Your company has an AI policy. It is a PDF, it was reviewed by legal, and it lives on the intranet next to the travel policy. Ask a room of employees what it says and you will get polite silence. The policy is real. The governance is not.
Here’s the thing. A control that lives in a document is a suggestion. People do not read it, or they read it once and forget, or they read it and decide their situation is the exception. Every one of those becomes a workaround, and every workaround becomes more shadow AI. The fix is not a better memo. The fix is governance that works even when nobody remembers the memo.
Put practical AI governance into the approved path
One page, and it says what people can do. Most AI policies are a list of prohibitions. That is useless to someone with a deadline, because it does not tell them what to do instead. Flip it. Here is the approved tool. Here is what is fine to put in it. Here is what is not, and here is who to ask. Plain English, and short enough that Karen in accounting can read it while her coffee brews.
Make the sanctioned path easier than the workaround. This is the whole game. If the approved tool needs an extra login and the consumer tool does not, the workaround becomes more attractive, even when the policy says otherwise. Governance that ignores convenience is governance that gets bypassed. So the approved path has to be the fast path, or at least not the slow one.
Put the control where AI touches the system. Think of it like a building. You do not keep people out of the server room with a sign in the lobby. You put a lock on the server room door. AI works the same way. The control belongs at the connection point, where the AI reads from or writes to a real system, not in a paragraph on the intranet. The system can apply the rule at that point. Test that the control works, and monitor the paths it covers.
Human approval only for the actions that matter. The instinct is to require sign-off on everything. That produces a person who clicks “approve” all day without reading, which is worse than no approval at all, because now you believe you have a control. Use your risk policy to choose the human steps, starting with actions that move money, change access, or leave the company. Let approved low-stakes work flow.
Log it so an audit is a report you run. When someone asks “what did the AI do last quarter,” the answer should be a query, not an archaeology project. Every connection, every action, every approval, written down as it happens. That log is also how you find out the policy is working, which is a nicer way to learn than the alternative.
The key thing is that none of this requires people to be more careful. It requires the system to be built so that the careful path is the default. That is what governance people follow looks like: they do not notice they are following it.
Practical next step: read your current AI policy and count the sentences that tell someone what they can do. If the answer is close to zero, rewrite the first page to lead with the approved path. Then find one place where AI connects to a real system and ask whether the rule lives there, or only in the PDF.
Where Ovatio fits
Ovatio Comply puts configured policy checks into supported AI connections routed through it, with recorded decisions and human approval where required.