Someone in your organisation is about to be made responsible for AI. What have they been authorised to do?
Ethos Advisory helps boards and chief executives settle the decisions AI creates, and turn those decisions into arrangements management can own.
Boards do not govern AI as an abstract technology. They govern decisions about what AI may do and the conditions under which it may be used. Those decisions sit with the board and the chief executive, and they are not delegable, because delegating them is the thing being decided.
The moment this matters
Three situations bring it forward.
Capability is starting. A pilot has begun, an implementation is underway, or a role has been created with AI in its mandate.
Capability is scaling. AI is moving across teams, systems or locations, and what was manageable as an experiment now touches decisions that reach customers, staff or members.
Capability is being inherited. A new chief executive, operations lead or transformation leader is taking responsibility for AI that is already running, and is being asked to own arrangements they did not set.
In each case the same thing is happening. Authority is passing to someone before anyone has said what that authority covers.
The decisions that come first
An organisation can appoint a capable person, give them a budget and a mandate, and still have settled nothing. The questions that remain are not technical, and they cannot be answered by the person receiving the delegation.
- What is AI authorised to do in this organisation, and what is it not.
- Where do the boundaries sit, and who may move them.
- What evidence is required before a use goes ahead, and what evidence is required to keep it running.
- Where does human judgement remain decisive, regardless of what the system recommends.
- What must the board see, how often, and what triggers an escalation before the next scheduled report.
Answering these is the work. Until they are answered, an AI policy is a document rather than a control, because there is nothing behind it to enforce.
What the work covers
Scope is agreed at the outset and follows the organisation’s stage.
Direction
Where AI can create real operational, strategic or service value, and where the risks of adoption outweigh the benefit. Not every use case is worth pursuing, and an independent view on that is worth more than an enthusiastic one. This includes mapping what is already in use, since informal adoption at team level is often where the work has to start.
Value that is disconnected from the organisation’s purpose will not hold up to board or regulator scrutiny.
The mandate
The decisions above, settled and written down, in language a board can adopt and management can act on.
The arrangements
What follows from the mandate: accountability and decision rights, the policy and standards that give effect to them, an inventory of AI in use including third party systems, evidence and approval requirements, board reporting with defined triggers, and escalation paths when something goes wrong.
The sequence
A practical order of work, showing what must be settled before capability expands and what can follow behind it.
Not every engagement covers all four. An organisation that has already settled its direction may need only the mandate and the arrangements. One that is still deciding whether to proceed may need only the first.
What your organisation ends up with
Arrangements, not recommendations.
The deliverable is a set of documents the board adopts and management operates: the mandate itself, the accountability and decision rights that give effect to it, the policy, and the reporting and escalation structure. They are written for board ownership and for continued use, not as a report that is read once and filed.
Where the organisation has obligations that bear on AI use, including the Privacy Act 2020 and, for tertiary providers, NZQA requirements under iQAF, the arrangements are built to meet them rather than described alongside them.
Who does the work
Bruce Johnson does the work. Ethos Advisory is a principal led practice, and the person who scopes the engagement is the person in the working sessions and the person who drafts the arrangements.
The work is done with the board and the executive team rather than to them. Arrangements written for an organisation that has not been part of settling them do not survive contact with the first difficult decision.
Why independent advice matters
Ethos Advisory sells no AI tools, platforms, or implementation services. Independent advisory and assurance work paid for by the client is the whole of the practice, which means recommendations are shaped entirely by your organisation’s interests, not by a vendor relationship or implementation revenue.
That matters more at this point than at any other. The people best placed to advise on introducing AI capability are frequently the people selling it, and the advice a vendor gives about the boundaries of their own product is not advice a board can rely on.
One consequence follows and is stated plainly. Where Ethos designs an organisation’s AI governance arrangements, it does not later provide independent assurance that those arrangements are operating. The criteria would be criteria Ethos chose. A client who needs both must take them from different providers, and that choice is better made at the outset than discovered later.
Who this is for
Organisations introducing AI capability, scaling it beyond its first use, or handing responsibility for it to someone new.
Typically this is a chief executive who has been asked to deliver AI capability and wants the authority settled before delegating it, a board or chair who has approved a direction and wants to know what they have actually authorised, or an incoming executive who has inherited AI running under arrangements nobody wrote down.
Where AI is already operating and nobody is certain what exists, an AI Governance Readiness review establishes the current position first. Where arrangements are already in place and the question is whether they are working, an AI Governance Assurance review is the better fit.
If someone in your organisation is about to be made responsible for AI, the authority is worth settling first.