Interactive explainer
What AI governance looks like in practice
AI governance in practice is a run of ordinary decisions, made on time by a named person and recorded as they happen. AI in use is found, owned, assessed, held to rules on live traffic and brought back for review when production shows something has changed.
A month in an AI estate
Step through the days that matter in one month. A new agent is found, assessed, put behind your rules, caught calling a tool it never declared and pulled back, while the governance history fills underneath. Use Next and Previous, the marked days, or the arrow keys.
A discovery scan runs across five connected sources, and GitHub reports collections-assistant, a code repository that calls an AI model. It waits in the queue until a person decides what it is.
A sealed, timestamped history of governance decisions and enforcement actions.
Every part of Aicura adds to it as work happens, and nothing is filed by hand. Each block and redaction at the gateway is its own entry, and allowed traffic is rolled into one entry a day. Discovery runs, red-team runs, assessments, approvals and rule changes sit alongside. Evidence packs are generated from this history. Board reports, the Trust Centre and other reports are built from your register, assessments and rules as they stand today, and each one published is added here too.
The month in writing
Every step in the timeline above, in order. The estate and its names are illustrative.
- Day 1
Discovery finds an agent nobody registered
A discovery scan runs across five connected sources, and GitHub reports collections-assistant, a code repository that calls an AI model. It waits in the queue until a person decides what it is.
AI register
- Day 2
It joins the register and is assessed
A person picks Add as agent. It enters the AI register at v1 with two declared tools, and its risk assessment comes back High with 13 risk items.
AI register · Assessments
- Day 3
Its controls become rules at the gateway
Suggested controls become rules, published as signed guardrail set v10 and deployed to the gateway in your network, which now carries the agent’s traffic.
Guardrails and gateway
- Day 6
A significant change saves a new version
The Collections team changes what data the agent uses. Saving the change creates v2 in the register, and the risk assessment runs again on its own.
AI register · Assessments
- Day 7
A release is checked before it ships
Before releasing a new build of the Claims summariser, the release pipeline asks Aicura whether it may go ahead. The check before deploy answers Allowed with warnings.
Guardrails and gateway
- Day 10
The agent reaches for a tool it never declared
The agent starts calling propose_payment_plan, a tool it never declared. The gateway blocks each attempt, and calls to undeclared tools make up 22% of its calls for the week.
Guardrails and gateway
- Day 11
Every block adds to the history
The calls keep coming. Every block is its own entry in the history, and the share of calls to undeclared tools climbs to 41%, close to its limit of 50%.
Guardrails and gateway · Monitoring and automatic responses
- Day 12
A limit is crossed and a response waits for approval
That share reaches 60% and an alert opens. Aicura proposes pulling the agent back, and because you set this response to need approval, it waits for the owner.
Guardrails and gateway · Monitoring and automatic responses
- Day 13
The owner approves and the agent is pulled back
The Head of Collections approves. Pulling the agent back saves v3, the change re-runs its risk assessment, and guardrail set v11 deploys to the gateway.
Monitoring and automatic responses · Assessments · Guardrails and gateway
- Day 19
A budget runs out
Microsoft 365 Copilot reaches its daily token budget, and the gateway refuses further requests until the period resets. Each refusal is added to the governance history.
Guardrails and gateway
- Day 30
The board report is drafted from the record
Aicura drafts the quarterly board report from your register, assessments and rules as they stand today. The author edits and finalises it, and the finalised report is added to the history.
Reporting
What AI governance looks like day to day
Most writing about AI governance describes frameworks, committees and principles. Those matter, but they are not what the work looks like on an ordinary Tuesday. In practice it is a series of small decisions, each made by a named person and each leaving a trace. The month above follows one agent through that cycle in an illustrative estate.
The cycle the month follows
- Find it. AI arrives two ways. Staff ask for it, or it turns up already in use. Discovery reads the sources you connect and proposes what it finds, and a person decides whether each find joins the register.
- Own it. Every system in the register has a designated owner, an accountable executive and a technical contact, and every version of it is kept. A significant change, such as a new model or new data, saves a new version, and the assessments that depend on it run again.
- Assess it. A risk assessment gives an overall rating, risk items and suggested controls. It informs your judgement and approves nothing.
- Enforce it. Controls that can be enforced become rules, published as signed versions and deployed to a gateway in your network. A rule acts on live traffic, so a policy becomes something that happens rather than something written down.
- Watch it. Measurements from production, such as undeclared tool use, spend and blocked calls, are held against limits you set. When a limit is crossed an alert opens, and any automatic response acts only as far as you allowed.
- Report it. The board report is drafted from the register, assessments and rules as they stand, and a person edits and finalises it.
Why the quiet days matter
Most days in the month are skipped in the timeline because nothing needed a decision. The gateway still allowed, redacted and blocked traffic on every one of them, and each block and redaction was added to the history. Good governance is mostly quiet. The significant days are the ones that call for a person, and the record of the quiet ones is what shows the controls were working all along.
What to take from the month
- Ownership comes before assessment. A system nobody owns cannot be assessed meaningfully, because nobody can answer for its purpose or accept its risks.
- Assessments go stale. The agent was assessed three times in two weeks, each time because something significant changed. A rating from launch day says little about the system running today.
- Approval points are a design choice. Pulling the agent back waited for the Head of Collections because the team set that response to need approval. Decide in advance which actions need a person. The guide to human oversight of AI covers how.
- The board report should be a by-product. If it takes weeks to assemble, the record underneath it is missing. The guide to AI governance board reporting sets out what directors need.
To see where your own organisation stands, the guide to assessing your AI governance maturity sets out the method. If you are comparing tools, the guide to evaluating an AI governance platform lists the questions worth asking.
How Aicura works
Aicura finds the AI you run, assesses it, enforces your rules on live traffic and reports on all of it, with a sealed history of the work underneath.
AI register
Every AI system and agent you run, found by discovery or asked for by staff. Each has a named owner, and every significant change, such as a new model, saves a new version.
Assessments
Risk assessments give each version an overall rating, risk items and suggested controls. Impact assessments set out who is affected and how. Both are guidance for your judgement.
Guardrails and gateway
Rules built from the register, assessments and permissions are signed and deployed to a gateway in your network that allows, redacts or blocks.
Monitoring and automatic responses
Alerts, targets and automatic responses that act only as far as you allow. A response can re-run the risk or impact assessment, so what happens in production feeds back into the rating.
Reporting
Board reports, the Trust Centre and the report catalogue, built from your register, assessments and rules as they stand today. Evidence packs are generated from the history.
The history. Governance decisions and enforcement actions are snapped into a sealed, timestamped history as the work happens. Nobody files anything by hand.
The register, discovery and system and agent reports are in the free Register plan. Risk assessments and guardrail authoring start at Essentials. Impact assessments, monitoring, enforcement on live traffic, board reports, the Trust Centre and the history start at Pro. Compare plans
Questions
What does AI governance look like in practice?
It looks like a run of small decisions, each made by a named person and recorded as it happens. AI in use is found and registered with an owner, each system is assessed, controls that can be enforced become rules on live traffic, data from production is checked against limits, and reports are drafted from that record. Most days are quiet. The significant ones are where a decision is needed.
How often should an AI system be reassessed?
Whenever something significant changes, and on a regular schedule otherwise. In Aicura, saving a significant change to a system in the register creates a new version and re-runs the assessments that depend on it, and the cadence view shows how long ago each piece of governance work was last done for each system.
Does a person have to approve every governance action?
No. Deciding which actions need a person is part of the design. Aicura's automatic responses run at an autonomy level your team sets for each condition, from Off and Tell me through Act with approval and Act and notify to Just do it. In the month on this page, pulling the agent back waited for its owner because the team chose approval for that response.
Is the estate on this page real?
No. The organisation, its systems, people and figures are illustrative. The behaviour shown, from the discovery queue to the gateway blocking an undeclared tool and the board report being drafted from the record, is how Aicura works.
Run your own month on Aicura
Create a free account, connect a discovery source and register what it finds. Assessments, guardrails and monitoring build on the same entries when you are ready.