AI Governance: Are We Governing AI… or Just Governing the Tools?

Decision governance is indeed a critical layer. I would add one question that may sit even before the decision lifecycle: who defines the conditions under which AI is allowed to influence a decision?

Traceability, evidence, and accountability help us govern how a decision is made.
But governance also needs to make explicit which decisions AI may support, what level of autonomy is acceptable, when human review is mandatory, and which decisions should remain non-delegable.

Perhaps the first principle of AI governance for project managers should be this: define the boundaries of AI authority before governing the decisions it helps produce.

Razzell,

This is a thoughtful question because I think AI governance is evolving beyond governing the technology itself to governing how organizations use AI within their decision-making processes.

In my organization, we're still in the early stages of formal AI governance. We have policies around approved tools, security, and data handling, but we're also beginning to integrate AI into portfolio management by using tools like Cursor with MCP integrations and models such as Gemini to interact with Jira data, generate analyses, and create visualizations. Those outputs support portfolio reviews and leadership discussions, but the final decisions remain firmly with people.

So to your second question, I think we ultimately need to govern both the technology and the decisions it supports. Technical governance addresses issues like security, privacy, and model usage. Decision governance focuses on how AI-generated insights are validated, challenged, documented, and incorporated into organizational decision-making.

Looking ahead five years, I think the biggest governance challenge won't be preventing AI from making bad decisions. It will be preventing organizations from gradually accepting AI-generated interpretations without sufficient scrutiny. AI increasingly influences which risks are highlighted, which dependencies receive attention, and how situations are framed before leaders ever make a decision. If those interpretations drift away from organizational context or strategic intent, decision quality will drift as well.

If I were developing an AI governance standard for project managers, my first principle would be:

AI should improve organizational understanding, not replace organizational judgment.

For me, that's the key distinction. AI should help teams synthesize information, surface patterns, compare alternatives, and expose trade-offs more effectively. But accountability for interpreting that information, making decisions, and owning the outcomes must remain with the people responsible for delivery.

As AI becomes part of everyday project delivery, I think successful organizations will treat it less as an autonomous decision-maker and more as a capability that helps people build better shared understanding before important decisions are made.

There is one and only one simple answer to your question: Responsible AI.

Most orgs govern the AI tool itself (data privacy, security), but not the decisions it influences. The real gap is tracking why a recommendation was made and who's accountable for accepting it. First principle: every AI-assisted decision should leave an audit trail (evidence, assumptions, human sign-off) so it can be reviewed and owned later.