--- name: review-ai-governance description: A practical check of who can buy AI, what data it can touch, and whether anyone would know if a tool went wrong. license: MIT metadata: author: The Revenue AI Report version: 1.0.0 last-reviewed: 2026-09-04 source: https://www.therevenueaireport.com/skills/review-ai-governance --- # Review AI Governance A practical check of who can buy AI, what data it can touch, and whether anyone would know if a tool went wrong. ## When to use this skill - When AI tools are spreading faster than any policy. - After a customer complaint or a data scare involving an AI tool. - Before the board asks what your AI governance looks like. ## Inputs to collect - A list of AI tools currently in use, sanctioned or not - Your current approval process, if any - Any data-handling rules that already exist ## Process 1. Inventory what is in use, including expensed and free tools. 2. Name the exposure points: data in, output out, money spent. 3. Write the minimum policy: approval, data access, output review, kill process. 4. Assign one owner. Governance without an owner is a document. 5. Review quarterly. Tools change faster than annual policies. ## Decision rules - Any tool touching customer data goes through review, no exceptions for free tiers. - Customer-facing AI output needs a named human reviewer until it has earned trust with logs. - A tool nobody will own gets shut off. ## Output requirements - The three biggest exposures, named. - Minimum viable policy in four parts. - A method for finding unknown tools. ## Quality checks - The policy fits your company size. - One owner is named. - The inventory method finds unsanctioned tools, not just licensed ones. ## Limitations - Policy does not equal behavior. Budget for the conversation, not just the document. - This is operational governance, not legal advice. Regulated industries need counsel. ## Example input 14 AI tools in use across sales and marketing, 5 expensed individually. No approval process. Reps paste CRM notes into free chat tools. ## Example output Exposures: customer data flowing into free tools with no data terms, unreviewed customer-facing output, and spend nobody owns. Minimum policy: all tools touching customer data approved by the RevOps lead; a provided, approved assistant so reps stop using free ones; human review on outbound AI content; a kill process any leader can trigger. Find unknown tools quarterly via expense reports and a two-question team survey. ## Review checklist - Owner named? - Free-tier tools covered by the policy? - Quarterly review scheduled? ## Works with - Playbook: Get shadow AI into the light (L3) (org, L3) https://www.therevenueaireport.com/playbooks/get-shadow-ai-into-the-light-l3 - Playbook: The agent control plane (L4) (revops, L4) https://www.therevenueaireport.com/playbooks/agent-control-plane-l4 - Playbook: Company operating policy rebuilt for agents (L6) (general, L6) https://www.therevenueaireport.com/playbooks/agent-operating-policy-rebuild-l6 - Tool: Viable (AI Agents & Workflow) https://www.therevenueaireport.com/tools/viable - Tool: Structured (Data & Analytics) https://www.therevenueaireport.com/tools/structured - Tool: Alation (Data & Analytics) https://www.therevenueaireport.com/tools/alation - Tool: Ataccama ONE (Data & Analytics) https://www.therevenueaireport.com/tools/ataccama-one - Tool: Metabase (Data & Analytics) https://www.therevenueaireport.com/tools/metabase ## Rules of conduct - Write for a Director, VP, or operator. Short sentences. Explain uncommon terms. - Separate facts from assumptions. Never hide uncertainty. - Do not invent numbers, benchmarks, quotes, or customer names. - Do not send messages, change CRM records, or publish anything unless the user explicitly asks. - Flag when a decision needs human review. ## Evidence This skill is grounded in The Revenue AI Report research: - https://www.therevenueaireport.com/research/trust - https://www.therevenueaireport.com/research/rollback - Related analysis: https://www.therevenueaireport.com/blog/ai-sdr-kill-criteria-before-you-sign Source and updates: https://www.therevenueaireport.com/skills/review-ai-governance