When AI Governance Lands On The CTO's Desk

Rob Black, CISSP, is the CEO & Founder of Fractional CISO. He architects and implements AI and cybersecurity risk management programs.

​By the time most organizations get around to formally controlling AI usage, it’s been on the “payroll” for months, working nights and weekends, and reading the entire codebase. Until a formal AI governance program is spun up, it’s as if nobody approved that “hire.”

Large companies have a CISO (chief information security officer) to manage this, but most growing companies don’t. The fallback is usually the most senior technical person in the building, which often means the CTO or IT director.

If that’s you, you can get AI governance up and running without driving your devs (or yourself!) crazy. It all comes together in one document, an acceptable use of AI policy, where you capture what’s already in use, record which tools you allow and set out how people request new ones.

Start With Your Risk Tolerance

Like with cybersecurity, every AI governance decision flows from two questions: How much risk is your organization willing to accept? How do you want AI to be used at your company?

I’ve worked with clients across the spectrum, from the ones who want the technology nowhere near their codebase to the true believers trying new tools every week. Most companies will land somewhere in between.

There’s no single right answer, but there’s one wrong move: not deciding at all. An undefined position means scattershot and inconsistent AI usage at your company.

The trade-offs are the same as the software days: speed against quality and time to market against polish. Do you want developers moving as fast as the tools allow or every line vetted before it merges, even if it ships slower?

Capture All AI Usage

None of this should shock anyone in 2026: Your team is already using AI, approved or not.

This gets captured in a separate document, linked to your acceptable use of AI policy.