AI governance: the minimum charter for a mid-sized company
- 1A useful charter is a few pages long and readable in fifteen minutes: it states who decides, which data may leave the company and who validates outputs.
- 2Start with an inventory of real uses, including AI embedded in existing software and uses nobody has declared.
- 3Three risk tiers are enough to scale controls proportionately and stay aligned with the revised FADP and the EU AI Act.
- 4The main cost of governance is training, not the committee, and it can be managed by targeting the most exposed functions first.
In most mid-sized companies we meet, AI arrived before governance did. A salesperson drafts proposals with a consumer assistant, finance trials a reconciliation tool, the ERP vendor switches on an "intelligent" feature by default. Nobody acted in bad faith, but nobody decided either. Leadership can no longer answer three simple questions: which data leaves the company, who validates the outputs, and who is accountable when something goes wrong.
A minimum charter exists to answer those three questions. It does not replace a full compliance programme. It lays the foundation for one.
Why a charter, and why a minimal one
The legal framework is already in place, even where it is not AI-specific. In Switzerland, the revised Federal Act on Data Protection (FADP), in force since 1 September 2023, applies to any processing of personal data, including by an AI tool: duty to inform, privacy by design, impact assessment where risk is high, rules on automated individual decisions. We covered these points in our article on the revised Swiss data protection act fifteen months on.
The EU AI Act, in force since 1 August 2024, also reaches Swiss companies that place systems on the EU market or whose outputs are used in the Union. It applies in phases: prohibitions and the AI literacy duty for staff since February 2025, obligations for general-purpose AI models from August 2025, most of the remainder from August 2026. Switzerland has no general AI statute at this stage and appears to be heading toward sector-specific adjustments. An exporting mid-sized company is therefore, in practice, subject to two regimes.
"Minimal" means four to six pages, readable in fifteen minutes by any employee, signed by the executive team. A charter nobody reads is an additional risk, not a safeguard.
Step 1: inventory real uses (weeks 1 to 3)
You cannot govern what you cannot see. Ask each function about its uses, including AI built into software already deployed (CRM, ERP, email, HR tools) and tools people use on their own initiative. State from the outset that declaring a use will not lead to sanctions. The goal is visibility.
The output is a simple register: use, tool, types of data involved, owner, population affected, vendor hosting location.
Step 2: name responsibilities
Three roles are enough. A sponsor on the executive team, usually the CEO or CFO. An owner for each use, who answers for its results. A small committee of four (executive, IT, legal or data protection lead, business), meeting monthly for 90 minutes. No new function is required.
Step 3: sort uses into three tiers
This is the core of the charter, and what keeps it proportionate.
- Green: no personal or confidential data, no direct external effect (rewording an internal text, research support). Free use within approved tools.
- Amber: confidential or personal data, or output that reaches a customer. Approved tool, mandatory human review, use recorded in the register.
- Red: decisions affecting individuals (hiring, evaluation, credit, individual pricing), safety, regulated activities. Committee approval, impact assessment, documentation.
This sorting echoes the logic of the AI Act, which classes certain recruitment uses among high-risk systems, for example. It avoids treating a meeting summary like a candidate screening tool.
Step 4: set the data rules
For each tier, specify which data may enter which tools. Three rules often fit on one page: no personal data of customers or employees in an unapproved tool; for approved tools, a business licence that excludes training on your data, written into the contract; a check of hosting location and subprocessors, with the FADP rules on cross-border transfers applied.
The quality of the data going in matters as much as its confidentiality, a point we develop in No AI without clean data. For the practical side of customer data, our use case on client data privacy compliance shows the approach.
Step 5: require human oversight and traceability
For amber and red tiers, a named person validates the output before any external effect. The baseline rule: no AI output goes to a customer, an authority or a candidate without review. Accountability stays with the company and the employee, never with the tool. For red uses, keep a record of the decision, the data used and the validation.
Step 6: frame your vendors
A short questionnaire of eight to ten questions is enough: use of submitted data, retention period, location, subprocessors, incident notification, notice of model changes, available documentation. From August 2025, providers of general-purpose models will carry documentation duties, so ask for it systematically. In contracts, provide for information and exit rights.
Step 7: train, then review
A two-hour session per function, built on real company cases, beats a generic module. Add a half-page incident procedure: whom to alert, within what time, who decides on any notification. The register is reviewed quarterly, the charter annually. Regular tracking of the texts, or even automated regulatory monitoring, avoids finding out about a change too late.
An order of magnitude for the effort
Take an industrial company of 300 people, with these assumptions: 25 uses identified, of which 15 green, 8 amber and 2 red. The inventory typically takes six to eight person-days spread across functions, drafting the charter about five days, and the committee less than one day a month (four people, 90 minutes). The heaviest item is training: 300 employees for two hours is 600 hours. Hence the value of starting with exposed functions (sales, finance, HR, procurement) and spreading the rest over the year.
This cost is managed like any other: budget, owner, tracking indicators, which our Finance & performance expertise can help structure.
The mistakes we see most often
- Banning everything. Uses then go underground and risk increases.
- Writing a legal text nobody understands, with no concrete examples.
- Naming no owner, so the register lapses after two months.
- Treating the charter as fixed while tools and regulations keep moving.
This charter is part of our broader approach to Data, AI & compliance: a simple framework first, uses second, and AI only where it serves the objective.
If you would like to know where your company stands on these seven steps, our diagnostic provides a baseline and a set of priorities within a few weeks.
A personalised first reading in three minutes.