Your AI governance program is a policy. It should be a practice.

Oscar Núñez, Deputy General Counsel & Director of LATAM Markets, TECfusions, Inc., discusses the difference between the document your board approved and the workflow that would survive a Rule 11 motion.

Most in-house counsel I speak with describe their “AI governance program” as an approved-tool list, a use policy, a training slide deck, and a review board that meets quarterly. This is not governance. This is inventory management with a legal veneer. When the first sanctions motion arrives, the veneer will not hold.

The test is simple. If you cannot name who signed the last AI-assisted output your team produced, for a specific matter with a specific reviewer, you do not yet have a governance program. You have documentation of aspiration.

The gap between the policy binder and the actual practice is where liability accrues, and where the audit trail turns out to be a folder of screenshots. Governance is not what the department wrote down in Q1. Governance is what the department did on Tuesday.

What separates a policy from a practice.

Four characteristics turn language into law.

Explicit stages. Every AI-assisted workflow moves through the same sequence: Frame (scope, sources, reviewer, tier), Analysis (the model produces), Challenge (adversarial verification), Approval (recorded human sign-off), Learn (log to the matter file). Skipping stages without a trace is what “informal use” actually means.

Assigned authority. Every output falls into a tier that specifies who can sign. Filings and executed contracts need GC sign-off. Core opinion work product and active criminal defence are not automatable at all. The tiers are the operating model’s spine.

Generated evidence. The workflow produces its own record (prompt, sources, output, reviewer, decision, timestamp) as an artifact of the workflow, not compliance overhead added later. If the record does not generate itself, it will not exist when you need it.

Durable cadence. The operating model must survive its first year. That means a monthly retrospective, a quarterly board report, an annual policy refresh, and named counsel accountable at each level. Programs that budget only for the pilot become approved-tool lists nobody enforces by day thirty-two.

Without those four, “AI governance” is aspirational language. The duties it exists to enforce cannot survive contact with a real matter.

“Governance is not what the department wrote down in Q1. Governance is what the department did on Tuesday.”

The day-31 problem.

Most AI governance programs die on day 31 of a 30-day pilot. Political capital evaporates, and the operating model decays back into an approved-tool list nobody enforces. The failure is not the pilot’s. It is the design’s. A thirty-day pilot does not generate a practice; it generates a proof of concept dressed up as a plan.

The programs that survive treat day 31 not as the end of the pilot but as the beginning of the practice. They install the operational rhythm before they announce the impressive part.

Governance is what you can instruct the model to do.

The AI era differs from prior compliance regimes in one respect: governance now means both policies that humans follow and instructions that the model follows.

If your policy requires counsel sign-off on filings, the model should prepend those outputs with “COUNSEL SIGN-OFF REQUIRED.” If it requires citations for every legal conclusion, the model should refuse to state one without a source. Instructions to the model are how the policy reaches the work.

Compliance is what the record can prove.

Compliance is not a separate function. It is what the governance produces. If your workflow generates a stage-by-stage log (prompt, sources, output, reviewer, decision, timestamp) you have a compliance program. If it does not, you have a document that says you have one.

Regulators are moving in the same direction. The EU AI Act’s high-risk framework – record-keeping, transparency, human oversight, accuracy – asks for properties of the workflow, not of the tool. U.S. state bar guidance measures lawyer AI use by what counsel can defend, not by what the vendor claimed.

The record is the compliance. The policy that says the record will exist is not.

The GC’s actual job.

The AI-era GC’s job is not to choose the model. It is to choose the governance around it. Tools will change. Vendors will consolidate. What will not change is the requirement to name who signed and what evidence supports the reliance. If your program cannot answer those questions about last week’s work, that is the first thing to fix, before any conversation about vendors or use cases. Governance is not a document. It is a practice with a signature.

Related Publications