The problem with policy alone

A campaign team picks up a co pilot to draft ad copy faster, and a developer wires an API into an internal tool over a weekend because it solves a problem nobody had raised with security yet. In both cases the tool skips review simply because there was never an obvious place for the request to go.

This is the pattern behind most AI governance gaps. Most organisations already have an AI policy but what they’re missing is a front door: a single working route a request actually travels through, with someone accountable at each stage. Without that route, adoption keeps happening faster than governance can track it.

What the AI Front Door actually is

The Front Door is a six-step workflow. Any AI tool, whether it’s bought, built, or already in use, moves through it before being trusted with data or business information.

It’s built directly on the NIST AI Risk Management Framework (AI RMF 1.0), whose four core functions are Govern, Map, Measure and Manage. Two steps have been added either side of those four: Triage, to handle intake before a request is assessed at all, and Onboard, to cover the secure provisioning work that happens once a request has been approved but before it goes live.

Each of the six steps has a named owner, a short set of questions to work through, and an exit gate that has to be cleared before the request can move to the next stage.

Anything already running elsewhere in the business goes through the same six steps too, treated as a retrospective baseline rather than an exemption.

A worked example: a sales team’s note-taking assistant

A sales team asks to adopt a note-taking assistant that joins customer calls and produces a summary afterwards. Run through the Front Door, that request looks like this. Triage flags that the tool processes voice recordings and third-party personal data, sets it to Medium tier, and logs the Head of Sales as sponsor. Govern names the Head of Sales as system owner and the CISO as accountable executive, and sets a control baseline requiring customer consent before any recording starts.

Map’s threat model surfaces that the vendor stores transcripts by default for 30 days, which is the kind of finding that needs a contractual change agreed before onboarding continues.

Measure sets an alert threshold if transcript accuracy drops below 90%, reviewed monthly by sales operations.

Onboard provisions a scoped service account limited to the sales team’s calendar and call data, with single sign-on enforced and no standing access to the wider CRM.

Manage picks up ongoing review. If the vendor later adds an agentic feature that lets the assistant action follow-up emails automatically, that change sends the request straight back to Triage, because it alters both the data flows and the oversight model that were originally agreed.

What happens when a tool skips the front door

Using an AI tool in production without clearing Triage and Govern is treated as a policy violation in its own right, not a grey area to be resolved case by case.

Access is revoked, the tool is isolated, and the matter is escalated to the CISO. A retrospective triage and an amnesty registration process typically follow, completed within an agreed window.

Repeated or serious breaches are referred to HR or the risk committee in line with policy. Defining the consequence and recovery path now, before anyone needs it, is what makes the workflow enforceable instead of aspirational.

Where to start this week

Pick one AI tool that’s already live somewhere in the business, even an unofficial one, and run it through Triage this week.

Name an owner for Govern before setting any control baseline. Start the AI Systems Inventory and Risk Register now, even as a spreadsheet, rather than waiting until a full programme is in place.

None of this needs the whole rollout to begin, it just needs one real tool and someone willing to log it.

Frequently asked questions

What is an AI Front Door?

An AI Front Door is a structured review workflow. Every AI tool, whether it’s bought, built, or already in informal use, has to pass through it before being trusted with production data. It gives each request a named owner and a go or no-go decision at every stage, instead of relying on a policy document nobody actively follows.

Is this the same as an AI usage policy?

No. A policy states what’s allowed. The Front Door is the working process that enforces it: the route a request travels through, who signs off at each stage, and what happens if a tool skips it entirely.

We already have AI tools live without formal sign-off. Is it too late to govern them?

No. The workflow is designed to run retrospectively against tools already in use, treating them as a baseline to bring under control rather than an exception to the process.

What framework is the Front Door built on?

The NIST AI Risk Management Framework (AI RMF 1.0). Its four core functions, Govern, Map, Measure, Manage, form the middle of the workflow. Triage and Onboard sit either side of them to cover intake and secure provisioning.

How long does it take to implement?

The workflow itself can be picked up and run within days against a single live use case. Embedding it as standard practice across an organisation, with a maintained AI register and review cadence, is a longer, ongoing commitment.