How to Use AI Responsibly

By Jay P. Patel, ASQ Fellow, MBB, Lean Expert, SCRUM Master, CEO and President of Quality & Productivity Solutions, Inc.

Artificial intelligence has moved from experiment to everyday infrastructure faster than most organizations have learned to manage it. McKinsey’s 2025 global survey found that 88% of organizations now use AI in at least one business function, yet only about one-third are scaling it across the enterprise, 39% report enterprise-level EBIT impact, and only about 6% qualify as AI high performers. The gap between adoption and results is not mainly a technology gap. It is a management gap.

After more than thirty years of helping organizations build quality and management systems, I see the pattern repeat. When a powerful new capability arrives, early enthusiasm outruns discipline, and leaders eventually discover that value depends on structure: clear authority, defined accountability, proportionate controls and honest measurement. AI is no different. This article sets out a practical framework, drawn from the QPS AI Governance, that leaders can use to govern AI responsibly, efficiently and effectively.

1. Governance Is an Accelerator, not a Brake

AI governance is the system of authority, accountability, policies, processes and controls by which an organization directs its use of AI so that it is lawful, safe, fair, effective and aligned with its purpose. It must answer five questions for every AI system, from a spreadsheet macro that calls a chatbot to a model that decides on credit:

Who decides? Who may approve, pause or stop the system?
Who is accountable? Which named person owns the outcomes?
What are the rules? Which policies and standards apply?
How do we know it works and is safe? What testing, monitoring and assurance exist?
What happens when it goes wrong? How are incidents detected, contained and learned from?

Done well, governance removes ambiguity. People know what is allowed, who will help and where the limits are, so low-risk uses are approved in days rather than months and scrutiny is concentrated where it matters. Three pressures make this urgent: risk (biased or confidently wrong outputs, data leakage through public tools, attacks on models), regulation and customer expectations (the EU AI Act, sector rules, US state laws and procurement questionnaires), and value (organizations that move from scattered pilots to governed, scaled use are the ones capturing financial impact). Good governance must therefore deliver three outcomes together: trust, compliance and value.

2. It Starts with Leadership

AI governance succeeds or fails on top-management commitment. ISO/IEC 42001, the international standard for an AI management system, makes this explicit in Clause 5: top management must demonstrate leadership, establish an AI policy and assign roles and responsibilities. The Board oversees; the CEO and executive team own the system. The Handbook distills this into ten duties, and in my experience five of them separate organizations that govern AI from organizations that merely write about it:

Set direction and boundaries. Approve a one-page AI vision tied to customer value, personally sign the AI Governance Policy and Responsible AI Principles, and publish the risk appetite and the “red lines” of uses the organization will never permit.
Create a body with real authority. Charter a cross-functional AI Governance Council with decision rights, not merely advisory status.
Appoint accountable people and protect their time. Name a Director of AI Risk & Ethics and AI Champions in every function, with time written into their job plans.
Fund it. Governance without budget is theatre. Resource the AI Governance Office, assessment tooling, monitoring and training.
Model the culture. Declare that raising an AI concern is expected and will never be penalized, use AI visibly and responsibly yourself, and respond to incidents with root-cause learning rather than blame.

The remaining duties (integrating AI into existing systems, holding quarterly management reviews, and reporting to the Board at least twice a year) turn commitment into routine. Each duty carries evidence an auditor or regulator would expect: signed policies, appointment letters, budget lines, minutes and action logs.

3. A Simple Structure with Clear Roles

Effective governance does not require a large bureaucracy. It requires a layered structure in which each layer has a purpose, an authority and a cadence, and in which no one marks their own homework.

Body or role	Purpose	Cadence
Board / Audit & Risk Committee	Oversees AI risk appetite; receives assurance from management and Internal Audit	At least twice a year
Top management	Sets vision, risk appetite and red lines; approves policy; resources the system	Quarterly management review
AI Governance Council	Cross-functional; chaired by CEO or COO; approves high-risk AI, resolves trade-offs, monitors risk and value	Monthly in year 1, then every two months
Director of AI Risk & Ethics	Independent second-line leader; owns risk tiering, impact assessments, ethics, incident oversight; holds a stop-ship right on high-risk systems	Continuous; quarterly report
AI Champions	One or two per function at about 10% of their time; first-line guides for intake, coaching and feedback	Monthly community of practice
AI System Owners	Business owner of each system; accountable for outcomes, compliance and monitoring	Per system lifecycle

Three design choices deserve emphasis. First, every function sits on the Council: technology, data, legal, privacy, security, HR, quality, operations, finance, procurement, product, customer experience, plus rotating Champions and an employee representative, with Internal Audit as an independent observer. An IT-only council treats AI as a technology topic when it is a business topic. Second, authority matters more than membership: the Director of AI Risk & Ethics can pause a high-risk system, and only the CEO can override, in writing, with a report to the Board. Third, the three lines model keeps roles separate: the business owns and operates AI safely, the second line sets frameworks and challenges, and Internal Audit independently assures the whole.

4. Match the Control to the Risk

The most important efficiency lever in the framework is proportionality. Not all AI deserves the same scrutiny, so every system is classified into one of four risk tiers, each with a defined approval authority and a ceiling on how independently the AI may act.

Risk tier	Typical examples	Who approves	Maximum autonomy
Tier 1 Low	Meeting summaries; drafting non-sensitive text	AI Champion and system owner	L4 Oversee (L5 only for tightly bounded, reversible tasks)
Tier 2 Medium	Customer-service chatbot; marketing content; forecasting with customer data	Director of AI Risk & Ethics; Council notified	L3 Approve
Tier 3 High	Resume screening; credit decisions; clinical decision support	AI Governance Council, with ethics opinion	L2 Advise (L3 only if reversible, with Council approval)
Tier 4 Prohibited	Social scoring; manipulation; untargeted facial scraping; fully automated decisions with legal effect and no human review	Nobody. No exceptions.	Not permitted

Most AI in a typical organization falls in Tiers 1 and 2. A good system makes those approvals fast (the Handbook’s example targets are five and ten days) and reserves the Council’s time for the few Tier 3 decisions that need it. The tiers also map naturally to the EU AI Act’s four categories, so an organization that builds to this structure now is well placed whichever compliance dates finally apply.

Consider how this works in practice with three requests arriving in the same week. The governance system treats each differently, and each reaches a decision without a meeting of the full executive team unless the risk demands it.

Request	Tier	Path through governance	Typical outcome
Team wants an AI meeting summarizer for internal, non-sensitive meetings	Tier 1	Champion and system owner approve; tool recorded in inventory; acceptable-use policy applies	Approved within days; annual review
Marketing wants a customer-facing chatbot using customer data	Tier 2	Risk assessment; testing; transparency notice that users are talking to AI; route to a human; Director approves, Council notified	Approved with conditions; quarterly monitoring
HR wants AI to screen resumes	Tier 3	Full impact assessment; ethics review; independent validation; human decides; Council approves with executive sponsor	Approved only if evidence is complete; monthly monitoring

5. Build It as a Management System, Not a Document Set

The difference between governance on paper and governance in practice is a management system: defined policies, repeatable processes, records, measurement and continual improvement, operated on the Plan-Do-Check-Act cycle. The Handbook provides twelve policies (governance, responsible AI principles, acceptable use, risk management, data and privacy, transparency, human oversight, vendors, security, lifecycle and validation, incidents, and workforce training) supported by thirteen processes that put them to work. A six-gate lifecycle, from idea through design, pilot, validation, deployment and monitoring, ensures that evidence exists at every stage and that approval is never mistaken for the finish line.

Several policy requirements show how practical this becomes. Every AI system has a named owner and is recorded in an inventory before production use. A human remains accountable for every consequential decision, with a tested override and shutdown capability. Staff may not enter confidential or personal data into unapproved tools, and must treat AI output as a draft to be verified. AI agents work on the principle of least privilege, with spending and communication limits set in advance and every action logged. Vendors receive the same classification and due diligence as internal systems, with contract terms on data use, incident notification and audit rights. Incidents are reported within 24 hours, without blame, and Severity 1 events reach the Council within a day.

Crucially, this is not a separate bureaucracy. The framework maps directly to ISO/IEC 42001 (clauses 4 to 10 and Annex A) and to the NIST AI Risk Management Framework functions of Govern, Map, Measure and Manage. It is designed to integrate with an existing quality management system, ISO/IEC 27001 and privacy programs, enterprise risk management and the internal audit plan. Organizations already certified to ISO 9001 will recognize the logic: leadership commitment, risk-based thinking, documented information, internal audit, management review and corrective action. Integrating rather than duplicating is what keeps governance efficient.

6. Measure What Matters: Safety, Speed, Value and Trust

What top management measures, the Council manages. The scorecard is reported at every Council meeting and at the quarterly management review, whose inputs include the AI inventory by tier, incidents and near-misses, audit results, stakeholder feedback and resource adequacy, and whose outputs are decisions, actions with owners and dates, and items to escalate to the Board.

Area	Indicator	Example target
Coverage	AI systems in the inventory; Tier 3 systems with impact assessment and ethics opinion before go-live	100%
Speed	Median days to decision for Tier 1 / Tier 2 / Tier 3	5 / 10 / 30 days or fewer
People	Staff completing AI literacy training; policy attestation	90% or more; 95% or more
Safety	Severity 1 incidents contained	Within 24 hours
Assurance	Audit findings closed on time	90% or more
Trust and value	Employee and customer trust survey; benefits realized against business cases	4.0 of 5 or better; reported per use case

Notice that the scorecard balances risk with speed, value and trust. A governance system that only counts incidents and approvals will be seen as a brake. Reporting cycle time and realized benefits beside safety is how leaders show that governance is the way to adopt AI faster and better.

7. Start Now: A 12-Month Path

Leaders often wait for a perfect framework. The Handbook proposes a staged approach. In the first 30 days, issue a commitment memo, appoint the Director and Champions, charter the Council, run a shadow-AI amnesty that invites staff to list the tools they already use without penalty, and issue interim acceptable-use rules and red lines. By day 90, approve the first four policies, confirm the tiers and launch use-case intake, classification and AI literacy training. By month six, approve the remaining policies and operate impact assessment, ethics review, vendor due diligence and the KPI dashboard. Months seven to nine bring the first internal audit, an incident drill and a gap assessment against ISO/IEC 42001, and by month twelve leaders can decide on certification and publish a responsible-AI report.

Along the way, avoid the pitfalls I see most often: governance as paperwork (audit practice, not documents), a council with no authority, policy without training, ignoring shadow AI because the official route is slower than free tools, one-size-fits-all approvals, no monitoring after go-live, blind trust in vendors, and ethics as an afterthought instead of a design input.

8. Values Make the System Real

Rules cannot anticipate every situation, so the framework anchors decisions in principles (human agency, fairness, transparency, privacy and security, safety, accountability, wellbeing and lawfulness) and in values. At QPS we draw on Jain-inspired values: ahimsa (non-harm) shapes safety testing and red lines, satya (truth) shapes honest disclosure of limitations and incidents, aparigraha (taking only what is needed) shapes data minimization, anekantvada (many viewpoints) shapes diverse review teams, and seva (selfless service) reminds us that AI should serve customers, employees and communities. Any organization can substitute its own values; what matters is that decisions are rooted in values, not only in rules.

Own it. Include everyone. Separate the roles. Scale control to risk. Keep a human accountable. Measure and improve. Keep customers and humanity at the center.

Responsible AI is not achieved by a policy, a tool or a committee alone. It is achieved when leadership commitment, clear accountability, proportionate controls and continual improvement work together as one management system. The organizations that build that system now will not only avoid harm; they will move faster, earn trust and capture the value that still eludes most adopters.