What AI governance demands of the teams putting it into practice

At IDA Ireland, I work closely with U.S. companies developing their European operations. Workforce capability is a recurring consideration, and AI adoption adds new questions about the expertise businesses need. Attending IAPP Privacy. Security. Risk. + AI Governance in Seattle this October reinforced how closely those questions now connect with privacy and cybersecurity.

What struck me was the move from governance principles to implementation. Along with optimism about AI’s productivity benefits, discussions focused on risk assessment, accountability, auditability and human oversight. For the U.S. businesses we support, building these capabilities matters both to operating in Europe and to expanding the work their Irish teams can undertake.

Make accountability visible in daily decisions

A practical governance framework should connect each AI use case to a responsible owner, an assessment of its risks and evidence supporting its approval. Teams need to establish what information a system processes, how its outputs will be used, and which decisions require human review. Auditability depends on retaining enough information to reconstruct those decisions and investigate problems.

Agentic AI makes these questions more urgent. An assistant that drafts a response presents different risks from an agent authorized to retrieve customer records or change account settings. Organizations should define the agent’s permissions, monitor its actions and ensure someone can intervene. Human oversight must include the authority and ability to stop an action.

Making this work requires people who understand one another’s responsibilities. Ireland’s cybersecurity ecosystem offers a useful example: Cyber Ireland connects industry, education and government around shared challenges, including workforce development. That collaborative approach is relevant to businesses bringing privacy and security teams together to govern AI. Employees also need role-specific training and clear guidance on approved tools and acceptable data use.

Keep vendor risk under review

I was particularly interested in the attention given to third-party risk. AI increasingly arrives through software-as-a-service platforms companies already use, making governance a continuing responsibility. A procurement assessment completed before an AI feature existed may say little about the risks it introduces.

A new assistant or agent should prompt questions about data access, retention and whether customer information is used to train models. Teams also need to understand the provider’s reliance on other suppliers and how material changes will be communicated. Someone must own the decision to reassess a service when its capabilities change.

These concerns help explain why AI security is becoming a board-level issue. Data leakage, model security and agents with excessive permissions can affect customer trust and business continuity. Boards need visibility into material exposures and the evidence that management can detect and contain failures.

Build compliance into implementation

The complexity of the EU AI Act and U.S. state privacy regulations was another recurring concern. For a U.S. company building European operations, the practical question is how teams across markets will demonstrate compliance. Responsibilities need to be clear within the business and across its suppliers.

A shared inventory of AI uses linked to relevant assessments and documented decisions provides a practical foundation. Privacy, legal and security colleagues should work with the teams deploying the technology so that compliance evidence reflects actual practice. Exercises can test whether people know how to escalate an unexpected outcome and identify who is accountable.

Use governance to support productive adoption

The most encouraging discussions treated stronger governance as a business enabler. Clear approval criteria can help teams move promising uses forward while defined boundaries make it easier to identify where further scrutiny is needed. Growing interest in privacy-enhancing technologies offers another opportunity to explore how businesses can obtain useful insights while limiting exposure of personal information. Their suitability still needs to be assessed for each use case.

These discussions directly connect with our work at IDA Ireland. Investment decisions increasingly depend on where companies can develop, deploy and govern AI across markets. Trusted data environments and regulatory clarity matter alongside skills and research partnerships.

Our role includes helping the multinationals already in Ireland expand their mandates, as well as attracting new investment. We connect companies with talent, research partners and funding to support that development. IDA CEO Michael Lohan’s emphasis on lifelong AI literacy and human judgment is especially relevant: businesses need people capable of questioning outputs and deciding when intervention is necessary, an opinion he shared in an op-ed for The Irish Times. 

I left Seattle encouraged by the practical focus and what it means for the U.S. companies I work with. Ireland’s experience connecting employers, educators and practitioners provides a foundation for developing these capabilities. At IDA Ireland, supporting companies as they build the teams and partnerships needed for responsible AI adoption is part of helping their European operations grow.