Leadership wants to use AI and the security team wants to be sure it is safe. Without a process, each request becomes a meeting, approvals live in email, and nobody can later show who approved what, on what information, or what risk was accepted.
Policies alone do not govern anything. A policy says AI use must be approved; it does not give a team a form to fill in, a reviewer with the right information, or a record that the approval happened. Monitoring tools can watch controls once they exist, but they do not decide whether an AI system should be allowed to exist in the first place.
RAMP turns the process into a workflow with named roles. Intake creates the register entry. A governance requirements document captures purpose, data, users, and the control expectations. The CISO approves the concept at Gate 1. Risk is quantified before and after controls and validated by finance. Gate 2 approves production use and records a kill switch notice. The result feeds the board briefing and the audit package.
Step 1: Register and write the requirements
Step 2: Gate 1, concept approval
Two gates are the point. One approval at the start misses what changed during the build; one at the end arrives too late to change the design.
Step 3: Quantify risk, then Gate 2
Step 4: Brief the board and keep the evidence
Frequently asked questions
- How do I govern AI in my company?
- Give every AI system the same path: register it, write a requirements document, approve the concept at a first gate, assess risk before and after controls, approve production at a second gate with a kill switch, and report to the board on a regular schedule.
- Who should approve an AI system?
- Typically the CISO or equivalent security executive approves at both gates, finance validates the risk figures, and the AI governance board or board committee receives the results. Legal and privacy review should be part of the requirements stage.
- What is an AI kill switch notice?
- It is a recorded statement of who can disable an AI system, how, and how quickly, captured when production use is approved so that shutting a system down in an incident is a decision already made, not one improvised.
Pick the roles, write the two gates down, and run your next AI request through them. A simple process used every time beats a thorough policy nobody follows.