Most organizations will tell you they have AI governance. There's a policy. Employees are trained. Boxes are checked.
We suggest starting with asking some clarifying questions: "Can you identify every AI system your organization relies on today, what it does, what context it generates its answers from, who is accountable for it, and what business process it supports?"
For many organizations, that's where the conversation stops.
That gap is the whole problem. A policy says what people are supposed to do. It says nothing about what's actually running, or who's accountable when it gets something wrong. Policies are written top-down; AI adoption happens at the edges, faster than any committee can track it without a clear operational framework. The policy lives in a document. AI lives in thousands of everyday decisions.
This is also why data governance and AI governance get confused. Data governance asks whether your data is trustworthy. AI governance asks whether the decisions made with that data are trustworthy. You can have perfectly clean data feeding a model that still produces an unexplainable result. Different job entirely.
Which is why governance has to start with something more basic than a policy: an inventory. You can't assess risk on a system you don't know exists, assign accountability for a decision no one registered, or answer a regulator's "where did this come from" with "we're not sure." Inventory is phase zero, skip it, and everything else is governing a fiction of your AI footprint.
The foundation of AI governance isn't only an inventory of AI systems. It's an inventory of context. AI models will change. New applications will be deployed. Vendors will come and go. The one constant that will persist is the context your organization provides and that your AI relies on. Policies, procedures, glossaries, role definitions, business rules, approved documents, workflows, and institutional knowledge are the assets that shape AI behavior. If you don't know what context is connected to each AI initiative, who owns it, or where it's being used, you can't effectively govern the AI built on top of it.
And it's not a one-time project. Systems drift. Approved for one use case, quietly applied to another. Context that was accurate at launch could be stale six months later. The inventory has to evolve as fast as the AI does, which is the real difference between AI adoption and AI infrastructure. Most companies have invested heavily in the first and almost nothing in the second.
None of this requires a mature program or enterprise budget. A two-person startup and a Fortune 500 company face the same starting line: know what you have before you try to control it.
You can't govern what you can't see.