How to govern AI for a mid-size organisation

The thing we see people struggling with is not physically getting access to a ChatGPT account. It is much more about how you allow parts of the organization to innovate and build skills, like playbooks for orchestrating processes that touch different parts of the company.

How do you make sure they do not get blocked by their access to connectors? If you are tech-forward and your stack is basically Notion, Linear, and modern web tools, it is pretty straightforward for an employee to get autonomous access. However, it becomes much harder when you have a more complicated stack.

For example, if you have a Microsoft stack, it might be quite difficult to plug into the right APIs via MCP. The Claude default connectors do not allow you to write emails today, so you would need a custom connector if you want to connect to your Outlook outbox. Even if you just have custom software, it is really difficult to figure out how to do that.

The other big governance issue is ensuring people do not interpret AI enablement as an invitation to build tons of random apps and dashboards, expecting IT to deploy them.

Setting a clear strategy is essential:

• Apps should only be for really high-volume use cases.
• For most things, manage tasks using a combination of skills that can contain code, perform deterministic actions, and run on end workstations using user permissions.
• Maintain appropriate governance over those skills, including the ability for central teams to risk-manage, scan, and approve them.
• Allow teams a degree of autonomy in building these skills.

Otherwise, your small IT team will become the bottleneck for administering and security-assessing both skills and connectors, which is not healthy.

Harriet brings together a unified AI platform, a deployment team and a strategy so that your company becomes AI-native.