by Mick Lavin, Coach, Agile Coach, Mentor
There’s a special kind of organisational risk that emerges when technology enthusiasm outpaces strategic readiness. With AI, that risk is especially acute, because the enthusiasm is real, the competitive pressure is intense, and the consequences of poorly governed deployment can range from significant financial loss to serious legal exposure.
Before your organisation commits extensive capital to scaling AI initiatives, there are six diagnostic questions that every leadership team should be able to answer clearly and honestly. Not optimistically. Not aspirationally. But honestly.
This article walks through those questions, explains why they matter, and gives practical advice for HR and legal professionals on what “good” looks like in each case.
Think of this as the governance checklist you run before the scale-up, the equivalent of a structural survey before you renovate the building.
Do We Have Full Observability Over Our AI Deployment?
The question in full: Do we possess clear, line-of-sight inventory over every AI agent currently deployed in our environment? Do we know exactly who is using them, what data they touch, and what business outcomes they are supposedly driving?
This sounds basic, but in most organisations, the honest answer is no.
Many employees use “Shadow AI” with personal or unapproved AI tools for work purposes. It is endemic in most workplaces. Individual team members are using AI writing assistants, summarisation tools, meeting note-takers, and coding aids without any central visibility, governance, or accountability.
From an HR perspective, this creates real risk. If an employee uses an unapproved AI tool in a performance review process, a disciplinary investigation, or a recruitment decision, and an error occurs, who is accountable? What data has been shared with a third-party platform? Does the employee know? Does the candidate?
What good looks like: A maintained, updated inventory of every AI tool in use across the organisation. Clear policies distinguishing approved tools from prohibited ones. Regular audits. An accessible reporting mechanism for employees who discover unapproved AI usage. And a request system to onboard and implement new requests.
Have We Defined Which Decisions AI Can and Cannot Make?
The question in full: Have we formally and explicitly defined which organisational decisions are permitted to be assisted by algorithms, and which decisions must strictly remain the domain of human judgment due to ethical, legal, or strategic complexity?
This is perhaps the most important governance question for HR and legal professionals, because employment decisions are specifically regulated in many jurisdictions under GDPR and national data protection legislation.
Under GDPR Article 22, individuals have the right not to be subject to solely automated decision-making that significantly affects them. In employment contexts, this covers hiring decisions, performance ratings, disciplinary outcomes, and redundancy selection; areas where HR teams frequently explore AI applications.
What good looks like: A clear, documented decision matrix that categorises your key organisational decisions by level of AI involvement; full automation, AI-assisted with human review, or human-only. This matrix should be reviewed by legal counsel, communicated to affected employees, and updated as AI capabilities evolve.
Here is a link to Guidance from the WRC.
Do We Have Documented Governance and Escalation Protocols?
The question in full: Are data boundary policies, manual override rules, and clear escalation paths explicitly documented and enforced before teams normalise unsafe workarounds or deploy shadow IT solutions?
Governance documents that exist in a SharePoint folder nobody reads are not governance. Effective AI governance means employees at every level know: what they can use AI for, what they can’t, what to do when an AI output seems wrong, and who to escalate concerns to.
This is especially important in employment law contexts. If an AI tool generates a recommendation that contradicts legal obligations, or produces a biased output in a recruitment process, there needs to be a clear, known, accessible pathway for raising and resolving that concern.
What good looks like: A practical, accessible AI usage policy that employees have actually been trained on (not just sent). Clear manual override provisions. A named AI governance contact or committee. A documented process for flagging and reviewing concerning AI outputs.
Can We Demonstrate Genuine ROI – Or Are We Measuring Enthusiasm?
The question in full: Can we demonstrate a quantitative, rigorous metric baseline for return on investment, or are we currently confusing technological enthusiasm and pilot vanity metrics with actual business value?
This is where many organisations find themselves exposed when their CFO or board asks the uncomfortable question. Metrics like “number of AI tools adopted,” “percentage of employees trained,” or “number of AI-generated documents” measure activity, not value.
I remember similar metrics in many Agile transformations I was involved in, and the lack of value each metric held.
Real ROI metrics for HR and employment functions might include:
- Measurable reduction in time to fill for standard roles
- Demonstrable reduction in time spent on routine correspondence
- Reduction in policy document creation cycle time
- Improvement in employee query resolution time
- Documented reduction in compliance error rates
What good looks like: Pre-implementation baseline data. Post-implementation measurement of the same metrics. A clear methodology for isolating the AI contribution from other variables. Regular reporting to leadership that presents both gains and costs (including cognitive load, training investment, and remediation time).
Do We Have a Disciplined Operating Rhythm?
The question in full: Do we maintain a disciplined 30-to-90-day operating and reporting rhythm for AI value extraction, ensuring initiatives are continuously evaluated against strategic goals rather than stalling as isolated experiments?
Pilot purgatory, the state of perpetual experimentation that characterises 95% of enterprise AI initiatives, is partly a governance failure. Without a regular, structured rhythm of review and decision-making, pilots drift. Early wins don’t get codified. Problems don’t get escalated. The initiative gradually loses momentum and executive attention without formally being cancelled.
What good looks like: A standing AI steering committee that meets on a regular basis. Defined criteria for what constitutes success, and failure, for each initiative. Clear decision points: at 30 days, at 90 days, at 6 months. A protocol for scaling successful pilots and formally closing underperforming ones.
Is Leadership Visibly Engaged – or Is This an IT Project?
The question in full: Are the CEO and senior functional leaders actively modelling the usage of these tools and aligning them tightly to corporate strategy, or has responsibility been entirely delegated to the technical departments?
This is perhaps the most consistently underestimated factor in AI success. Companies that succeed with AI are three times more likely to have senior leaders demonstrating active, daily engagement, not just authorising budget, but visibly using AI tools, talking about their experience (including failures), and communicating clearly about how AI fits into the organisation’s long-term strategy.
When AI is seen as the IT department’s project, it faces cultural resistance at every level. When leaders model AI use as a normal, valued part of their own work, the cultural message shifts fundamentally.
For HR directors specifically, this creates both a responsibility and an opportunity. Advising the executive team to take a more visible leadership role in AI adoption isn’t just good change management advice. It’s one of the highest-leverage interventions available.
What good looks like: Executive team members who can speak credibly about their own use of AI tools. Regular, honest communications to the workforce about the AI journey, including what’s working and what isn’t. AI adoption as a standing agenda item at board level, not just as a technology update.
A Quick Self-Assessment
Use this summary to assess your organisation’s current readiness. For each question, rate your organisation: In place and working, In progress, or Not yet started.
- Observability: Full inventory of AI tools and usage in place
- Decision mapping: Formal AI vs human decision matrix documented
- Governance: Usage policies and escalation paths documented and communicated
- ROI: Baseline metrics established and tracked rigorously
- Operating rhythm: Regular AI review cycle with clear decision criteria
- Leadership: Senior leaders visibly engaged and modelling AI use
Any “not yet started” in this list is a priority before scaling.
Scaling AI adoption before completing this diagnostic is the organisational equivalent of running a recruitment campaign before defining what the role actually requires. The enthusiasm is understandable. The risk is avoidable.
For HR & Legal professionals, this checklist isn’t an abstract governance exercise. Each question has direct implications for legal exposure, employee wellbeing, organisational credibility, and the sustainability of your AI investment.
Answer these questions honestly. Fix the gaps deliberately. Then scale.
The final article in this series: Article 9 — The 3–5 Year Outlook: What’s Coming, and How to Prepare Your Organisation Now.
Intro: AI & the Future of Work Series
About the author
Mick Lavin is an Intercultural Coach, Executive Coach and Mentor, accredited by the European Mentoring and Coaching Council. For the past 30+ years, Mick has worked in the world of technology as a people, project, and strategic account manager in several European countries, with the US, in the Middle East, and in Asia. Mick specialises in people & leadership development and business agility in multicultural business environments, helping organisations move to a more responsive and people-centric mindset.
