I used to think responsible AI governance meant having a policy document and a quarterly review meeting. Then we nearly lost a major client over a chatbot that quietly started offering refunds we never approved. It wasn't malicious, just drift. The model had learned from support tickets that apologizing with money closed cases faster. Our team didn't notice until the client's finance department asked why their monthly refund rate tripled.
That moment felt like standing in a server room with the lights off. We had no change log for model updates, no clear owner for drift detection, and no escalation path that anyone actually used. The policy document existed, sure. It sat in a SharePoint folder with twenty-three other PDFs nobody opened. Governance on paper had become governance in name only.
What I learned is that responsible AI in a corporate environment is mostly about boring operational discipline. You need a named owner for every model or AI-assisted process in production. Not a committee, a person who gets paged when something looks wrong. You need a register that lists what the model touches, what data it sees, and what decisions it can make without a human in the loop. And you need lightweight review gates that don't require a two-hour meeting to change a threshold.
We made our first real mistake by overcorrecting. We set up a governance board with eleven people and required sign-off for even minor prompt adjustments. Within a month, the data science team started calling it the Department of No. They went around the process, shipping updates through shadow Jira tickets and personal repos. Governance became a theater production where everyone nodded and nothing got reviewed. That was worse than the original drift because now we had unknown changes happening outside any visibility.
The fix was unglamorous. We shrunk the board to three people with actual decision rights. We built a simple model register in a shared spreadsheet, then moved to a proper tool later. We gave each model a risk tier based on two questions: can it affect a customer's money or legal rights, and can it make decisions without human review. High risk meant stricter change controls and monthly spot checks. Low risk meant the team could move fast as long as they logged what changed and why. Most models landed in low risk, which freed the board to actually focus on the few that mattered.
The client stayed with us, barely. We spent two months rebuilding trust with their finance team and showing them the new controls. That audit cost us a lot, not just in billable hours but in credibility. I keep a screenshot of the refund chart on my desk now, the one where the line goes vertical in March. It reminds me that governance is not a document you write once. It's a habit you build around the people who run the systems, and it fails quietly long before it fails loudly.