Eight questions every CIO should ask about AI governance and sovereignty

There is a point in almost every organisation’s AI journey when the conversation changes. 

At first, the focus is understandably on possibility. Organisations will ask which use cases are worth pursuing or whether models can summarise documents more quickly, improve customer service or help teams make better decisions. Early pilots will be judged on whether the technology works at all.  

But once AI begins to move into everyday operations, the questions become more demanding. It is no longer enough to know that a tool can generate a useful answer. Leaders need to understand where the data behind that answer has come from, which model processed it, what it cost, who can intervene if something goes wrong and whether the organisation can explain those decisions to a regulator, customer or board. 

That is the shift from experimenting with AI to operating it. For CIOs, governance and sovereignty should not be treated as constraints imposed on innovation once the interesting work is done. They are the conditions that make large-scale adoption viable. When organisations can see, direct and account for how AI is being used, they are in a much stronger position to innovate with confidence. 

These are eight questions I believe every CIO should be asking before AI moves from a promising initiative to a business-critical capability.  

1. Do we know where AI is being used?

AI adoption does not always happen through a central programme. Teams often introduce tools to solve an immediate problem; drafting content, analysing documents or helping developers work faster.  

That initiative can be valuable, but it can also leave businesses unable to see what data is entering AI systems, where it is being processed or who is responsible for it. An apparently simple ask may handle sensitive customer, commercial or internal information so before setting policy, organisations need a clear picture of reality with a focus on which AI tools are being used, who’ll be using them and for what purpose. 

2. Can we allocate AI spend to the teams, projects and applications creating it?

AI costs are not as predictable as a conventional software licence as spending varies according to model choice, user volumes, prompt size, workload complexity and the number of model calls involved. This becomes particularly important with agentic workflows, where one user request can trigger a chain of actions, data retrievals and model interactions. Without cost attribution, a growing AI bill becomes difficult to explain or manage. CIOs should be able to connect consumption to the teams, applications and processes creating it and then assess whether the investment is delivering proportionate value.

3. Are workloads routed according to value, risk, latency and sovereignty requirements?

Different AI workloads need different levels of speed, security, control and proximity to data. A low-risk internal assistant has very different requirements from an application handling regulated or commercially sensitive information. The key is not choosing one model or deployment environment for everything, but rather deliberately matching each workload to the appropriate model, infrastructure and location, based on its risk profile, business value, latency requirements and sovereignty obligations.  

A one-size-fits-all AI architecture is rarely efficient and intelligent routing provides the flexibility to use the right capability for the right task, in the right place. 

4. Are budgets, alerts and quotas active before a wide rollout?

A pilot used by a small group may appear inexpensive and straightforward but once scaled across an organisation usage can increase rapidly, particularly when an application calls multiple models or systems behind the scenes. 

Budgets, quotas, alerts and approval thresholds should be built into deployments before broad access is granted to prevent useful experimentation unintentionally becoming an unmanaged operational cost. The goal is to give teams the freedom to test and innovate while maintaining a clear view of consumption and exposure. 

5. Can we explain which model handled a request, where it ran and which policy applied?

A governed AI environment should make it possible to answer a few basic questions. For instance, which model processed a request? What data was involved? Where was it processed? Which policy applied? This is especially important in regulated and high-trust sectors. Businesses may need to demonstrate that sensitive information was handled in an approved environment, that users had the right access and that the right controls were applied.

Data residency matters, but sovereignty goes further as a measure of control on who has access, what jurisdiction applies and whether the organisation can evidence how its AI environment operates.

6. Are we measuring AI against business outcomes, not raw token counts?

Token use, model-response times and system availability are useful operational measures but they do not show whether AI is creating business value. 

The more meaningful question is whether AI is delivering useful work at an acceptable cost and speed. That might mean enabling engineers to resolve incidents faster, helping procurement teams compare complex supplier information or allowing frontline staff to make more informed decisions in the moment. Cost per token is an input and CIOs need measurement frameworks that connect AI consumption and performance to the business results the organisation is trying to achieve. 

7. Are we managing context deliberately?

AI needs relevant context, such as product information, customer records or internal knowledge – sending more information with every prompt does not necessarily produce a better result. 

Unnecessary context increases processing costs, can slow responses and introduces additional data-governance considerations. Organisations should ensure that applications retrieve only the information needed for the task, rather than passing entire archives or long conversation histories by default. It’s the same as asking a technician to identify a fault in one part of a machine – they would need the relevant diagnostic information, not the complete history of every component ever installed. Good context management is a practical way to improve performance, control costs and reduce unnecessary data exposure. 

8. Who owns the overall AI operating model?

AI involves technology, data, security, legal, compliance, finance and business teams. Each has an important role, but shared involvement can become fragmented accountability without a clear operating model. CIOs should be able to answer practical questions and have clear answers, such as who approves a new model, deciding whether a workload can process data in a different region or who intervenes when costs rise or a control fails. The answer requires decision rights, ownership and escalation paths to be clear to mitigate risk of collecting isolated AI experiments, rather than building an AI capability that can scale. 

Embedding AI operations in business processes 

These eight questions reflect a wider change in enterprise AI where the first phase of adoption – proving that AI could work – has shifted to proving it can operate reliably at scale, within the right governance framework, in the right location and with clear accountability. 

The businesses that succeed with AI will not simply be those that adopt the fastest. They will be those that treat governance and sovereignty as foundations for innovation, enabling them to scale intelligence while retaining control of performance, cost and compliance.