There's a question I keep hearing from founders and CTOs: "Do we need an AI policy?" My answer is increasingly: you need a governance program, and AI just needs to be part of it, the same way your data handling and your hiring practices are.
We've crossed a threshold. AI is no longer a feature you bolt on to differentiate a product. It's inside your note-taking tools, your customer support workflows, your code editors, and your sales platforms. It's in the room whether you invited it or not. And yet, one of the more common gaps I find when working with software companies is that their governance programs still treat AI as a special case, a thing to address separately, later, once they figure out what they're actually doing with it.
That approach made sense three years ago. It doesn't anymore.
It Starts Earlier Than You Think
The tendency is to assume that AI governance is a developer problem, but it isn't. It starts in your sales department when someone subscribes to a note-taking app that transcribes your client calls. It shows up when your content team pastes a customer's feedback into a writing assistant to generate a case study. It's present when your finance team uploads a contract into a summarisation tool to pull out the key clauses. It's front and centre when your Applicant Tracking System in recruitment makes a call on someone's seniority.
None of these are engineering decisions. All of them carry privacy, data handling, and potentially contractual implications. And if your governance program hasn't caught up to the fact that these tools are in daily use, you have a gap that no amount of future policy drafting is going to close retroactively.
The Problem With Treating AI as a Separate Category
When governance programs carve out AI as its own workstream, a few things tend to happen. First, nothing gets done because no one quite knows who owns it. Second, everything else moves forward without AI being considered, so you end up with a patchwork of policies that don't account for how your staff are actually working. Third, the genuine risks, things like data being fed into third-party models, outputs being used in client-facing materials without review, or agents making decisions that affect personal data, accumulate quietly in the background.
Your privacy program should already cover data minimisation, purpose limitation, and vendor management. AI doesn't need a separate doctrine for these things; it needs to be brought into the existing one. The same goes for your security controls, your acceptable use policies, and your data processing agreements with clients.
Where to Start
Start by asking a simple question across every department: what tools are people using, and what data is going into them? You'll likely be surprised by the answer. From there, the existing frameworks you're working with, whether that's GDPR, PIPEDA, SOC 2, or your client contracts, already give you most of the vocabulary you need to assess and manage the risks involved.
The more advanced end of this, the use of agents that spawn other agents, automated pipelines that touch personal data, and development environments that use AI-assisted code generation, requires more deliberate architectural thinking. That's a longer conversation, and one I'm currently working through in a whitepaper specifically on AI agents for software companies. But even before you get there, the foundational governance work needs to be in place.
The Bottom Line
The companies getting this right aren't building separate AI ethics committees or waiting on regulatory clarity before moving. They're doing the practical work of folding AI into their existing governance exercises, reviewing their vendor lists, updating their privacy notices, and training their teams on what appropriate use looks like for their specific context.
If you're not sure where your current program stands, or you need someone to help your team work through what this looks like in practice, you can reach out at rossgsaunders.com. I work with founders, CTOs, and privacy officers to build governance programs that reflect how their businesses actually operate, and I'm available to speak to your leadership teams or work through this alongside you.