The hazards are already on the floor. Are you running AI like a health and safety problem?

"The policy you haven't written isn't protecting you. It's just making sure you're the last to know”.

A senior business leader I spoke with this week knows her team is using AI. She just can't tell you how, where or what it's touching.

Her organisation has done the responsible thing. Guidelines are in place. The intent is right. But the full governance framework hasn't rolled out yet. That's where a lot of businesses trip. You can't see the end state. You can't draw the full pathway. You can't tell your team what you're rolling out, because you haven't worked it out yet.

Meanwhile your team keeps using AI anyway. No shared view. No register. No rhythm. The exposure is already in the building. The policy you haven't written isn't protecting you, it's just making sure you're the last to know.

Governance is simpler than you think

Here’s the key. Governance isn't a document. It's three things. Visibility, capability, communication. And you already run a system built on all three. You call it health and safety.

Think about how H&S actually works. You don't write one safety manual and call it done. New equipment arrives. New tasks emerge. New hazards show up. So the system is built to move. You spot hazards. You log them. You match the tool to the operator. You review on a rhythm. It starts on the floor, with the people doing the work, not in a boardroom.

AI governance needs to run the same way. Not a document you perfect and freeze. A practice you keep alive in conversation. The hazards move. The system has to move with them.

The forklift principle

Think about the last time a forklift arrived at a site. You didn't hand the keys over. You identified the risks. You looked at who would be operating it. You decided what training, certification and supervision were needed before anyone touched it. Not because the forklift was banned. Because risk in the wrong hands is different from risk in the right hands.

AI tools are the same. One tool can be benign in one team's hands and dangerous in another's. The question is not "is this tool safe?" It's "is this person ready for this tool, in this context, with this data?"

You don't remove the risk. You match the capability and manage what's left. That is governance.

The three things you actually run

Strip it back to first principles. There are three.

1.        Visibility.

Start the conversation. Ask the team what they're actually using, where it helps and what makes them nervous. This is your hazard walk. You are not auditing to catch anyone out. You are surfacing what is already happening so you can see it. The whole thing depends on creating an environment where people will tell you the truth. In most businesses, this one conversation uncovers more than any policy ever would.

2.        Capability matching.

Once you can see the tools, match them to the people. Who can use what, with what data, under what supervision. This is the forklift principle applied to AI tools. The work isn't to remove risk. It's to align the tool with the operator.

3.        Communication.

The system only works if people keep telling you what's changing. A new tool. A new risk. A new use case. Build the habit of raising things as they come up, not just at scheduled meetings. Then put a recurring review on the calendar, monthly to start, to consolidate what's surfaced and decide what changes. The hazards evolve, so the system has to. A register you write once and never reopen is just a slower way of doing nothing.

That's the loop. Visibility, capability, communication. Then around again.

"You don't need to understand AI perfectly to govern it. You need to see what's happening, match the tool to the operator, and keep the conversation going."

What this looks like on Monday

Back to the leader I opened with. She doesn't need to see the end state to start. She doesn't need the full pathway drawn. She just needs to begin the conversation.

How she does it is up to her. A team meeting. A short survey. A series of one-on-ones. The format doesn't matter. The framing does. Something like: “We want to roll out AI safely. We don't have all the answers yet. We're beginning the conversation, and we want to hear from you. What are you using? What would you like to use? Why? And what worries you about it?”

That's the hazard walk. The answers populate the register. The register starts the rhythm.

She can see her hazards before the week is out. The policy, if and when she needs a formal one, writes itself later. By then, she'll know what she's actually governing.

Start here

1.        Start the conversation.

A meeting, a survey, a series of one-on-ones. Whatever fits your business. Lead with the framing: we want to roll AI out safely, we don't have all the answers, and we want to hear from you. Then ask what people are using, what they'd like to use, and what worries them. Make it safe enough that they'll actually tell you.

2.        Open the register.

One page. Tool, use, who is using it, what could go wrong. Fill it in live as the conversation happens.

3.        Set the review date.

Put a monthly slot in the calendar before you leave the room. The recurring conversation is what makes it governance and not a one-off.

You don't need to understand AI perfectly to govern it. You need to see what's happening, match the tool to the operator and keep the conversation going. You already know how to do this. You do it every day to keep your people safe.

Stop waiting for the policy. Start the conversation. The hazards are already on the floor.

Start your AI hazard walk

In five minutes find out if your business has AI under control, or just hopes it does.

Take the 5-Minute AI Risk Snapshot

--

About the Author 

Mark Lucas is Co-founder at Generation AI, where we help New Zealand business leaders build real AI capability.

Information provided is general in nature and does not constitute legal advice