validation Circuits. They centralize use cases, owners, suppliers, data, risks, decisions, and reviews. They prevent projects from remaining within business units without visibility for IT, legal, and security. Requirements: business owner, risk level, accessible data, validation history, review dates.
• Access and Identity Controls for Agents. They manage non-human identities, tokens, API keys, service accounts, and permissions. Recommendations on agents emphasize rapid revocation, especially via OAuth tokens, as highlighted in the alert on rapid deactivation of AI agents. Requirements: least privilege, identified owner, access expiration, immediate revocation, action logs.
• Data and Context Platforms. They provide agents with controlled access to useful internal sources. The findings on barriers related to internal data show that business knowledge conditions the transition to production. Requirements: authorized sources, inherited rights, role-based filtering, response traceability, metadata quality.
• Supervision and Logging Tools. They monitor queries, tool calls, agent actions, errors, data access, and abuse signals. They must allow for reconstructing an incident sequence without relying on a user's memory. Requirements: timestamped logs, defined retention, alerts, incident search, audit export.
• Governance in Code Tools. They transform governance rules into executable controls. The asago initiative by Red Hat, NVIDIA, and IBM illustrates this approach, still to be qualified according to environments. Requirements: versioned rules, execution proofs, CI/CD integration, role separation, continuous audit.

The Framework: AI Act, GDPR, Data, and Responsibilities

Key dates for AI governance in companies

Key dates, status as of October 22, 2026.

AI Act: Obligations Already Active

The AI Act came into effect on August 1, 2024, and applies in phases. Since February 2, 2025, prohibited practices are banned, and any organization using AI systems must ensure a sufficient level of AI mastery among its staff. Prohibited practices include social scoring, manipulation exploiting vulnerabilities, and emotion recognition at work, except for medical or safety reasons. Transparency obligations apply from August 2, 2026.

High Risk: Preparing Without Backdating

The obligations for high-risk systems in Annex III apply from December 2, 2027, after the delay provided by the Digital Omnibus. They particularly target employment, education, certain critical infrastructures, access to essential services, policing, migration, justice, and democratic processes. Tools without high-risk usage, such as writing, summarizing, accounting, cash flow forecasting, or fraud detection, are only subject to general training and transparency obligations.

GDPR, CSE, and Automated Decisions

The GDPR has been in effect since May 25, 2018. Its Article 22 regulates decisions based solely on automated processing that produce legal or significant effects on a person. In companies, the Labor Code also requires informing and consulting the CSE when introducing new technologies. An AI project affecting employees must therefore be documented from the perspectives of personal data, work organization, and social information.

Data, Cloud, and Digital Products

The Data Act has been in effect since September 12, 2025: it organizes access to data produced by connected objects and facilitates changing cloud providers. For publishers and manufacturers, the Cyber Resilience Act requires reporting actively exploited vulnerabilities and serious incidents since September 11, 2026. The directive on liability for defective products includes software, including AI systems, with transposition by December 9, 2026, at the latest.

Pitfalls to Avoid

Diluted Responsibility. An AI committee is not enough if no one can stop a system, deny access, or be accountable for an incident. Each usage must have a business owner, a technical lead, and a known arbitration rule.

Over-Authorized Agents. The danger often comes from overly broad access, not from a spectacular model. A test agent should not have production, writing, or deletion rights without human validation and a shutdown procedure.

Unclassified Data. If teams cannot distinguish between public, internal, confidential, and sensitive data, they will apply the same practices everywhere. AI governance then becomes an abstract directive, difficult to enforce in daily tools.

Paper Compliance. A charter stored in a document repository does not protect the company. Rules must be translated into rights, logs, validations, training, supplier contracts, and periodic reviews.

Sensitive HR Usages. Usages related to recruitment, evaluation, monitoring, or task allocation fall under the most sensitive areas. They require social consultation, GDPR analysis, human oversight, and preparation for high-risk regimes.

Taking Action: The 90-Day Plan

A three-step plan to frame AI in the company

Three steps: frame, test, deploy.

Start by making the existing situation visible: tools used, accessible data, active agents, suppliers, and owners. The first month serves to frame responsibilities, prohibitions, and access. The next two months should transform these rules into evidence: register, authorization reviews, training, logs, shutdown tests, and supplier clauses. A limited pilot is better than a broad deployment without traceability.

Eight checks before generalizing an AI usage

Eight verifications to perform before each new usage.

Further Reading

Our analyses for general management and IT departments

• Why the ambiguity of responsibilities blocks AI in companies. Understand why CIOs, CTOs, CISOs, and business units must clarify who is accountable for AI systems.
• Governing AI agents in companies. An operational method for framing agents, their rights, their data, and their supervision.
• Securing data exposed to AI tools. The controls to implement on access, classification, encryption, logs, and SaaS usages.
• Managing non-human identities of AI. Why agents, API keys, certificates, and service accounts must be managed as critical accesses.
• Reducing litigation risks related to AI. Legal and technical reflexes to document choices, contracts, and AI incidents.

Key News to Remember

• 58% of managers expect to oversee more AI agents than humans
• Okta, AWS, Google Cloud, and Salesforce recommend rapid shutdown of AI agents
• An AI agent linked to Claude deletes PocketOS's database in nine seconds
• Corporate AI agents require architecture, security, and compliance from the design stage
• Red Hat launches asago to transform AI governance into code
• Corporate AI agents remain hindered by access to internal data

Do you provide a solution for AI governance in companies?

This guide is read by general management, IT departments, CISOs, legal directors, and business leaders. Brief IA offers solution providers in AI governance, cybersecurity, identity management, and data platforms dedicated articles, evening brief inserts, and promotion in the directory. Formats and rates at briefia.fr/partenaires.

The Essentials in Questions

How to Implement AI Governance in a Company?

Start with a usage register: tools, agents, suppliers, data, purposes, owners, and risk levels. Appoint an AI responsible person, define prohibited usages, train users, limit access, and plan for periodic reviews. Governance must then be translated into rights, logs, contracts, and shutdown procedures.

Who Should Be Responsible for AI in the Company?

Responsibility should not remain fragmented among CIOs, CISOs, business units, and legal teams. General management sets the risk appetite and designates an owner for AI governance. The IT department operates technical controls, security verifies access, and business units assume the purposes and results of the usages they request.

What AI Act Obligations Already Apply to Companies?

Since February 2, 2025, prohibited practices are banned, and any organization using AI systems must ensure a sufficient level of AI mastery among its staff. Since August 2, 2026, transparency obligations apply: a conversational assistant must indicate that it is an AI, and certain generated content must be flagged.

Are HR AI Systems Already Subject to High-Risk Obligations?

No. AI systems used for recruitment, selection, promotion, dismissal, task allocation, evaluation, or employee monitoring fall under Annex III of the AI Act. However, after the Digital Omnibus, the obligations for high-risk systems in this annex will apply from December 2, 2027.

How to Control an AI Agent Connected to the Information System?

Treat the agent as a privileged identity. It must have an owner, a purpose, minimal permissions, a validity duration, action logs, and a revocation procedure. Sensitive actions, such as writing, deleting, paying, publishing, or sending externally, must be separated and subject to human validation.