AI Governance
Building an AI Governance Framework from Scratch: A Public Sector Case Study
The Problem
A government department with 8,500 employees had 23 individual teams experimenting with AI tools — generative AI assistants, document classification models, forecasting tools — with no central visibility, no governance framework, and no consistent standards. A ministerial review identified this as a significant risk: data handling inconsistencies, no AI accountability structure, and inability to respond to public questions about AI use.
The Approach
The AI Maturity Model assessment revealed a score of 31/100 (AI Explorer) with governance and risk as the lowest-scoring dimension (18%). A 90-day governance sprint was launched using the AI Governance Framework playbook as the primary methodology. Key workstreams: (1) Discovery — catalogued all 23 existing AI uses across the department. (2) Policy — drafted the departmental AI Policy using the AI Policy Writing playbook and template. (3) Risk classification — applied the Risk Classification Tool to all 23 existing uses; 4 were classified HIGH risk and 2 CRITICAL — both CRITICAL cases were paused pending ethics review. (4) Governance structure — established an AI Governance Board with representation from Legal, Digital, Operations, and a permanent Secretary chair. (5) Intake process — implemented the AI Use Case Intake process for all future AI initiatives.
Results
AI uses governed
Before
0 of 23
After
23 of 23
Time to policy approval
Before
No policy
After
90 days
New AI proposals (60 days post-launch)
Before
0 formal process
After
11 proposals
The Outcome
All 23 existing AI uses documented and governed within 90 days. 2 CRITICAL risk cases paused and placed into formal ethics review. AI policy approved by the Minister. New intake process: 11 new AI proposals submitted in first 60 days post-launch. The department was cited positively in a parliamentary select committee as a model for responsible AI in government.
Key Lessons
- 1
Discovery before governance. You cannot govern what you cannot see. The 2-week discovery sprint — simply finding all the AI tools in use — was the most important step.
- 2
The governance framework needed to be seen as an enabler, not a blocker. Framing it as "we want to enable good AI, not stop it" was critical for adoption. The speed of the new intake process (5 days to get a governance decision on new proposals) helped enormously.
- 3
Pausing the CRITICAL cases publicly demonstrated the framework had teeth — which in turn increased trust in the governance board.
Playbooks & Tools Used