Visit the full site
A Hive Advisory Group brief

Ten steps to AI governance

What McKinsey, BCG, Bain, Deloitte, PwC, EY, KPMG and Gartner agree on about governing AI, consolidated into ten steps and sized for mid-market leadership teams.

  • Seven pages, with every figure attributed to its source
  • What each step looks like at mid-market scale
  • A 90-day sequence and a map to the NIST AI Risk Management Framework

Get the brief

The brief is free. A work email address is all we ask for.

Work email addresses only. We may follow up with you about the brief. Privacy policy

Your brief is ready.

Thank you. The PDF opens in a new tab.

Download the brief (PDF)
One more thing
What is inside

Ten steps, each with the question it answers

For each step the brief sets out what the published research says, with the source cited, and what the step tends to look like in a mid-market company.

  1. Ownership at the topWho answers for AI in this business?
  2. A stated risk appetiteWhat will we accept, and what is off the table?
  3. An inventory of the AI already in useWhere is AI already at work here?
  4. A reconciliation against commitmentsWhat have we already promised in writing?
  5. Risk tiers for use casesWhich uses need the most attention?
  6. A policy people can followDo employees know what is expected of them?
  7. Terms for vendors and third-party AIWhat are suppliers doing with AI, and with our data?
  8. Controls for AI agentsWhat may an agent do, and who signed off?
  9. Monitoring, testing and an incident planHow would we know if something went wrong?
  10. A review rhythm, with tooling chosen to fitHow does this keep pace as AI changes?
From the research

Three findings that frame the brief

Most of the published surveys draw mainly on large enterprises. The brief notes the survey population wherever it matters.

1 in 3

About a third of organizations reach level three or higher, on a four-level scale, in AI strategy, governance and controls on AI agents.

McKinsey, AI Trust Maturity Survey, 2026
21%

Of companies planning to deploy AI agents within two years, the share that report a mature model for governing them.

Deloitte, State of AI in the Enterprise, 2026
40%

Of employees say their workplace has a policy or guidance on the use of generative AI.

University of Melbourne and KPMG, 2025

The brief summarizes and interprets published research by the organizations named. Hive Advisory Group is independent and is not affiliated with, sponsored by or endorsed by any of them. Full sources are listed in the brief.

Prefer to talk it through?

Fifteen minutes with a senior advisor is usually enough to know whether there is something worth pursuing.

Book a 15-minute call Get the brief