From an AI Governance Workshop to Team Rules That Actually Work

Legal sends a PDF of AI guidelines attached to a company-wide email. Two weeks later, half the team is still using the same unapproved tools as before, for a simple reason: nobody from the actual day-to-day work had a hand in drafting the policy. Rules written at legal's desk, without knowing the practice of the people meant to follow them, rarely survive contact with daily work. AI governance is therefore less a documentation problem than a facilitation problem: a negotiation process that needs the perspective of the people who actually use the tools.

Regulatory pressure adds to that: the EU AI Act increasingly requires companies to document their AI-related processes. A workshop with genuine participation is a better foundation for that than a document nobody actually reads.

The questions that come before the actual AI question

A surprisingly large share of what shows up as an “AI governance problem” turns out, on closer inspection, to be a problem that was unresolved well before modern AI tools existed: where does our data actually live? Which cloud services are approved at all? Who decides when a new tool shows up? AI tools just make these gaps more visible, because suddenly anyone with a chat window can potentially type company data into an outside system.

Sometimes all it takes is realizing that a given task doesn't need a cloud tool with data risk in the first place, no new AI policy required. For workshop planning, for example, a tool that runs entirely in the browser with no account and no cloud storage – like Sessionplan.de – is enough. Our post on 30 privacy-first alternatives to expensive software shows how far this principle extends beyond workshop planning. And for how AI can still be used sensibly and with clear boundaries, see our post on responsible AI use in Sessionplan.

Six building blocks of an AI governance workshop

1. Stocktake: which tools are already in use?

Without an honest stocktake, rules get written for a reality that doesn't exist. Collect openly and without judgment which tools are already in use – including informal ones. Honesty only happens when nobody expects consequences for past use.

2. Approved tools & approval process

An approved-tools list that defines which tools are cleared for which purposes works better than a ban list – and simultaneously defines a clear path for how a new tool actually gets reviewed and approved.

3. Data classes & data handling

Define which data – customer data, source code, trade secrets – may go into which kind of tool at all. This classification is usually the actual core of the “AI question.”

4. Copyright & disclosure

Clarify when AI-generated content needs to be disclosed and who reviews its quality before publication.

5. Responsibility & sign-off

Define who stays substantively responsible for AI-assisted outputs. Responsibility never shifts onto the tool itself – say that explicitly instead of assuming everyone already knows it.

6. Review cadence

AI tools and their capabilities change faster than most corporate policies. A fixed review date keeps the rules from simply becoming outdated after six months.

Time Budget for the 110-Minute Agenda

The six building blocks fit into a single session if you set the time budget in advance:

Building block	Time	Format
1. Stocktake	20 min	Silent individual collection, then share out in plenary
2. Approved tools & approval process	20 min	Small groups, then merge results
3. Data classes & data handling	20 min	Shared categorisation on the board
4. Copyright & disclosure	15 min	Short input, then open discussion
5. Responsibility & sign-off	15 min	Clarify roles in plenary
6. Review cadence	10 min	Lock the date into the calendar on the spot
Consent decision	10 min	Round-robin check for objections

Note: the first three building blocks deliberately get the most time – they provide the factual foundation the later decisions build on. Cut them too short and blocks 4 through 6 end up feeling like a formality.

Common Pitfalls

• Bans without alternatives: a pure ban with no approved replacement just pushes usage further into the shadows. Every banned tool needs an approved substitute.
• Legal facilitates instead of the team: if legal sits in the driver's seat of the discussion, the workshop quickly slides back into the approval logic it was meant to replace.
• Only text generators in scope: image generation, code assistants, meeting transcription and auto-summaries often get left out of the stocktake, despite carrying the same data risks.
• No owner for the review date: without a named responsible person, the review date from building block 6 reliably slips.

How to facilitate the workshop

The rules you've drafted stay a concrete proposal, not a finished resolution handed down – adopted via a consent decision: ask each person in turn for paramount objections, integrate them, check again. If you need an even more structured decision basis, see our post on the 7 building blocks of facilitated decisions – including an owner and a review date, both essential for AI rules too.

Example: A 12-Person Product Team Surfaces Shadow AI

A twelve-person product team walked into the workshop expecting ChatGPT to be the only AI tool in use. The anonymous stocktake at the start surfaced six different tools – two of which were pasting customer data straight into prompts, unnoticed by legal until that moment. By the end of the 110 minutes, the team had an approved-tools list with three entries, a clear rule on which data classes may never enter a cloud tool, and a fixed review date six weeks out. The decisive difference from the failed policy before it: all twelve people had a say in which tools made the list – not just IT.

AI Governance Workshop FAQ

How long does a workshop like this take?
The template is built for 110 minutes. For teams with an especially fragmented tool landscape, it's worth pulling blocks 1 and 2 forward into their own 60-minute session and covering the rest in a second one.

Who should attend?
The team that actually uses the tools, plus one person with sign-off authority. Legal and IT security are valuable as advisors, but shouldn't decide alone – otherwise the original problem just repeats itself.

What if legal won't get on board?
Invite them explicitly as participants, not as an after-the-fact approval gate. Most objections dissolve once legal and the team stand at the same board together instead of trading documents by email.

Is one workshop enough?
No – that's exactly why building block 6, the review cadence, isn't a formality. AI tools change faster than any annual policy. Without a fixed follow-up date, the agreement decays within a few months.

Does this apply to freelancers and contractors too?
Yes, arguably even more urgently – external people often have the weakest attachment to internal process and the highest odds of sticking with a personal AI tool out of habit. Include them explicitly in the stocktake instead of just informing them afterward.

After the Workshop: Making the Rules Stick

The workshop itself is just the start. Without a clear rollout plan, the outcome sinks into a wiki page nobody reads. Three steps help: first, capture the agreed rules in a single short document instead of a long policy. Second, surface the approved-tools list where decisions actually get made – in new-hire onboarding, or directly in the tool-procurement process. Third, put the review date from block 6 not just on a calendar, but in the document itself with a date attached, so it doesn't get lost in the next reorg.

AI governance that holds up gets built in the room with the people who use the tools every day, not written at legal's desk. Facilitate the stocktake, data handling and responsibility questions together, rather than decreeing them from above, and you end up with rules that still make sense after the next tool update.