Before I use a new AI tool, I ask four questions. They are short enough to run before I sign up, and they have already changed which tools I keep.
For me, AI governance is deciding which AI tools to use, what to share with them and how to check their work.
I think about AI governance in three areas:
- Companies that build AI and how they manage it
- Governments that regulate it, such as the EU AI Act
- How each of us uses AI and understands the risks
This post covers the third area, my personal framework. I use ISO/IEC 42001, the international standard for managing AI, as a rough guide.
1. What is the use case, and what problem does it solve?
- What risk level does it pose for my workflow: low, medium or high?
- How does it fit with the other tools I use, AI or not?
- What information will I share with it, and what access will it have?
2. Can I trust the tool and where my data goes?
- Is it a known, legitimate company? I run a third-party risk check, as I would for any vendor.
- Can I stop my data from being used to train their models, and which country is my information stored in?
- What risks are there? I use the four sources of operational risk from GRC work: people, process, systems and external events. It is the same habit I use in 6 risk questions I use for big life decisions.
What I never paste into an online AI tool:
- Passwords and ID numbers
- Bank details
- Other people’s private messages
If I wouldn’t email it to a stranger, I don’t paste it.
3. Did the AI add value?
- If the result is weak, is it the model, my prompt or the task itself?
- Do I need to learn more, or give the tool better guidance, to use it well?
4. How do I stay in the loop?
- How will I review the results before I rely on them?
- Will it add to my tools or replace one?
- How often will I need to change models or vendors to keep it useful?
One tool, four questions
I wanted help reading long private emails and notes, so I set up an AI model on my Mac. It runs locally, so the text never leaves my computer. That answered question 2. For question 3, I checked its answers and kept track of which ones were right. It was good at summarizing long text, but it often got questions about code wrong, so I stopped using it for that. For question 4, I check each answer before I act on it, and I keep a record of how much it helps. For everything else, I use online tools and check their data settings first.
I used these questions when I let an AI agent work on this site, which I wrote about in how I used AI to improve my website.
One of my “no” decisions: I also tried a second AI agent to review my website. It can read the site and point out problems, but I decided it would never make changes. Only one tool can change the site, and nothing goes live without my OK. Question 1 stopped me: the use case was reviewing, so it only needed read access.
How the EU AI Act sorts risk
The EU AI Act is the first broad law for AI. It sorts AI systems into four levels of risk. Here is my simplified summary:
| Risk level | What it means | Examples |
|---|---|---|
| Unacceptable (banned) | A clear threat to people’s safety or rights | Social scoring of people, harmful manipulation, emotion recognition at work or school |
| High | Can affect people’s safety, health or rights, so strict rules apply | AI used in hiring, credit scoring, education and medical devices |
| Limited | The main risk is not knowing you are dealing with AI, so it must be made clear | Chatbots and deepfakes |
| Minimal | Little or no risk | Spam filters and video games |
Most of how I use AI day to day falls in the minimal or limited levels. That is why my own four questions matter more to me than the law does. The European Commission has the full overview of the AI Act.
New AI tools are arriving fast, and each one is a balancing act between what it can do for me and what it asks me to trust it with. I come back to these four questions every time, starting with question 4 whenever a model or vendor changes.