AI Governance Framework for Mid-Market Companies

By Franck, Founder & CEO, Data-Sleek | Based on sessions at the TDWI Data & AI Leaders Summit, Anaheim, September 2026

Your company probably already runs AI. There’s a chatbot on the website, a copilot in the sales team, a vendor tool scoring leads or claims, and a few pilots that someone in operations is proud of. What you probably don’t have is a clear answer when a board member, an auditor or a customer’s lawyer asks: who approved this, how do you know it still works, and what happens when it doesn’t?

That gap is widening. At the TDWI Data & AI Leaders Summit in Anaheim this September, Lauren Burke-McCarthy of Slalom shared a benchmark of 100+ senior data and AI executives: 99% say data and AI are a top investment priority, yet only 39% have AI in production at scale. In another session, Deanne Larson cited a Grant Thornton survey in which 78% of executives lacked strong confidence they could pass an AI governance audit within 90 days.

This article gives CEOs and COOs of mid-market companies a practical AI governance framework you can run without a 20-person risk office. It is built on the most useful model I heard in three days of sessions, Ken Johnston’s “Three Yeses,” and adapted for companies with lean data teams and real budgets.

Quick answer: what is an AI governance framework?

An AI governance framework is the set of owners, risk rules, controls and evidence that decides which AI systems your company ships, keeps them working safely in production, and restores them when they fail. A practical version answers three questions: Get to Yes (should this system go live, and who owns it?), Stay at Yes (is it still behaving as approved?), and Recover to Yes (when it breaks, how fast can we detect, prove what happened and fix it?).

Why AI Governance Is Now a CEO and COO Problem

For years, AI governance sounded like a policy document owned by IT or legal. That changed because the consequences moved into the P&L and the courtroom. As Ken Johnston put it in his session, governance is not being defined by government. It is being defined courtroom by courtroom, case by case.

The courts are setting the rules. Three cases every executive should know:

• Air Canada (February 2024). The airline’s website chatbot invented a bereavement refund policy. A passenger relied on it. Air Canada argued the chatbot was a separate legal entity responsible for its own actions. British Columbia’s Civil Resolution Tribunal rejected that and held the airline responsible for everything on its website, “whether it came from a static page or a chatbot.” The damages were small (about C$650 plus interest and fees). The precedent is not.
• Mobley v. Workday (ongoing). A job applicant over 40 was rejected by more than 100 employers using Workday’s AI screening. In May 2025, a federal court allowed a nationwide age-discrimination collective action to proceed, and held that employers “cannot escape liability for discrimination by delegating traditional functions, like hiring, to a third party.” Lesson: “we didn’t build the model” is not a defense, for the vendor or for its customers.
• Cigna PxDx (filed 2023). A class action alleges Cigna’s claims algorithm denied more than 300,000 payment requests over two months, at an average of 1.2 seconds per claim. Whatever the outcome, “a human reviewed it” does not hold up when the review takes a second.

Regulation is arriving on a timeline you can plan for. The EU AI Act’s rules for stand-alone high-risk systems were deferred to December 2, 2027 by the Digital Omnibus that entered into force in July 2026, but its transparency obligations already apply from August 2, 2026. In the U.S., Colorado replaced its original AI Act with SB 26-189, signed May 14, 2026 and effective January 1, 2027. It requires disclosures, explanations after adverse outcomes, correction rights, and meaningful human review when automated decisions affect employment, housing, healthcare, education, finance, or insurance.

The risk is scaling. Burke-McCarthy noted that reported AI incidents more than doubled between 2023 and 2025, according to the AI Incident Database. More AI systems now touch consumers, employees, and decisions that carry consequences.

AI governance failures, mapped to the Three Yeses

Incident	What went wrong	Which “Yes” failed	Lesson for mid-market leaders
Air Canada chatbot	Invented a refund policy; company claimed the bot was responsible	Stay at Yes	Nobody compared live outputs against the real policy
Chevrolet dealer chatbot (Dec 2023)	A user instructed it to end every answer with “that’s a legally binding offer” and got a $1 Tahoe “deal”	Get to Yes	No input guardrails or testing before launch
Workday screening	Alleged age bias in vendor AI	Get to Yes	Vendor models still need your bias testing
Cigna PxDx	Alleged batch denials at 1.2 seconds per claim	Stay at Yes	Human-in-the-loop must be real, measured and owned

Why Enterprise AI Governance Frameworks Don’t Fit Mid-Market Companies

Most AI governance frameworks you’ll find online are written for the Fortune 500. They assume an AI ethics board, a chief risk officer, a model risk management team, and a governance platform. One leading vendor framework lists 43 considerations across five pillars. That’s valuable reference material, and it’s the wrong starting point for a $50M–$500M company with two data engineers and a busy COO.

Mid-market companies fail at AI governance in predictable ways:

• Governance is a committee, not a person. “The AI steering group reviews it” means nobody is paged when something breaks.
• The review board meets monthly; systems ship weekly. Governance becomes a bottleneck, so teams route around it.
• Controls live in a Confluence page. Nothing enforces them at runtime.
• Evidence is assembled after someone asks. Screenshots and Slack threads, stitched together under pressure. (and screenshots and slack threads are not evidence in court)

The fix is not to copy an enterprise program. Burke-McCarthy’s advice was the most practical line of the summit: start where you already have structure and owners. Extend the governance that already has a budget and a history (financial controls, security reviews, data governance) and intentionally add what AI requires.

The Three Yeses: A Practical AI Governance Framework

Ken Johnston, founder of the AIGovOps Foundation, framed AI governance as three states every AI system must reach and hold:

Stage	The question it answers	What “working” looks like
Get to Yes	Should this system go live?	A named owner, a risk tier, controls and tests, and an approval gate
Stay at Yes	Is it still behaving as approved?	Guardrails enforced at runtime, drift caught before customers notice, rollback ready in minutes
Recover to Yes	When it breaks, how fast do we get back?	Owner paged in minutes, evidence assembled from logs already captured, controls updated, not just patched

The strength of this model for a CEO is that it maps governance to the life of a system, not to a policy binder. You can ask any team for any AI system: “Which ‘Yes ‘are you at, and can you prove it?”

Get to Yes: Four Things to Name Before Any AI System Ships

Johnston’s rule is blunt: “If you can’t name all four, you didn’t get to yes. You just shipped.”

1. Owner named. A real person, not a team. In a mid-market company this is usually the business leader whose process the AI changes (the VP of Customer Service for a support bot, the claims director for a claims model).
2. Risk tiered. How much damage can this system do? (See the tiering table below.)
3. Controls and tests. What stops a bad input, a bad output or a biased result, and what tests prove it before launch?
4. Approval gate. Who signs off, based on which evidence, at which point in delivery?

Tier AI systems by blast radius, not by hype

In the day-long agentic AI workshop at the summit, the instructors made a point every executive should adopt: before you build anything, ask “what is the cost of being wrong?” They scored risk on four factors: reach (what the system can access or change), reversibility (how easily a mistake is undone), error cost (financial, legal, or reputational damage), and detection time (how long a mistake goes unnoticed).

For a mid-market company, three tiers are enough:

Tier	Typical examples	Minimum gates
Tier 1: Low	Internal drafting, meeting summaries, read-only research assistants	Acceptable-use policy, approved tools list, owner named
Tier 2: Medium	Internal decision support, sales forecasting, customer-facing content with human approval	Pre-production testing, data source sign-off, output monitoring, quarterly review
Tier 3: High	Customer-facing chatbots that can commit the company, pricing, claims, credit, hiring or health decisions, agents that write to production systems	All Tier 2 gates plus bias testing, red-teaming, a real human-review design, rollback plan, incident runbook and executive sign-off

Your risk tier decides which gates fire. That keeps low-risk tools fast and puts your scarce review time where the exposure is.

Every control needs a WHO and a WHEN

Burke-McCarthy called this “the control gap,” and it’s the most common weakness I see in client AI policies. Statements like these feel like controls but aren’t:

• “We’ll add human oversight.”
• “Legal reviews high-risk use cases.”
• “We monitor for drift.”
• “It’s covered by the AI policy.”

A real control has a named role whose job already includes looking at this, and a defined moment in the workflow: at intake, at the pre-production gate, at release review, in weekly monitoring, or when an incident occurs. As she put it, good intentions don’t drive proactive risk management.

Stay at Yes: Governance That Runs in Production

Most AI governance programs stop at launch. That’s where the Air Canada and Cigna stories begin. Johnston described the three ways “Stay at Yes” usually breaks: “We checked it at launch.” “Nobody flagged it.” “We didn’t know until the tweet.”

Staying at Yes means:

• Guardrails enforced at runtime. Input filters against prompt injection (OWASP ranks it the top LLM risk), output checks against policy, and limits on what an agent can write or spend.
• Monitoring against ground truth. Compare what the system says or decides with what should have happened: the actual refund policy, the actual claim outcome, the actual forecast.
• Drift is caught before customers notice. Watch both model drift and data drift. At the summit, TDWI’s Fern Halper stressed that data drift is monitored far less often than model drift, yet most AI failures start as data problems.
• Vendor change control. If you use a third-party model or a SaaS AI feature, know when the vendor changes the underlying model, and retest.
• Real human-in-the-loop. Define what the reviewer must check, how long it should take, and how often they override the AI. If override rates are near zero and reviews take seconds, you have a rubber stamp, not a control.
• Rollback ready in minutes. Every Tier 2 and Tier 3 system needs a documented way to turn it off or fall back to the previous version.

Recover to Yes: Incident Response and the AI Evidence Packet

The line from the summit that I’ve repeated most since: “If you can’t produce the evidence packet in an afternoon, you can’t produce it. Period.”

When a regulator, a court, or a major customer asks what happened, you need to show, quickly and credibly:

• Which system, which model version, and which prompt or configuration were running
• Which data it used, and where that data came from (lineage)
• Who approved it, based on which tests, and at which risk tier
• What it produced for the affected transactions, with timestamps
• When the problem was detected, who responded, and what changed afterward

Recovering to Yes means three things happen in order: the incident is detected, and the owner is paged in minutes, the evidence packet is assembled from logs you were already capturing, and service is restored with the control updated, not just patched.

Screenshots and Slack threads are not evidence. Signed, timestamped, retrievable records are.

The Operating Model Behind Every Yes: The Four Ps

Johnston’s operating model has four parts. Here’s how each one usually breaks, and what “working” looks like at mid-market scale:

P	How it usually breaks	What it looks like working
People	“Responsible AI” is a committee, not a person	Named owners for model, data, deployment and incident, each paged when their piece breaks
Process	Review board meets monthly while systems ship weekly	Gates built into delivery; the risk tier decides which gates fire
Platform	Controls live in a document; nothing enforces them	Controls run as code: input, output, drift and rollback
Proof	Evidence assembled after the regulator asks	Signed, timestamped records, retrievable in minutes

AI Governance Roles for a Mid-Market Company

You don’t need a new headcount for each role. In most mid-market companies, one person covers two or three. What matters is that every role has a name.

Role	Typically held by	Accountable for
Executive sponsor	CEO or COO	Risk appetite, tier rules, final call on Tier 3 systems
Business owner	The leader whose process the AI changes	The outcome and the value number; approving go-live
Data owner	Data or analytics lead	Source data quality, lineage, access rights
Model / vendor owner	IT, data science lead or vendor manager	Model versions, testing, vendor change notices
Deployment owner	Engineering or IT operations	Runtime guardrails, monitoring, rollback
Incident owner	Usually the deployment owner or IT security	Detection, paging, evidence packet, post-incident fixes

Your AI Governance Program Is a Data Program

Here’s the part the governance frameworks tend to skip, and the reason a data consulting firm is writing about it. Look at every item in the Three Yeses: model versions, prompts, source data, lineage, test results, approvals, runtime inputs and outputs, and incident timelines. Every piece of evidence in AI governance is data. If it isn’t captured, stored, and queryable, you can’t produce it in an afternoon.

The TDWI research presented at the summit backs this up: 63% of high-impact AI organizations enforce policy at the data layer, compared with 28% of low-impact peers. Governance that travels with the data (role-based access, lineage, auditability) scales. Governance that lives in a policy binder doesn’t.

In practice, that means:

• An AI system inventory kept as a governed table, not a spreadsheet on someone’s laptop
• A system of record for AI activity: prompts, model versions, inputs, outputs and approvals logged to your warehouse
• Lineage from source to AI output, so you can show which data fed which decision
• Data quality acceptance before data reaches a model, with named owners for each source

If this sounds like work your data platform should already support, it is. Our data governance best practices guide covers the foundations, and our data architecture consulting team builds the logging and lineage layer that turns governance from a promise into proof.

Not sure where your gaps are? Our AI Readiness Assessment reviews your AI systems, data foundation, and controls, and gives you a prioritized plan in weeks, not quarters.

AI Governance Maturity Model: Where Does Your Company Stand?

Burke-McCarthy described four stages on the path to the responsible activation of AI. Use it to place your company realistically:

Stage	What it looks like	Your next move
1. Vision	No AI policy or risk plan yet; AI tools used ad hoc	Inventory existing AI systems and use cases; prioritize by risk
2. Defining	Drafting policy; analyzing readiness and gaps	Define risk tiers, owners and a process to assess new use cases
3. Applying	Policy exists but is applied unevenly	Build gates into delivery; add runtime monitoring; close control gaps
4. Adapting	Governing at scale with monitoring and audit trails	Feed incidents and drift back into the plan; version it like a product

Most mid-market companies I talk to are between stage 1 and stage 2, with a few Tier 3 systems already live. That’s the risky combination. For a broader view of readiness beyond governance, see our AI maturity model.

The 30-Day AI Governance Starter Plan

You don’t need to govern everything at once. Johnston closed his session with four “Monday morning moves.” Here they are, with the steps we’d add for a mid-market company:

1. Week 1: Pick one system, the riskiest one you run. List every AI system you can find (including vendor features), tier them, and pick the highest-tier one.
2. Week 1: Name the owners. Model, data, deployment, and incident. Real people, written down and told.
3. Week 2: Build one gate. One test suite that must pass before changes go live, and one approval with a named approver.
4. Week 2–3: Capture one evidence artifact. Log the model version, inputs, outputs, and approvals for that system to a place you can query.
5. Week 3: Write a one-page incident runbook. Who gets paged, how to roll back, and where the evidence lives.
6. Week 4: Run it for 30 days, then move on to the next system.

As Johnston put it, thirty days from now, evidence exists where it didn’t before. That’s the only thing that changes the conversation with your board, your insurer, or a regulator.

How AI Governance Protects Your AI ROI

Governance is often sold as risk reduction. For a CEO, the stronger argument is that it protects the return on AI. Deanne Larson’s research session showed that organizations delivering ROI from AI share a pattern: governance with decision rights. A governance body that can only approve can never defund, so failing pilots linger, and the AI application portfolio only grows. Effective bodies can fund, defund, and set stage gates with dates attached, and they review risk and value in the same forum.

The Three Yeses give that forum what it needs: a clear owner for each system, a risk tier that sets the bar, and evidence that shows whether the system is still worth running. For more on tying AI and data investments to measurable returns, see our guide to data strategy ROI and our analysis of why AI projects fail in mid-market companies.

Frequently Asked Questions About AI Governance

Getting to Yes, and Staying There

AI governance for a mid-market company doesn’t have to be a bureaucracy. It needs three answers for every AI system you run: who approved it and why, how you know it still works, and how fast you can prove what happened when it doesn’t. The companies that answer those questions with data, not documents, will move faster with AI, not slower.

At Data-Sleek, we help mid-market companies build the data foundation that makes AI governance provable: system inventories, lineage, logging and the evidence layer behind every Yes. Book a free consultation with a Data-Sleek expert to review your riskiest AI system and leave with a 30-day governance plan.

Sources: Sessions by Ken Johnston (AIGovOps Foundation), Lauren Burke-McCarthy (Slalom), Deanne Larson (Larson & Associates), Fern Halper (TDWI Research) and the agentic AI workshop at the TDWI Data & AI Leaders Summit, Anaheim, September 21–23, 2026; American Bar Association, Business Law Today (Moffatt v. Air Canada); Holland & Knight (Mobley v. Workday); Healthcare Dive (Cigna PxDx lawsuit); White & Case (EU AI Omnibus); Colorado SB 26-189.