AI Requires Clear Accountability and a Reliable Framework
AI supports employees in their day-to-day work, taps into knowledge, and is increasingly taking on tasks within business processes. As a result, the demands for its responsible use are also growing. Who decides which applications are permitted? What data are agents allowed to access? And who bears responsibility for the results and costs? This was precisely the focus of our webinar “AI Governance: Law, Organization & Technology for Secure AI” on October 29, 2026. Ralf Angermann, Fabienne Bouffé, and Jan Niederhauser demonstrated how companies combine organizational guidelines with technical controls.
Shadow AI Highlights the Need for Action Within the Company
Many employees already use AI in their daily work. Often, they also use personal tools and accounts for this purpose. The live survey conducted during the webinar showed that this practice is also widespread among the participants. At the same time, governance guidelines were sometimes nonexistent or unknown. For companies, this creates a gap between the defined rules and actual day-to-day work. The first step, therefore, is to create transparency: Which applications are being used, what data do they process, and what approved alternatives are available to employees?
AI governance is a management responsibility
Senior management determines the company’s AI objectives, the risks it is willing to take, and what uses are permitted. Business units are responsible for their use cases and the benefits they deliver. IT and security implement technical controls and monitor operations. Employees, in turn, must critically evaluate results and comply with internal guidelines. Fabienne Bouffé made it clear that these responsibilities must be clearly defined across all levels. This includes transparent decision-making, defined responsibilities, and a shared understanding of when human oversight is required.
“It is important to consider governance from the very beginning and not to establish it as an afterthought.”
Ralf Angermann
Head of AI Solutions
People, processes, policies, and technology work together
The AI Governance Operating Model presented in the webinar encompasses four perspectives: People, Process, Policy, and Technology. People need clear roles and the appropriate skills. Processes govern how new use cases are submitted, evaluated, and approved. Internal policies define permitted use and the handling of data. Technology implements these requirements through identities, permissions, data protection, and monitoring. The model is effective when all four perspectives are integrated and the rules are understandable and actionable in day-to-day work.
The specific use case determines the review
A governance review begins with the purpose of the application. What data is being processed? Are individuals affected by the results? What consequences could an incorrect answer or an unintended action have? In the webinar, this was illustrated using the example of a customer service agent who reviews inquiries and drafts responses. Among other things, the responsibility for the application, the permitted data sources, and the review process before sending must be clarified. A documented purpose, a designated owner, data authorization, and a risk assessment form the basis for controlled use.
Legal requirements must align with the use case
Which legal requirements are relevant depends on the specific use case and its area of application. The webinar provided an overview of Swiss legal foundations, potential requirements related to the EU, and international frameworks. For companies, this means incorporating legal issues into the assessment early on and clarifying their applicability in each individual case. Frameworks such as the OECD AI Principles, ISO/IEC 42001, and the NIST AI Risk Management Framework can provide guidance for systematically establishing responsibilities, risk assessments, and governance processes.
AI expertise is developed through continuous learning
For employees to use AI responsibly, they need to understand the technology’s capabilities and limitations. This includes handling sensitive data securely, being familiar with approved tools, and being able to critically evaluate results. Power users and AI champions can deepen and share this knowledge within their teams. Managers and business owners also need the understanding to assess risks and take responsibility for approvals. Regular training and the sharing of concrete experiences help keep pace with rapid developments.
Governance supports the entire lifecycle
AI governance must evolve alongside applications and their operating conditions. The process outlined here consists of five steps: Discover, Assess, Govern, Protect, and Monitor. Companies first identify applications and ideas, assess risks, define rules, and implement protective measures. During operation, they monitor usage, costs, risks, and changes. The insights gained are then fed back into the assessment and management processes. This ensures that governance remains effective even when new data sources are added, agents take on additional tasks, or requirements change.
Secure alternatives help combat shadow AI
Anyone who wants to curb the use of private AI tools must also understand the needs of employees. They are often looking for a quick and easy way to complete their tasks. Companies should therefore provide approved applications, explain their benefits, and support teams during the implementation process. In addition, technical controls can limit the use of unauthorized applications or data flows. In the webinar, Jan Niederhauser demonstrated how important this synergy is: Clear guidelines, suitable alternatives, and transparent approval processes make it easier for employees to work within the intended framework.
“We don’t believe that simply banning things can be the answer.”
Jan Niederhauser
Copilot Lead & Consultant
Data Access and Permissions Take Center Stage
AI can find and consolidate information quickly. This makes overly broad permissions particularly relevant. Data that was previously difficult to find can suddenly appear in search results. Companies should therefore review who is allowed to access which content and how sensitive information is classified and protected. Within the Microsoft ecosystem, Microsoft 365 permissions, Entra, Purview, and Defender, among other tools, work together to support this. They help control access, protect data, and ensure transparency in usage.
AI agents need an owner and clear rules
As the number of agents grows, so does the need for a centralized overview. Companies need to know which agents are in use, who is responsible for them, and what data or actions have been approved for them. Reliable support is especially important for applications that support entire teams or business-critical processes. In the webinar, Jan Niederhauser provided insights into administration in the Microsoft environment and explained the role of Agent 365. The discussion focused on transparency regarding inventory, ownership, usage, and risks, as well as rules for authorization and operation.
Usage-based costs require clear budgets
In addition to security and data protection, cost management is also part of AI governance. While traditional licenses are easy to plan for, agents incur additional costs based on actual usage. Depending on the task, multiple processing steps, data queries, and actions may be involved. Companies should therefore determine who is responsible for budgets and at what level they will monitor usage. This includes setting appropriate limits and alerts for applications, teams, or individual users. This allows them to assess an agent’s value in relation to its running costs.
Three Questions for the Next Executive Meeting
At the conclusion of the technical section, three specific questions remained: Who is authorized to build and share agents within our organization? Who is responsible for AI costs, and what are the limits? Do we know which agents and AI applications are already in use today? These questions provide a tangible starting point for assessing your organization’s current status. They highlight where decisions are missing, where responsibilities need to be clarified, or where additional transparency is required. From this, prioritized actions for the organization and IT can be derived.
AI governance lays the foundation for secure scaling
The webinar demonstrated how closely responsibility, risk assessment, and technical implementation are interlinked. Clear roles, understandable guidelines, and ongoing training provide direction. Technical controls support compliance and provide evidence for operations. With the Online (AI) Governance Service, we help companies establish standards, manage deviations, and regularly review their Microsoft 365 environment. Want to know where your company stands? Together, we’ll map out the next steps for the secure and responsible use of AI.
Do you have specific questions or use cases you’d like to discuss in more detail?
Our experts are happy to provide advice and assistance.
