Why you need to think about Governance

---

Microsoft Copilot, Generative AI, and the broader wave of workplace automation will, and should, change your organisation like nothing before.

In the rush for the best prompts, the most useful agents, and the reengineering of processes, there’s one topic we pay lip service to: Governance.

If you don’t govern AI, it will govern you.

Governance isn't about slowing things down. It’s about pointing the rocket in the right direction before you hit launch. It’s about clarity in chaos, purpose in progress, and ensuring AI serves your organisation — not the other way around.

Governance means decisions made on purpose, not by accident.

It’s how your organisation decides:

• Why you’re using AI

• Where it’s safe

• Who’s accountable

• What it’s replacing (and what it’s enhancing)

• How it aligns with your values, policies and regulatory responsibilities

That’s why I developed the Malcolm Bullock Model of AI Governance — a four-layered approach that goes beyond tick-box compliance. It covers core hygiene (legal, regulatory, and ISO standards), technical readiness inside Microsoft 365, behavioural change and user fluency, and, finally, strategic ownership at the leadership level. These aren’t siloed policies; they’re interlocking foundations that make AI work safely, usefully and confidently across your business.

Governance isn’t a document on a shared drive. It’s how you lead. It’s how you build trust. It’s how you sleep at night, knowing your people are using powerful tools wisely and purposefully, not chaotically.  My Governance models don’t just tick compliance boxes, but they actually makes governance useful, grounded in how Copilot and AI are used in your workplace, not in a test environment. 

Policies and procedures? That’s where the rubber hits the road. They’re the operational side of governance, the real test. Without them, "governance" is just a nice word in a meeting.

I see the wood for the trees. I help organisations make sense of it all — drawing upon:

• ISO42001 (AI Management Systems)

• ISO27001, BSI ISO/IEC 38507 (Information Security and AI Governance)

• Microsoft’s AETHER & EDP frameworks (Responsible AI, Privacy, Ethics)

• EU AI Act, UK regulations, ICO guidance (and NHS digital standards)

Please read the series of blog articles explaining my AI Governance model in the Blog section of this website.

Because when it comes to AI, doing it right isn’t optional. It’s the difference between transformation… and litigation.