The Missing Link Between AI Governance and Project Management

There is a point in almost every AI initiative where governance enters the conversation. The business case has been developed. The technology has been selected. The team has started building. Perhaps a pilot is already underway. Then someone asks whether the project meets the organization's governance requirements. I think that is too late. As companies move from experimenting with AI to building larger portfolios of AI initiatives, governance increasingly needs to move upstream to become part of how those projects are selected, planned and managed. It cannot sit entirely outside the project and appear only when an approval is required.

This changes the role of AI governance. It becomes less about reviewing an AI project after the important decisions have been made and more about helping the organization make better decisions throughout the project lifecycle.

One overlooked area of AI governance is in the project management of AI initiatives.

Click to expand full resolution

On the surface, AI governance and project management appear to be different activities. They have different owners, draw on different expertise and focus on different outcomes. Project management is concerned with the activities and decisions that plan and deliver an initiative successfully. Governance focuses on those activities and decisions that turn the AI initiative into a business capability.

The project manager is responsible for moving an initiative toward an outcome. Governance helps determine the conditions under which that outcome can be pursued responsibly, the decisions that need oversight, the risks that need to be managed and the evidence required to make those decisions.

In reality, some of these decisions are coupled. A governance decision changes the project's scope, cost or schedule. A project management decision changes the risk that governance is managing. Neither side can decide well without the other's latest decision in hand.

For AI, those things are increasingly difficult to separate.

At its simplest, AI project governance is the structure an organization uses to make decisions about an AI initiative throughout its lifecycle.

That includes who has decision rights, who is accountable, what risks need to be considered, what controls are required, what information needs to be documented and when a project should be reviewed or reassessed.

It is broader than compliance.

A governance process might determine whether an AI initiative is appropriate for the organization in the first place. It might influence the scope of the project, the data that can be used, the degree of human oversight required, the deployment environment, the monitoring requirements or the conditions under which the system can move from pilot to production.

This is consistent with how leading AI risk frameworks increasingly approach governance. NIST's AI Risk Management Framework, for example, treats Govern as a cross-cutting function that informs and is infused throughout the other functions of AI risk management. It describes AI risk management as a continuous activity across the AI lifecycle rather than a fixed sequence of steps.

That is an important distinction.

Governance is not simply the approval at the end of the project.

It is part of the decision-making system around the project.

Consider two AI initiatives. The first has a strong business case. It could potentially generate $2 million in annual value, but it depends on sensitive data, requires significant data remediation and will influence decisions that currently involve human judgment.

The second has a smaller potential benefit of $750,000 a year, but the data is readily available, the workflow is straightforward and the organization already has the capabilities required to deploy and monitor it.

If governance enters after prioritization, the first initiative may have already been selected because its projected financial return looked stronger. If governance is part of prioritization, the picture changes. The organization can consider the additional controls, data work, operating requirements and risk alongside the expected value. That does not automatically make the second project the better investment. It gives leadership a better basis for deciding. This is where AI governance becomes connected to AI project prioritization. The governance requirements of a project are part of understanding what it will take to make the project successful.

They affect feasibility.

They affect cost.

They affect timing.

They affect organizational readiness.

And, in some cases, they affect whether the expected value can actually be realized.

A traditional project plan might include requirements, development, testing, deployment, training and change management. An AI project needs to account for additional questions that can affect each of those stages. Data may need to be assessed and remediated before development can proceed. Models may need to be evaluated against defined performance or risk criteria. Security and privacy requirements may affect architecture. Human oversight may need to be designed into the workflow. Monitoring may be required after deployment.

These are not activities that happen around the project.

They are activities within the project.

NIST's AI RMF explicitly identifies governance, data, model development, deployment, monitoring and evaluation as activities involving different actors across the AI lifecycle, including product managers, system funders, data engineers, governance experts, legal and privacy professionals and evaluators. That has a practical implication for project management. If a governance requirement can affect the scope, resources, timeline or cost of an initiative, it belongs in the project plan. Otherwise, the organization is effectively managing the project with incomplete information.

One of the more useful ways to think about AI project governance is through decision points. At different stages of an initiative, leadership should have enough information to decide what happens next. A project might move from an initial concept to discovery. Discovery might reveal that the data is insufficient. The organization may then decide to invest in data preparation before continuing. A pilot might reveal that the model performs well technically but creates operational issues. The organization may decide to redesign the workflow. Testing might uncover a risk that requires additional controls. The project may absorb that work before production. The economics may change as the full cost of deployment becomes clearer.

At each point, the organization should have the ability to make a deliberate decision.

Continue.

Change.

Sequence differently.

Add controls.

Reassess the investment.

Or stop.

That is fundamentally a project-management discipline. The purpose of governance is to make those decisions visible, accountable and repeatable.

This is another area where organizations can get stuck. Governance can become the responsibility of a committee that meets periodically while the actual project is being managed somewhere else. That creates distance between governance decisions and project execution. I think accountability needs to be distributed more deliberately. Business leaders should own the business outcome. Technology teams should own technical implementation.

Data teams should own relevant data practices. Risk, legal, security and compliance functions should provide the expertise required for their areas of responsibility. And someone needs clear accountability for bringing those perspectives together when the project makes consequential decisions. The exact structure will vary by organization and risk level. The important thing is that decision rights are clear.

When something changes materially in an AI project, the organization should know who has the authority to decide whether the project continues, changes direction or requires additional controls. Without that clarity, governance can become a discussion rather than a decision mechanism.

There is also a financial dimension that deserves more attention.

A project may begin with an estimated $500,000 investment. As the organization learns more, it discovers that production deployment requires additional data work, security controls, monitoring infrastructure, model evaluation and ongoing human oversight.

The project may still be economically attractive.

But it is no longer a $500,000 decision.

This is why governance information needs to connect with investment management.

The cost of responsible operation is part of the economics of the AI initiative.

The same applies to time.

If an initiative requires six months of foundational work before deployment, that affects when the organization can begin realizing its expected benefits. If another initiative can be deployed in three months using existing capabilities, the sequencing decision may change. Governance therefore contributes information to both the project plan and the investment case.

That is particularly important once an organization has multiple AI initiatives competing for the same resources.

A single AI project can be governed reasonably well in isolation. The complexity increases when there are twenty.

Now the organization has multiple projects using shared data, infrastructure, engineering resources and governance capabilities.

One initiative may depend on another. Several projects may require the same security capability. A foundational data investment may unlock multiple downstream use cases. Two projects may each make sense individually but compete for the same scarce resources. This is where project governance needs to connect with AI portfolio governance. The organization needs visibility into the collective picture.

Which initiatives are ready?

Or

Which have unresolved governance requirements?

Or

Which projects should be sequenced first?

These are portfolio questions, but they are informed by the governance requirements of individual projects. The project cannot be governed effectively without understanding its place in the portfolio. And the portfolio cannot be managed effectively without understanding what each project requires to become viable.

There is another principle that I think is particularly important for mid-market organizations. Governance should be proportional. A low-risk internal productivity application should not necessarily require the same process as an AI system influencing credit decisions, healthcare outcomes or employment decisions..

Applying identical governance requirements to every AI initiative can create unnecessary friction and encourage teams to work around the process. A better approach is to understand the potential impact and risk of each initiative and apply the appropriate level of oversight. That might mean a relatively lightweight process for one use case and significantly deeper evaluation for another.

The objective is ain't maximum governance, tbh. It is appropriate governance. That distinction becomes a lot more important as the number of AI initiatives grows.

There is no single governance model that will work for every organization, but a practical AI project governance framework should provide clarity around several areas.

Decision rights: Who can approve, change, pause or stop the initiative?

Accountability: Who owns the business outcome and the consequences of the system's use?

Risk classification: What level of risk does the initiative present, and what level of oversight follows from that classification?

Data and model requirements: What standards need to be met before the system can progress?

Human oversight: Where does human judgment remain necessary, and who is responsible for it?

Controls: What security, privacy, compliance and operational controls are required?

Evidence: What needs to be documented so that decisions can be understood later?

Monitoring: What needs to be measured after deployment, and what triggers reassessment?

Change management: What happens when the model, data, workflow or use case changes materially?

The important thing is that these should connect to actual project decisions. A governance framework that produces documentation but does not influence what gets funded, built, deployed or changed is unlikely to have much practical value.

I think this is where the conversation around AI governance needs to mature. The objective was never to create another layer between an AI team and production. It is to give the organization a better way to make decisions while there is still time to act on the information.

Right from projects to costs to all the way upto pricing & conditions - things unfold as management questions.

But, they are also governance questions.

As organizations build larger AI portfolios, I expect that distinction to become increasingly difficult to maintain. The companies that manage AI effectively will need governance to connect with prioritization, project management, investment decisions and portfolio strategy rather than operate as separate processes.

For me, that is the real opportunity in AI project governance.

Governance should help an organization decide what to build, how to build it, when to move forward and when to change course. Once it does that, governance stops being a final checkpoint.

It becomes part of how the organization manages AI.