Most companies are past the question of whether to use AI. It is already in their inboxes, their spreadsheets, their support queues, and their codebases. So the question that matters is no longer adoption. It is what happens when AI stops assisting people and starts doing the work.

That line is easy to miss. A drafted reply is harmless right up until the moment it gets sent without anyone reading it. The invoice an assistant flags. The policy it pulls up for a rep to read to a customer. The record it changes through a connected tool. Each one is the same model doing roughly the same thing. What changed is that a human stopped standing between the output and the world.

This is the shift that matters: experiment to production. And it is exactly where most organizations have the least visibility. An experiment has a person reading every output. A production system often does not. The very qualities that make AI useful, the speed and the autonomy and the reach, are what make an ungoverned production system a liability.

The pattern I keep seeing is simple. The model gets more responsibility. The organization does not. The gap between those two is where risk lives.

Govern AI by what it can do, not what it is

The common instinct is to govern AI by category. Write an AI policy. Hold every system to it. This feels responsible and it is almost useless.

A meeting-notes summarizer and an agent that can move money are both “AI.” Holding them to one standard guarantees one of two failures. You smother the harmless tool in process nobody needs, or you wave the dangerous one through on a bar built for the harmless one. Often both, in the same company, at the same time.

The axis that actually matters is capability and consequence. What can this system do, and what happens if it does it wrong. Most production AI sorts into three bands.

  • Low. Internal and assistive, with a human reading every output. A document summarizer. Drafting internal text. Light touch is the right touch.
  • Moderate. It touches sensitive data or shapes a real decision, but a person is still in the loop. Drafting customer replies from CRM data. An internal knowledge assistant. Worth documenting and worth watching.
  • High. It makes or strongly shapes consequential decisions, acts on its own, or talks to customers in sensitive contexts. An autonomous outreach or transaction agent. AI in hiring, lending, or care. This earns real scrutiny, before and after launch.

The principle is one line: more capability and consequence, more structure. Less, less. A surprising amount of what gets sold as “AI governance” is just the cost of ignoring that line, one heavy standard applied to everything until people quietly route around it.

Seven questions that work as a test

You do not need a compliance department to govern production AI. You need to be able to answer seven questions about every system that is live. Who owns it. What data it can reach. What it can actually do. How it was tested. Who approved it for production. How it is monitored. And what happens when it fails, because it will.

The tell is simple: if a system is running in your business and no one can answer these crisply, that gap is the finding. The value was never the list. It is how confidently your organization can answer it for the AI already running.

A way to keep answering them

Knowing the questions is not the same as having a way to keep answering them as the business changes. The operating model we use is deliberately light, and it runs as a loop rather than a one-time project: Govern, Map, Assess, Control, Operate.

The Langham AI Governance Loop: Govern, Map, Assess, Control, and Operate, run as a continuous loop, with each stage producing a real artifact: a policy and roles, an AI use-case inventory, a risk tier and impact assessment, a system card and controls, and a launch gate with a review rhythm.
Five moves, run as a continuous loop. Each stage produces something real: a policy, an inventory, a risk tier, a system card, a launch gate.

You decide how you will govern before you scale. You map every AI system you have into one honest inventory. You assess each one on that capability-and-consequence axis. You put proportionate controls on it, heavy where it matters and light where it doesn’t. You operate it through a pre-launch gate, then monitor and review on a rhythm. Then you keep looping, because models change, data changes, and the workflow underneath moves.

None of this is about slowing the business down. Done right, it is what lets you move faster, because you can finally tell the difference between the system that needs a week of red-teaming and the one that needs a glance.

The honest starting point

Most leadership teams I talk to cannot yet list every AI system running in their business, name an owner for each, and say what each one is allowed to touch. That is not a failure. It is the normal starting position in 2026. The companies that pull ahead are the ones that decide to look first.

We wrote a short, practical guide for exactly that first look. It walks through the shift into production, the seven questions, the sense of proportion, where production AI tends to go wrong, and a ten-minute check you can run against your own systems. It is grounded in the established standards for AI governance and security (ISO/IEC 42001, the NIST AI RMF, OWASP’s Top 10s for LLM and agentic apps) without reading like any of them.

Free guide · no email required

Governing AI in Production

A short, practical field guide for leaders: the shift into production, the seven questions, a sense of proportion, where production AI goes wrong, and a ten-minute check for your own systems. Ours to you, no gate.

Download the PDF ↓

The question worth sitting with is the one the guide opens with. Of all the AI already running in your business, how much of it could you actually account for? If the answer is less than you would like, that is not a reason to slow down on AI. It is a reason to govern it.