Create an AI system register
List each internal and customer-facing use, its purpose, owner, provider, data sources and actions. Include unofficial tools used in daily work. Visibility is the foundation for every other control.
Classify systems by impact. A private brainstorming assistant does not require the same review as a system that approves a payment or communicates a binding decision.
Define data and vendor rules
Specify which information may enter third-party services, how it is retained and whether it is used for provider training. Review access, subprocessors and deletion options based on the sensitivity of the use case.
Avoid relying on brand reputation alone. Configuration and contract terms can materially change the risk of the same tool.
Evaluate and monitor
Create representative test cases and measurable acceptance criteria. Track quality, refusals, latency, cost and escalation. Re-evaluate after model, prompt, data or workflow changes.
Record important versions so unexpected behaviour can be investigated. AI governance should support faster safe iteration, not freeze the system indefinitely.
Assign human accountability
Name a product owner and a technical owner. Define when a person reviews an output, who can stop the system and how incidents are reported.
Wishmakers builds governance into product architecture and operations. Controls are most effective when they are part of the workflow rather than a document users must remember separately.
Build what comes next
Turn the idea into a working system.
Wishmakers designs, builds and operates AI-native products, software systems and digital ventures across Europe, Morocco and Brazil.
Frequently asked questions
Does every company need an AI policy?
Any company using AI benefits from clear rules proportionate to its data and risk.
Who should own AI governance?
Ownership is often shared across leadership, product, technology, security and legal roles, with one accountable decision-maker for each system.
How often should AI systems be reviewed?
Review frequency should reflect impact and rate of change. Material model or workflow updates should trigger a new evaluation.