Nobody grows up wanting to do AI governance.

No seven-year-old has ever looked up from a drawing of a fire engine and announced that what they really want to do, one day, is maintain a control evidence library with accurate expiry dates.

It’s not on the careers-day posters. There is no governance equivalent of the astronaut, the vet, or the person who tests rollercoasters for a living. And yet here you are — or here someone in your building is — quietly holding the whole thing together, armed with a spreadsheet, a healthy suspicion of the word “FINAL” in a filename, and the patience of a saint who has been asked “is this high-risk?” eleven times before lunch.

This one’s for them. No method, no framework, no number to defend. Just a fond field note about the least glamorous, most load-bearing job in the modern organisation.

A row of labelled binders on a wooden shelf, illuminated by a warm desk lamp against an evening window — The shelf. The lamp. The quiet evidence of someone who actually keeps things in order.

01You can spot them by what they say

Every governance person has a small repertoire of phrases, deployed with the weary precision of a customs officer who has heard every excuse.

A person reading a document at a desk late in the evening — “Where did this number come from?” — asked gently, the first time. Less gently, the fourth.

An open notebook with handwritten notes beside a pen, glasses, and a cup of coffee — “Who owns this?” — a question that can clear a meeting room faster than a fire alarm.

A person leaning back in their chair with a coffee, smiling quietly — “Define ‘soon.’” — the most powerful three words in compliance.

And the quiet classic, usually said to no one, at 6pm, to a screen: “We have a policy for this. I know we do. I wrote it.”

If you’ve said any of these out loud, alone, you are among friends.

02The job is mostly noticing

Here is the thing outsiders miss. The governance person isn’t the one who says no. That’s a cartoon. The good ones are the ones who notice — who spot, three weeks before anyone else, that a shiny new AI tool has appeared in the marketing stack and nobody told a soul, that it’s quietly ingesting customer data, and that “we’ll sort the paperwork later” has the structural integrity of a chocolate teapot.

Noticing: the underrated superpower

It’s the colleague who reads the policy before signing it. The one who asks what happens to the data when the trial ends. The one who says “lovely — who’s accountable when it gets something wrong?” and is met with the specific silence reserved for people who have ruined a nice moment by being correct.

They are, in the most literal sense, the person standing between the organisation and a wall it can’t see. The reward for stopping you from hitting the wall is that nothing happens, which is famously difficult to put on a slide.

03The unsung pleasures of an updated register

Let us speak, briefly and without irony, in praise of the well-kept register.

There is a genuine, low-key joy in opening a governance system and finding everything where it should be. Every AI system has an owner. Every control points to evidence. Every piece of evidence has a date that is not alarming. Nothing is amber for mysterious reasons lost to history.

It is the spreadsheet equivalent of a tidy spice rack, and the people who maintain it experience the same small, private satisfaction as someone who has just labelled all the jars. A feeling known to governance teams everywhere

It never lasts, of course. Entropy comes for every register. Someone adds a tool, someone leaves and takes the context with them, an evidence document expires at the worst possible moment. The job is less “build the cathedral” and more “repaint the bridge” — by the time you reach the far end, the near end needs doing again. There’s a peace to be made with that, and the best governance people have made it.

04In defence of the boring word

“Governance” is a deeply unsexy word. It sounds like committees. It sounds like a meeting that could have been an email about a meeting. Marketing departments would rather eat their lanyards than put it on a homepage, which is why it usually hides behind friendlier words like “trust” and “responsibility.”

But strip the dullness away and governance is just this:

Being able to answer for the thing you’ve built.

Not preventing progress — accounting for it. The ability to look someone in the eye and say “yes, we use AI for that, here’s how we make sure it behaves, and here’s how I’d prove it.”

That’s not bureaucracy. That’s the difference between an organisation that knows what it’s doing and one that’s hoping.

Put like that, it’s almost heroic. Almost. Let’s not go too far; there are still spreadsheets involved.

05A small thank-you

So this is for the person who reads the policies. Who keeps the register honest. Who has explained the difference between inherent and residual risk to a room that was checking its phones, and explained it again the next week, and didn’t sigh audibly. Who treats “it’s probably fine” as the beginning of a conversation rather than the end of one.

You will never get a careers-day poster. There will be no film where a tense governance lead defuses a risk register with seconds to spare while a clock ticks. The work is invisible precisely when it’s working, which is a cruel deal for anyone who likes credit.

Before you go

You know the evidence on row 14 expired on Tuesday. Go and update the register. We’ll wait.

But the company is still standing, the board still has answers when it asks for them, and the wall — the one nobody else could see — went unhit again this quarter. That was you. Quietly, unglamorously, correctly: that was you.

We built our whole platform, in the end, to make that invisible work a little more visible — and a lot less lonely. Mostly, though, we just wanted to say: somebody noticed the noticing.