Most mid-sized companies now have some kind of AI policy. Fewer have a person who checks whether it is being followed. That gap is a hiring problem as much as a technology one.
A policy in a shared drive does not control anything. Controls live in the systems: who can reach which data, which tools are approved, what gets logged. Someone has to build those controls and someone has to watch them. If neither job belongs to a named person, the policy stays on paper.
Where governance breaks down
The pattern is familiar to anyone who has run operations through a period of fast change. Adoption moves quickly, oversight follows later, and the gaps show up in a few predictable places:
- Teams sign up for AI tools on their own, with company data, and no one in IT or finance knows
- Rules are applied differently from one department to the next
- Data moves between systems without clear limits on who can see it
- Risk reviews arrive after deployment, so they slow things down instead of shaping the work
None of these is fixed by another memo. They are fixed by putting controls into the platforms your people already use, and by assigning accountability.
Why the platform matters
When your data, applications and AI tools sit in a connected environment, you can manage access by role, keep an audit trail and flag unusual activity. When they are scattered across spreadsheets, local tools and separate vendors, you cannot. Governance is only as consistent as the systems underneath it.
Public frameworks such as the NIST AI Risk Management Framework describe the same idea: set up governance structures, identify risks, measure how systems perform, and manage them over time. That is ongoing work, not a one-time review. It needs people with time set aside for it.
The roles that make it real
You do not need a large team. You do need the right few people, and you need to be clear about who does what.
- A cloud or platform engineer who sets up identity, access and logging so that controls are enforced by the system
- A data engineer or data steward who knows where sensitive data sits and how it moves
- An AI or machine learning lead who can explain what a model does, where it can fail and how to test it
- A risk, compliance or internal audit contact who reads the logs and reports to leadership
- An executive owner, often the COO, CFO or CIO, who is accountable when something goes wrong
In a company of 200 to 800 people, one person often covers two of these. That is fine, as long as the coverage is written down and the person has the authority to say no to a tool or a data request.
Permanent hire or contract
Not every piece needs a permanent seat. A rough guide:
| Work | Usually better as |
|---|---|
| Setting up access controls and logging | Contract, project-based |
| Auditing existing AI use across departments | Contract |
| Day-to-day monitoring and data stewardship | Permanent |
| Executive accountability | Permanent, existing leader |
A contract specialist can build the foundation in a few months. The risk is that the knowledge leaves with them. Make sure a permanent employee shadows the work and holds the documentation before the contract ends.
What to ask when you hire
Governance candidates are easy to oversell. A few questions separate people who have done the work from people who have read about it:
- Describe a control you built that actually stopped a bad outcome. What was it?
- How did you find tools staff were using without approval, and what did you do next?
- How do you handle a business unit that says the review is slowing them down?
- Which parts of this did you own, and which did you advise on?
Look for people who talk about working with operations and finance teams, not around them. The best governance people make it easier for others to move, because the rules are clear and built into the tools.
Canada and the US
Rules differ by jurisdiction and by industry. Privacy obligations in Canada, state-level requirements in the US and sector rules in areas like health or financial services all affect what your controls must do. If you operate across the border, ask candidates what they have supported in both markets, and involve legal counsel early. A hire can build the system, but counsel should confirm the requirements.
What to do next
Start with a simple inventory: which AI tools are in use, who approved them and what data they touch. Then name one owner and decide which of the roles above you already have. The gaps tell you what to hire or contract for. If you want help finding AI, data or cloud people who have done this in a real operating business, a Traverse recruiter can help.