AI governance questions to answer before your project is approved
In this article (7 sections)
Related programme: the Generative & Agentic AI course (3 months).
Before an internal AI project is approved, expect four groups of questions: security (where data goes and who can access it), privacy (whose personal data is involved and on what basis), risk (what happens when the output is wrong), and business ownership (who is accountable and how success is judged). Preparing written answers before the review meeting is the single biggest thing you can do to speed approval.
How to use this question bank
Answers below are models for a fictional internal tool that drafts summaries of customer complaint tickets for a quality team. Replace the specifics. Where an answer depends on your organisation's policy, the model answer shows the shape — you must supply the facts. A reviewer will trust a plain answer with a gap you admit over a polished answer that turns out to be wrong.
Security reviewer
Q: Which service processes the data, and is it on our approved list? Model answer: "The approved enterprise assistant already licensed by IT. I checked the approved-software register on the intranet; the entry is dated and names the permitted data classes."
Q: Is the data used to train the vendor's models? Model answer: "According to our enterprise agreement's data-use terms, which procurement shared with me, prompts and outputs are not used for training. I have attached the clause." If you cannot find the clause, say you have asked procurement.
Q: Who can see the outputs? Model answer: "Only the five members of the quality team. Summaries are stored in the existing ticketing system with its current access controls; no new storage is created."
Q: What stops someone pasting other data into it? Model answer: "The tool is available to everyone already, so the pilot does not add that risk. Our instructions tell users to paste only the ticket text and never payment details."
Privacy reviewer
Q: Does the input contain personal data? Model answer: "Yes. Complaint tickets include customer names, phone numbers and sometimes addresses. We will strip phone numbers and addresses with a simple masking step before the text reaches the tool; names remain because the summary needs to reference the case."
Q: Is this use consistent with the purpose customers were told? Model answer: "Customers gave their details to have complaints resolved. Summarising the complaint to route and resolve it is within that purpose. We are not using the text for marketing or profiling." Your privacy team will judge this against the notice your company actually gave; India's Digital Personal Data Protection Act, 2023 ties processing to specified purposes, which is why they ask.
Q: How long are outputs kept, and can they be deleted? Model answer: "Summaries follow the ticket system's existing retention rule. If a ticket is deleted, its summary field goes with it."
Risk reviewer
Q: What is the worst plausible error? Model answer: "A summary that misstates the complaint — for example, recording a safety issue as a delivery delay — so the ticket is routed to the wrong team."
Q: How would you detect it? Model answer: "The quality analyst reads the original ticket before accepting the summary for every case during the pilot. We will record every correction. If misrouting of safety-related tickets occurs even once, we stop."
Q: Is any decision made automatically? Model answer: "No. The tool drafts; a person decides the route. Nothing is sent to customers."
Q: Does it treat some customers differently? Model answer: "We will check a sample of tickets written in Hindi and Hinglish separately from English ones, because summary quality may differ by language. If quality is worse for one group, we will report that rather than average it away."
Business owner
Q: Who is accountable if it goes wrong? Model answer: "The quality team lead owns the process and the pilot. I own the prompt, the instructions and the measurement."
Q: How will we know it worked? Model answer: "We will compare the median time to route a ticket, including review, against four weeks of baseline data, and count corrections per hundred summaries. We agreed in advance that if time does not fall or corrections exceed what the team considers acceptable, we stop."
Q: What does it cost to stop? Model answer: "Nothing beyond switching back. The existing process is unchanged and runs in parallel."
A one-screen readiness check
Before the meeting, confirm you can answer each of these with a document or a named person, not a belief:
| Question | Evidence to bring |
|---|---|
| Tool approved for this data class? | Register entry or IT email |
| Vendor training / retention terms | Contract clause or procurement reply |
| Personal data fields and handling | Field list with mask/keep decision |
| Purpose consistency | Privacy team's view, or your question to them |
| Worst-case error and detection | Written scenario and review step |
| Stop rule | Agreed in writing with the sponsor |
| Owner | Named person |
Why reviewers ask "boring" questions
Governance teams are not trying to block you; they are the people who answer for incidents. A project that arrives with the evidence table above looks like it was designed by someone who understands that. That impression carries over to your next proposal.
The one-page pilot proposal has space for most of these answers. If the privacy questions are new to you, read DPDP Act basics for data analysts. Designing review steps, masking and evaluation for assistants like this is part of the Generative & Agentic AI add-on.
Frequently asked questions
Who reviews an internal AI project in a typical company?
It varies, but expect some combination of information security, a privacy or legal function, a risk or compliance team in regulated sectors, and the business owner of the process. Smaller companies may have one person covering several of these. Ask your manager who signed off the last new software tool; the same path often applies.
What if I cannot answer a governance question?
Say so and say how you will find out. "I don't know yet; I will confirm the vendor's data retention terms with procurement by Friday" is an acceptable answer. Guessing is not, because reviewers will check.
Pankit Kumar has 10 years in Data Science & AI, building and shipping production systems in regulated pharma and clinical environments. He is a freelance trainer at Boston Institute of Analytics, AnalytixLabs and Scaler, and has taught this material to thousands of working professionals.
This article is part of our Generative & Agentic AI programme — 3 months. Add practical GenAI, retrieval and agent-building skills to your existing toolkit.
Explore Generative & Agentic AI