Effective AI governance starts with an "AI Council" composed of passionate users, IT, legal, and operations staff. Unlike a top-down "Center of Excellence" that dictates rules, this council's primary role is to create enabling policies and guidelines that empower grassroots adoption and safe experimentation across the organization.

When creating AI governance, differentiate based on risk. High-risk actions, like uploading sensitive company data into a public model, require rigid, enforceable "policies." Lower-risk, judgment-based areas, like when to disclose AI use in an email, are better suited for flexible "guidelines" that allow for autonomy.

An effective AI strategy pairs a central task force for enablement—handling approvals, compliance, and awareness—with empowerment of frontline staff. The best, most elegant applications of AI will be identified by those doing the day-to-day work.

To overcome employee fear, don't deploy a fully autonomous AI agent on day one. Instead, introduce it as a hybrid assistant within existing tools like Slack. Start with it asking questions, then suggesting actions, and only transition to full automation after the team trusts it and sees its value.

Address security concerns by granting AI tools access incrementally. Start with low-risk tasks like drafting content. As you build confidence, gradually allow it to read your emails, then your calendar, and eventually perform actions. This "trust spectrum" approach makes adoption more comfortable.

To manage the complexity and risk of AI agents, companies should adopt a centralized model. Rather than allowing individuals to build agents freely, a dedicated internal team should build, govern, and distribute a suite of approved agents to departments, ensuring consistency and control.

Instead of a binary human-in-the-loop decision, enterprises should use an "autonomy budget" for agents. Actions are classified by risk (e.g., irreversibility, financial impact) to determine the level of freedom, creating a spectrum from full autonomy to required human approval, avoiding agents becoming expensive suggestion boxes.

Many companies try automating massive, multi-team processes from day one. A better strategy is to first empower individual employees to build their own agents, fostering a culture of innovation before tackling complex, cross-functional automation.

To manage innovation when non-technical staff build AI tools, form a "triad": 1) an AI super-user from the business unit, 2) a dedicated tech partner for support and governance, and 3) the practice head to decide on scalability. This structure balances speed with stability.