Can organizational governance be both a creative act and a force multiplier? When it comes to AI in the enterprise, it has to be both.

There’s an old and oft-cited saying that applies to AI governance: “If you want to go fast, go alone; if you want to go far, go together.”

The Larridin State of Enterprise AI 2026 report shows this saying in action:

• Enterprises are finding that roughly half of their AI usage is unsanctioned, “shadow” AI. This isn’t subversion or defiance; it’s individual employees seeking to go faster, and more effectively, in their work by “going alone” as they experiment with new AI tools.
• But the #1 predictor of ROI success in the enterprise? The existence of an organization-wide framework allows people to “go together” with solutions that prove their value, and that can be scaled across departments and job functions.

Allowing, or even encouraging, your employees to experiment with new AI tools allows for creative expression. Not all the experiments will work, but the ones that do will drive the AI transformation effort forward.

While pulling together an AI governance strategy, getting agreement on it, and sharing it with your teams is where the force multiplier part comes in. Scaling successful experiments into new ways of people getting their work done, across your organization, only happens effectively with a governance framework in place.

This Workbook brings the AI Governance Guide to life. It has three parts, working together to help you create and implement governance for your organization:

1. The Enterprise AI Governance Checklist helps you make sure that you have all the pieces you need for an effective framework.
2. How to Govern Effective AI in the Enterprise shows how to treat AI agents as if they were employees, describes when it’s effective to do so - and when it’s best not to.
3. The AI ROI KPIs piece shows how to add AI and agentic AI into your existing key performance indicator (KPI), management by objectives (MBO), or similar people management framework.

Figure 1 shows barriers to effective AI adoption in the workplace, from the Larridin State of Enterprise AI 2026 report. Governance helps to eliminate or reduce most such barriers.

Figure 1. Governance concerns slow the adoption of AI in the enterprise.
(Source: The State of Enterprise AI 2026)

#1 The Enterprise AI Governance Checklist: From Regulatory Compliance to Operational Control

Your organization is using more AI than you know, regulators are moving faster than you expect, and agents are expanding scope without asking permission.

What should you do? This checklist helps you bring all three under control.

When Governance Cannot Wait

Three forces are converging, and each one alone would justify an urgent governance program.

• “Shadow” AI sprawl is accelerating. The average enterprise discovers 3-5 times more AI tools than IT estimates during its first audit. Employees adopt tools that help them work faster, but resourcefulness without visibility means sensitive data flows into consumer-tier tools with no enterprise agreements and no audit trail. The Shadow AI Guide documents how organizations routinely find 200 to 300 AI tools where they expected 60 to 70.
• Regulatory pressure is now enforceable. The EU AI Act becomes fully applicable in August 2026, with fines up to 35 million EUR or 7% of global turnover. The NIST AI Risk Management Framework, updated in 2025 to address generative AI and third-party model risks, is increasingly referenced by sector regulators including the SEC, FTC, and FDA. ISO 42001 is becoming a procurement prerequisite. Organizations without documented governance are not just exposed to fines; they are losing deals.
• Agentic AI is expanding scope without guardrails. Gartner projects 40% of enterprise applications will embed AI agent capabilities by the end of 2026. Agents send emails, modify databases, and chain autonomous decisions, while a single misconfigured agent can exfiltrate data at machine speed.

The Governance Checklist

Organized by domain. The prioritization section below tells you what to tackle first.

1. Tool Inventory and Approval Process

• Conduct a comprehensive AI tool audit across browser extensions, SaaS subscriptions, API integrations, and expense reports
• Deploy shadow AI detection at the browser and endpoint level; network monitoring alone cannot distinguish enterprise from consumer accounts
• Establish a tiered approval process: 48-hour initial risk screening, two-week standard evaluation, full security review only for high-risk tools
• Create a living inventory that updates continuously, not a quarterly spreadsheet

2. Data Classification and Handling

• Define sensitive data categories explicitly: customer PII, protected health information, source code, financial projections, M&A data, and credentials
• Map data flows for every discovered tool: what goes in, whether the tool retains or trains on it, and where it is stored geographically
• Implement real-time data protection at the browser level, intercepting sensitive data before it leaves your environment
• Document data processing agreements for every approved tool

3. Access Controls and Authentication

• Enforce SSO and enterprise authentication for all approved AI tools; no personal accounts used to work with organizational data
• Implement role-based access control (RBAC) so that different teams interact with different tools and data tiers
• Establish offboarding protocols that revoke AI tool access alongside standard IT deprovisioning

4. Risk Assessment for Each AI Tool

• Classify every tool across four dimensions: data handling, training data policies, data sovereignty, and enterprise vs. consumer tier
• Assess security posture: encryption, SOC 2 or ISO 27001 certification, penetration testing history
• Map each tool against EU AI Act risk categories and document your classification rationale
• Reassess every tool quarterly – vendors change data practices and regulations take effect

5. Compliance Mapping

• Map your inventory against EU AI Act requirements: risk classification, transparency documentation, human oversight obligations
• Align controls with the NIST AI RMF core functions: Govern, Map, Measure, Manage
• Layer sector-specific regulations: HIPAA, PCI-DSS, GDPR, SOX as applicable
• Evaluate ISO 42001 certification as a governance maturity milestone

6. Incident Response for AI Failures

• Define what constitutes an AI incident: data leakage, agent malfunction, hallucination-driven errors, compliance violations
• Establish a dedicated AI incident response workflow, more than a footnote in your general IR plan
• Build rollback capabilities for agentic systems; if an agent sends 500 incorrect emails, can you reverse it?
• Conduct post-incident reviews that feed into policy updates

7. Vendor Assessment Criteria

• Require an AI-specific vendor security questionnaire covering training policies, retention, subprocessors, and model provenance
• Verify enterprise-tier data protections contractually; marketing claims are insufficient
• Include AI-specific procurement clauses: no training on customer data, data deletion on termination, audit rights

8. Employee Usage Policies

• Publish a clear AI Acceptable Use Policy that employees actually read
• Communicate the “why” behind restrictions; employees who understand that consumer versions of LLM-powered tools train on their inputs will voluntarily use enterprise versions
• Provide approved alternatives for every blocked tool
• Establish a no-blame reporting channel for employees who realize they have shared sensitive data with an unauthorized tool

9. Monitoring and Audit Trails

• Deploy continuous monitoring tracking AI tool usage by individual, team, and department
• Track unauthorized AI use against a 3 to 4% unauthorized usage benchmark: usage above 10% means policies are too restrictive; near zero means stalled experimentation
• Log data flows with enough granularity to reconstruct any incident
• Generate board-ready governance dashboards quantifying risk posture and compliance coverage

10. Agentic AI-Specific Controls

• Define authority levels for every agent: read-only, advisory, action-taking with approval, or autonomous
• Set scope boundaries: time limits, action count limits, domain limits, and blast radius limits
• Establish escalation triggers that force human review: confidence thresholds, value thresholds, error accumulation
• Require full audit trails for every agent action, with triggers, inputs, decision logic, outcomes, and intervention points

How to Prioritize

You cannot implement all ten domains at once. Here is the sequencing that works.

Weeks 1 to 4: Visibility first. Tool inventory, shadow AI detection, data flow mapping. You cannot govern what you cannot see. This is Stage 1 of the AI Maturity Model, and everything else depends on it.

Weeks 5 to 8: Risk classification and policies. Classify every discovered tool, draft your acceptable use policy, establish the tiered approval process. Start with tools handling customer data, financial information, or regulated data.

Weeks 9 to 12: Data protection and compliance. Deploy browser-level data protection, map your inventory against EU AI Act and sector regulations, begin vendor assessments for highest-usage tools.

Months 4 to 6: Agentic controls and incident response. Build the agent governance framework, establish continuous monitoring, formalize your AI incident response plan.

This is not a one-time project. The AI Transformation Guide positions governance as an inner orbit discipline – a strategic constant that runs continuously. Reassess quarterly. Update as regulations evolve. Monitor benchmarks weekly.

The Governance-Innovation Balance

The biggest governance failure is not a data breach. It is building a program so restrictive that employees stop experimenting with AI entirely.

Samsung’s experience illustrates both sides. When engineers pasted proprietary code and meeting notes into consumer ChatGPT, the data exposure forced a company-wide restriction. The restriction was necessary, but the root cause was not reckless employees. It was the absence of enterprise-tier alternatives and governance infrastructure to make approved alternatives the easiest path.

The organizations that get this right share a principle: governance enables adoption rather than blocking it. The governance spectrum: educate, warn, monitor, restrict, block; gives you five possible responses instead of two. Most interactions should land in the first three.

A practical test: if your governance program’s primary output is a list of blocked tools, you have a prohibition program. If its primary output is a set of approved pathways with clear guardrails, you have governance that scales.

#2 How to Govern Agentic AI in the Enterprise

AI agents don’t wait for instructions. They act. Your governance framework needs to account for that, before agents are running in production.

Why Agentic AI Needs Its Own Governance Framework

Every previous generation of enterprise AI worked within a simple boundary: a human asked a question, the AI produced an answer, and the human decided what to do with it. Governance simply required that you control the data going in and out. That model is now obsolete.

AI agents act autonomously. They chain decisions across multi-step workflows and access enterprise systems. They modify data, send communications, and execute operations, without a human reviewing each step. An agent resolving a support ticket might pull account data, check order history, apply a discount, draft a response, and send it. Five actions, three system integrations, and one customer-facing communication, all before anyone reviews the output.

This is not theoretical. 23% of organizations are already scaling agentic AI deployments, with 39% experimenting (McKinsey’s 2025 State of AI report). Gartner projects 40% of enterprise applications will feature AI agents by the end of 2026. But a less-quoted Gartner forecast: over 40% of agentic AI projects will be canceled by 2027, largely due to governance failures and inadequate risk controls.

Your existing AI governance covers data flows, visibility, and compliance. That foundation is necessary but insufficient. It was designed for tools that process information, not systems that take action. Agents require a fundamentally different governance layer.

What Makes Agents Different from Copilots

Conflating agents with copilots is how organizations end up with structural governance gaps.

Copilots operate with a human in the loop. They assist a single task: drafting an email, suggesting code, summarizing a document. The human reviews, decides, and acts. The blast radius of a copilot-type mistake is bounded by the human in front of it. Copilot governance is primarily data governance.

Agents operate autonomously. They execute multi-step workflows, make sequential decisions, access multiple systems, and take real-world actions without step-by-step review. The blast radius is bounded only by the permissions the agent holds.

• A copilot drafts an email. A human reads it, edits it, clicks send.
• An agent reads incoming emails, classifies them, drafts responses, pulls CRM data, applies business rules, and sends; all in a loop, at scale, without human review.

The governance gap is categorical. Agents require governance over actions, scope, decisions, and accountability, dimensions that don’t exist in copilot frameworks. As AIGN Global’s framework notes: agentic systems are owned like tools, but require oversight akin to employees. They fall into a governance category that didn’t previously exist.

The Agentic AI Governance Framework

The framework has six pillars. Only the first one exists in most current programs.

1. Authorization: What Can Agents Do?

Every agent needs a defined permissible action set before production. Define authority levels: read-only (access data, modify nothing), advisory (recommendations only, human executes), action-taking with approval (agent acts, human signs off: the right starting point for most agents), and autonomous within scope (independent operation inside defined boundaries; reserved for proven agents).

Start every agent at the lowest authority level that allows it to function.

2. Oversight: Human-in-the-Loop Requirements

Define escalation triggers: when an agent must pause and hand off: confidence thresholds, value thresholds (dollar amount or customer impact), exception conditions, error accumulation management, and scope boundaries.

Singapore’s Model AI Governance Framework for Agentic AI launched in January 2026, the first state-backed framework of its kind. The framework emphasizes that oversight must be meaningful, not performative. A human rubber-stamping steps at speed is not oversight.

3. Auditability: Logging Every Decision and Action

Every action logged with full attribution: trigger, input data, decision, action taken, outcome, and human intervention points. The EU AI Act classifies some autonomous systems as high-risk, requiring documented decision-making. NIST’s CAISI issued a Request for Information in January 2026 targeting AI agent security; U.S. regulatory attention is intensifying.

74% of organizations cannot explain how an agent reached its conclusion. Deploy without audit trails and you cannot reconstruct what happened when something goes wrong.

4. Data Access: What Can Agents See and Modify?

Agents inherit data risks, plus they can modify data. Apply a “least privilege” standard aggressively. Document, for every agent: the data sources it reads, systems it writes to, data types it handles, and whether data crosses compliance boundaries.

Critical: agent data governance must be dynamic. An agent chaining steps may accumulate access across systems in ways no human user would. The compound access profile across an entire workflow matters more than any individual permission.

5. Failure Modes: What Happens When an Agent Goes Wrong?

Pre-define: How do you stop it? (Kill switches.) How do you reverse it? (Rollback capabilities.) How do you contain it? (Blast radius limits.)

In a Kiteworks 2026 Data Security Forecast survey, 100% of security and risk leaders confirmed agentic AI is on their roadmap – but the majority cannot stop an agent when something goes wrong. Define failure protocols before deployment, not after the first incident.

6. Accountability: Who Is Responsible?

When an agent makes a bad decision, who owns it? 81% of organizations lack documented governance for machine-to-machine interactions. Assign clear ownership for: agent design, deployment approval, ongoing monitoring, incident response, and outcome accountability.

The AI Transformation Guide positions governance as an inner orbit discipline; a strategic constant. Accountability is its foundation.

Maturity Levels for Agent Governance

Your governance should match your level of AI maturity.

Level 1: Manual Oversight. Advisory mode only. Every action requires human approval. Full audit logging. Most organizations should start here.

Level 2: Supervised Autonomy. Low-risk actions execute independently. High-impact actions require approval. Escalation triggers are active. Near-real-time monitoring.

Level 3: Governed Autonomy. Independent operation within scoped boundaries. Automated guardrails replace manual review. Kill switches and rollback tested and operational.

Level 4: Adaptive Governance. Governance rules evolve based on agent performance data. Reliable agents earn expanded scope. Unreliable agents get automatically constrained. Very few organizations are here yet.

The AI Maturity Model defines Stage 5 as Agentic Deployment – but you cannot skip Stages 1 through 4.

The Pace Problem

Agent capabilities are evolving faster than governance can keep up. In early 2025, agents were experimental. By mid-2025, major platforms shipped production-ready capabilities. In 2026, multi-agent systems, with agents coordinating, delegating, and making interdependent decisions, are emerging, creating emergent behaviors that are harder to predict and govern.

Meanwhile, governance is catching up. Singapore’s framework launched January 2026. NIST’s RFI closes March 2026. The EU AI Act’s full enforcement extends through 2027. The gap between what agents can do and what governance covers is widening.

The Agentic AI Foundation, launched by Block, Anthropic, and OpenAI, is building open protocols. But enterprise governance cannot wait for consensus. You need a working framework now, with the expectation it will evolve.

What to Do Now

Even if your agent strategy is early-stage, build the foundation.

Inventory your agents. Map every AI system that takes action, not just those labeled “agents.” Include automated workflows, AI-enhanced RPA, and anything operating without step-by-step human approval.

Classify by autonomy level. Does it advise or act? How long does it run without review? What systems can it access?

Start with the six pillars. For every agent, document authorization, oversight, auditability, data access, failure protocols, and accountability. Even rough documentation beats none.

Deploy kill switches before you need them. If you cannot stop an agent within minutes, you are not ready for production.

Accept that this will iterate. Your first framework will be imperfect. The organizations that wait for perfection will join the 40% cancellation rate. The ones that start now will govern effectively at scale.

#3 AI ROI KPIs: The Definitive Guide to Measuring What Actually Matters

Most AI dashboards track activity and call it impact. Here are the KPIs – organized by tier, maturity stage, and audience – that separate organizations generating real AI value from those generating expensive reports about nothing.

Why Most AI KPIs Are Wrong

Your AI dashboard probably tracks logins. Maybe active users. Maybe “hours saved,” pulled from a self-reported survey that no one filled out honestly.

Gartner identifies establishing ROI as the single biggest barrier to further AI adoption. S&P Global found that only 21% of companies measure AI impact at all. BCG reports that just 5% of organizations generate meaningful value from AI at scale. The measurement gap is not a reporting inconvenience; it is the reason most AI programs stall.

The root problem: most organizations confuse activity metrics with impact metrics. Logins, session counts, licenses activated: these tell you whether people showed up, not whether AI created value. Workday’s January 2026 study found that 37% of time saved through AI is consumed by rework. Only 14% of employees achieve net-positive outcomes. Tracking “hours saved” without measuring hours lost to rework is celebrating a number that does not exist.

The fix is better KPIs, organized into tiers that reflect the causal chain from usage to business outcome. As the Measuring AI Impact guide argues, you need a measurement system, not a single number.

Tier 1: Adoption KPIs

The question: Are people actually using AI?

Adoption is the foundation. Without it, nothing else matters. But adoption alone tells you almost nothing about value.

Active user rate: Daily, weekly, and monthly active users as a percentage of eligible employees. Segment by function, team, and seniority. A 60% rate that is actually 90% in engineering and 15% in finance tells a completely different story than the blended number.

Feature utilization depth: Which features within each tool employees actually engage. An employee using Copilot exclusively for email summaries is not the same as one integrating it into drafting, analysis, and meeting preparation.

Activation rate: The gap between licenses purchased and licenses used. This reveals whether your rollout creates value or funds shelfware.

Adoption trend velocity: Not just the current rate, but the slope. A plateau at 40% tells you something very different from a plateau at 85%.

These belong in every AI adoption dashboard. But if your executive dashboard stops here, you are measuring inputs and reporting them as outcomes.

Tier 2: Proficiency KPIs

The question: Are people using AI well?

This is the tier most organizations skip, and it’s where the 37% rework problem lives. High adoption with low proficiency means your organization generates output that creates downstream costs. The AI Proficiency Guide details why the usage-skill gap is the hidden variable in every ROI calculation.

Task completion quality: The percentage of AI-assisted work that flows through without significant revision. If 40% of drafts require substantial rework, your net productivity gain is dramatically lower than gross time saved implies.

Workflow integration score: Whether AI is embedded in how people work or bolted on as a separate step. Integrated usage compounds; bolted-on usage plateaus.

Time-to-competency: How long a new user takes to reach proficient, net-positive output. McKinsey’s research shows structured enablement achieves proficiency 40-60% faster than self-directed learning.

Net productivity score: Genuine time saved divided by total time on AI-assisted work, including rework and prompt iteration. This accounts for the 37% AI tax. If gross time saved is 10 hours but rework consumes 4, net productivity is 6, and that is the number your ROI should use.

Tier 3: Impact KPIs

The question: Is AI changing business outcomes?

Impact KPIs connect AI usage to business outcomes. They require correlating AI telemetry with business system data, which is why most organizations never get here. The ones that do are BCG’s AI-effective 5%.

Revenue influence: Compare cohorts: teams with high AI proficiency against those with low, controlling for territory and experience. Deloitte’s 2026 State of AI in the Enterprise report shows that AI ROI leaders define critical wins as revenue growth, not efficiency. Track pipeline conversion, deal velocity, and revenue per employee.

Cost reduction (net, not gross: Total verified savings minus AI tool licenses, infrastructure, training, governance, and rework costs. An organization spending $2 million on AI that generates $2.5 million in gross savings, but $600,000 in rework, is losing money, not saving it.

Time savings converted to output: Time saved only becomes value when recaptured for higher-value work. Capacity Reallocation Value calculates the difference: five hours saved on drafting at $75/hour, redirected to strategy at $200/hour, produces $625/week, not $375/week.

Customer satisfaction delta: First-contact resolution rates, CSAT, NPS, and escalation rates for AI-assisted versus non-assisted interactions.

Tier 4: Strategic KPIs

The question: Is AI changing our competitive position?

Strategic KPIs capture whether AI is transforming capabilities, not just optimizing processes. Gartner frames this as Return on Investment versus Return on the Future.

Speed of innovation: Time-to-market for new products, speed of competitive response, iteration velocity. AI’s strategic value shows up as compressed organizational cycle times, not just faster individual tasks.

Competitive position indicators: Market share, win rates against specific competitors, talent acquisition advantage. Not purely AI metrics, but if AI is transforming your organization, they should reflect it over time.

Organizational learning rate: How fast teams improve at using AI. Is the gap between best and average users narrowing? A rising learning rate compounds advantage. A flat one means standing still while competitors accelerate.

Capability elevation: Whether AI enables work that was previously impossible. A three-person team handling complexity that previously required fifteen. This is the KPI that justifies AI investment beyond efficiency.

Building the KPI Dashboard

The executive dashboard should contain five to eight metrics, maximum. Include Tier 3 and Tier 4 KPIs in financial language: Capacity Reallocation Value, Cost of Delay, revenue influence, ROAI if required; plus one or two Tier 1/Tier 2 leading indicators as early warnings.

The operational dashboard is where Tier 1 and Tier 2 live in full detail. Your AI program manager and functional heads use this weekly to manage adoption, spot proficiency gaps, and direct enablement investment. Segment by function, team, and tool; enterprise-wide averages hide every actionable insight.

The two must connect. When the board asks, “Why did revenue influence increase 12%?,” the operational dashboard should have the answer: sales adoption rose from 45% to 72%, proficiency improved, deal velocity accelerated.

The Right KPIs by Maturity Stage

Applying Tier 4 metrics to a nascent AI program is like measuring a startup’s market share: technically possible, practically meaningless. The AI Maturity Model defines five stages; here is what to measure at each.

Exploring. Focus on Tier 1: activation rate, active users, and Shadow AI prevalence. Establish baselines, not ROI.

Expanding. Shift to Tier 2: task completion quality, time-to-competency, net productivity score. Identify who generates value and who generates rework.

Integrating. Here, Tier 3 becomes meaningful. You have enough data to correlate AI usage with business outcomes. Build the executive dashboard here – not before.

Optimizing. Layer Tier 4 alongside Tier 3. Track innovation speed and competitive position. Use the Copilot ROI Framework to benchmark tool-level returns.

Transforming. All four tiers are active. The emphasis shifts to capability elevation and competitive advantage. Fewer than 5% of organizations operate here.

Common KPI Mistakes

Tracking logins and calling it a KPI. Login frequency is a system administration metric, not a business metric. An employee who logs in daily and generates output requiring complete rewriting is not a success story.

Relying on self-reported surveys. People overestimate AI proficiency and underestimate rework time. Surveys capture sentiment; they are not a substitute for behavioral telemetry showing what people actually do.

Ignoring quality entirely. Speed without quality is the 37% AI tax in action; your dashboard shows improvement while actual productivity declines. Every time-based KPI needs a quality guardrail.

Vanity metrics disguised as KPIs. “Prompts per user per day” is not a KPI. If you cannot draw a direct line from a metric to revenue, cost, quality, or speed, it does not belong on the dashboard.

Measuring engineering and extrapolating. GitHub Copilot acceptance rates projected across finance, HR, marketing, and sales is not measurement; it’s fiction.

Static measurement. AI evolves monthly. Review your metric set quarterly. Retire vanity metrics aggressively.

Larridin is the AI execution intelligence platform that gives enterprises complete visibility into how AI is being adopted, how proficiently it’s being used, and whether it’s delivering real business impact. If you’re building an AI transformation strategy that starts from the core, your organizational intelligence, Larridin provides the measurement infrastructure to track progress across every discipline in the inner orbit: adoption, proficiency, governance, and impact.

Learn how Larridin enhances AI governance