Boards are increasingly being told that their AI governance should be proportionate. Scaled to the risk the organisation carries, rather than a compliance programme built for organisations that look nothing like theirs.
This is good advice and I give a version of it myself. It is also an easy word to use when what you really mean is that you want to do less governance.
Start with what doesn’t scale
Whatever the size of the organisation, four questions must be answerable.
- Who is answerable when this system is wrong? Wha
- What decisions has the organisation determined AI may not make on its own?
- Does anyone know what AI is being used for, as opposed to what was approved?
- What would have to happen for us to switch it off, and who has the authority to do that?
Be precise about the claim, because it is easy to overstate. The apparatus required to answer those questions scales enormously. Answering the third at an eight hundred person organisation may mean an inventory, a discovery capability, and some way of detecting use that was never approved. At a three person organisation it means asking the other two people.
That is what proportionality is for.
The obligation to answer is what stays fixed. Neither organisation gets to leave one of the questions unanswered because of its size.
What proportionality is for
Assessment depth should be proportionate. So should control intensity, documentation burden, review frequency and testing rigour. Requiring otherwise produces theatre rather than rigour.
A small charity using Copilot to tidy up non sensitive internal meeting notes does not need the control environment of a lender running credit decisioning models. Making it build one teaches the organisation that governance is something done to it rather than something it does, which is about the worst outcome you could get.
But there is no lighter version of knowing who is answerable. The way accountability is recorded may scale. The need to assign it does not.
For a lot of small New Zealand organisations, the real problem is not that their AI governance lacks rigour. It is that they have none. Every additional expectation makes starting harder, and an argument that sets the bar too high can produce less governance than one that says start with an acceptable use policy and a list of what you’re using.
That seems right about sequencing and wrong about the floor.
Starting small is correct. But the four questions above are not the advanced module. They are cheaper to answer than the policy is to write. An organisation that has a policy and an inventory but cannot say who is answerable has bought the artefacts and skipped the governance. It has probably spent more doing so than it would have spent getting the order right.
Where the trimming tends to land
The NIST AI Risk Management Framework has four functions: Govern, Map, Measure and Manage. All four can be implemented proportionately.
Govern is the one I would watch most closely.
The other functions tend to produce things you can see: a map of where AI is being used, evidence about risk, controls and responses. Governance is more likely to show up as authority, accountability and decision rights. Those are less visible, and where budgets and attention follow tangible deliverables, they are easier to defer without anything obviously appearing to be missing.
That is an argument from incentives, not a survey finding.
ISO/IEC 42001 makes a related point through its leadership requirements. Top management carries responsibilities around establishing the AI policy and assigning organisational roles, responsibilities and authorities. How an organisation gives effect to those requirements can scale considerably. The need to establish them does not disappear because the organisation is small.
Show me the tailoring rationale
“Tailored” is a legitimate discipline, and an excellent euphemism.
A framework tailored by the people who will subsequently deliver against it can easily end up reflecting what those people were already equipped to do. That is not necessarily a criticism of them. It is simply a reason to look at the choices that were made.
Which is why “is our approach proportionate?” is not a particularly useful board question. Everyone answers yes.
A better one is “show me the tailoring rationale”.
What was taken out of the reference framework, on what basis, and who decided? What was added? A New Zealand organisation working from an international framework has local obligations the framework does not specify, from the Privacy Act 2020 through to sector specific obligations. Tailoring that only ever subtracts isn’t tailoring.
That does not make every tailoring choice a board decision. But where tailoring leaves a material risk accepted, the board should be able to see what was adopted, what was deferred and why.
At a small organisation the rationale might be a paragraph in the minutes e.g. we considered this framework, adopted these parts, deferred those, review in twelve months. At a large one it might be a proper document. The form scales.
And when the answer comes back “it wasn’t proportionate to our risk”, the follow up matters more than anything else in this piece.
Proportionate to the risk, or proportionate to the budget?
Those are different answers. If the real constraint is budget, say so. Do not rename a resource decision as a risk judgement.
Deferred is not the same as declined
You do not need to build everything at once. Very few organisations should try, and the ones that do usually produce a binder instead of a capability.
But deferring something and not doing it look identical from the outside unless somebody wrote down which one happened. If your AI governance has been right sized, the board should be able to see what was deferred, who decided, what risk that acceptance carries, and when it comes back for review.
The more benign possibility is that the record already exists. It was made carefully, by people who thought hard about it, and it never travelled up to the board because the tailoring happened at management level and the board was shown the finished framework rather than the reasoning behind it.
That is a reporting gap, and it takes one question at one meeting to close.
Worth asking, though.
If nobody can explain what was left out and why, the board has no way of knowing whether the framework was tailored or simply made smaller.