Generative AI can draft reports, summarise claims, support investigations and help analysts explore data. It can also disclose confidential information, invent evidence, reproduce bias or create an unapproved decision pathway. Governance should therefore begin with permitted uses and data boundaries, not with a list of fashionable tools.
Define safe-use tiers
Separate public-information drafting, internal summarisation, controlled retrieval and decision-support use. Each tier needs different rules for confidential data, human review, retention, supplier terms and output use. Prohibit direct customer decisions unless the complete decision control framework has been approved.
Control prompts and sources
Record material prompts, retrieval sources, model version and output reviewer for regulated work. Test whether the system cites the correct source, distinguishes fact from inference and abstains when evidence is insufficient. Do not let a polished answer substitute for verification.
Monitor real use
Track rejected prompts, sensitive-data events, hallucination findings, override rates, complaints and usage outside approved applications. A quarterly policy attestation is not enough if the actual workflow changes weekly.
The NIST AI RMF provides a useful risk-management structure. Quantica Risk Modelling recommends treating generative AI as a controlled capability with an auditable evidence trail.