In short
AI governance means knowing, at any moment, who in the company uses which AI, on what data, with what permissions, and who checks what it produces. It is not a document or a label: it is a system you can measure. Before signing with anyone who sells it, a general manager or a Fractional Manager should ask 5 questions.
Key points
- 'AI Governance' is becoming a market category that more operators try to claim. The name says nothing about the system.
- In 2025 Deloitte Australia refunded part of an A$440,000 report full of citations invented by AI: nobody was checking the output.
- Operational AI governance = who uses which AI, on what data, with what permissions, who checks, and what you measure.
- Five questions separate a slogan from a system: metrics, permissions, the permissions chart, output control, shadow AI handling.
In recent months “AI Governance” has become a category in Italy. Some present themselves as the first to offer it as a service, some tie it to labour law, some place it next to cybersecurity. It is a good sign: companies have understood that AI is not simply bought, it is governed.
But there is a risk, and anyone who works as a Fractional Manager next to a general manager knows it well. When a word becomes fashionable, the word arrives before the system.
Being the first to name something does not mean knowing how to do it.
The Deloitte case: the name was there, the control was not
In July 2025 Deloitte Australia delivered a report to the Australian Ministry of Labour. It cost 440,000 Australian dollars and ran to 237 pages. A researcher at the University of Sydney read it and found citations that do not exist: a sentence attributed to a Federal Court ruling that was never handed down, and references to academic studies that do not exist.
In October Deloitte admitted it had used generative AI in drafting the report and agreed to return the final instalment of the contract.
This is not an improvised freelancer. It is one of the largest professional services firms in the world, which among other things sells expertise on AI risk and governance.
What was missing? Not a framework, and not a policy. The most basic thing was missing: someone to check what the AI had produced before signing it.
That is the difference between having the name and having the system.
What we really mean by AI governance
When a business owner or a Fractional Manager asks us on a call “what do you mean by AI governance?”, the answer is short.
AI governance is being able to answer five questions at any moment: who in the company uses AI, which tool or agent, on what data, with what permissions, and who checks what it produces. Plus a sixth that keeps the others alive: what do we measure to know whether it is working.
It is not a document you sign once. It is a map you keep updated, like an organisation chart. If you cannot open it and read it in 10 minutes, you do not have it.
Everything else (training, policy, AI Act compliance) is useful, but it comes after. We cover it in How to govern AI in an Italian SME: a system, not a tool.
The 5 questions to ask before signing
If a supplier proposes an “AI Governance” programme, for you or for a company you support, these are the questions that separate a slogan from a system.
| # | Question | Slogan answer | System answer |
|---|---|---|---|
| 1 | What do you measure about AI use? | ”We write a policy and run training” | Who uses which tool, how much, on which processes, with 30-day numbers |
| 2 | Which permissions do you grant? | ”We train everyone in responsible use” | Approved tools, and for each one the data allowed and the data excluded |
| 3 | What does the permissions chart look like? | ”IT takes care of it” | Levels by role: who uses, who builds agents and automations, who approves |
| 4 | Who checks the output before it leaves the company? | ”The models are reliable now” | A named person in charge, and a record of the check |
| 5 | What happens if someone uses an unapproved tool? | Silence, or “we ban it” | How you find out, how you bring it inside, who decides |
Question 4 is the Deloitte one. Question 5 is about shadow AI, which is already inside almost every SME.
If the answers you get look like the left-hand column, you are buying a label.
Why this matters for Fractional Managers
A Fractional Manager enters a company with a precise mandate and little time. If they bring in AI without a system of control, the risk is double: for the company, and for their own reputation.
The advantage of working part-time is the ability to leave behind systems that stay when you are gone. On AI, this means leaving the general manager a map of permissions and checks, not enthusiasm. It is the same reasoning as in Fractional Managers and AI: the asymmetric advantage.
In short
- The first to name AI governance is not necessarily the one who has it.
- The Deloitte case shows that without output control the name protects nobody.
- AI governance means knowing who uses which AI, on what data, with what permissions, who checks and what you measure.
- Five questions are enough to tell whether you are buying a system or a slogan.
If you want to ask these questions of yourself first, start from the AI Governance Diagnostic.
Sources and references
Frequently asked questions
What does 'AI Governance' really mean for an SME?
It means knowing who uses which AI tool, on what data, with what permissions, who checks the outputs and which numbers measure the use. If these answers are not written down and kept up to date, there is no governance. There is a policy in a drawer.
How do you tell a real AI governance system from a marketing label?
By the answers to operational questions: what do you measure, which permissions do you grant, what does the permissions chart look like, who checks the output before it goes out, what happens when someone uses an unapproved tool. A system answers with numbers and names; a slogan answers with documents and generic training.
What should a general manager or a Fractional Manager ask before signing an 'AI Governance' programme?
Five questions: what do you measure about AI use, which permissions do you grant, what does the permissions chart look like, who checks the output before it leaves the company, what happens if an employee uses an unapproved tool.