AI governance culture: the policy is not the practice

AI governance culture is the half of governance that doesn’t fit in a policy document: what your people actually do with AI when no review board is watching. The formal half is well mapped — the NIST AI Risk Management Framework, the EU AI Act, OECD principles, model inventories, acceptable-use policies — and if you search this topic, that apparatus is nearly all you’ll find, with culture appearing as one dutiful subsection. This page inverts the proportions, because in practice the proportions are inverted: the policy stack governs the AI systems you know about, and culture governs everything else, which is most of what’s happening.

What the policy layer can’t see

Formal governance operates on declared usage: the sanctioned tools, the registered models, the workflows someone wrote down. Meanwhile the actual AI surface of your organization is every employee with a browser, and their usage is governed by a different document — their private read of what happens to people who are honest here.

That read decides the questions governance actually depends on. Does the analyst mention that the first draft came from a model, or present it as hand-built? Does the engineer report the subtle hallucination that made it into a customer email, or hope nobody traces it? Does the team that found a brilliant unsanctioned workflow disclose it for review, or keep a good thing quiet? No policy controls these calls. Culture does, and each answer either feeds your governance real information or starves it.

The misconception: govern harder

The instinct, especially after an incident, is more apparatus: “we need tighter AI policies and real enforcement.” And enforcement does change behavior — it changes where the behavior happens. Punish disclosed mistakes and you get undisclosed mistakes. Make the review process slower than the workaround and you’ve made the workaround rational. The dashboard improves either way, which is the trap: adoption and compliance look the same from a dashboard. Surface compliance is what speed-without-safety produces, and it’s worse than visible non-compliance, because it’s unaudited risk wearing a green checkmark.

The replacement idea: governance is a reporting system, and reporting systems run on safety. The base question, borrowed from LeaderFactor’s AI readiness work, is the cultural keystone: can people be bad at this without being punished? An organization where admitting “the model misled me and I almost shipped it” is treated as valuable telemetry will find its risks early. An organization where that sentence ends careers will discover its risks in production, via a customer, with counsel on the call.

This is psychological safety doing governance work. In LeaderFactor’s 4 Stages terms, error reporting is learner safety applied to AI, and “this sanctioned workflow is worse than my workaround” is challenger safety — and both have to be true about AI specifically, where competence anxiety runs highest.

The behaviors that make it real

Culture is built from what leaders visibly do, and four behaviors carry most of the load:

• Disclose your own AI use, failures included. A VP who says “I drafted this with a model and it invented two citations; here’s what I now check” has issued a license worth more than the policy PDF. Modeling goes first; it always goes first.
• Treat reported errors as system information. The first response to “the model got this wrong and I caught it late” sets the price of the next report. Thank the reporter, fix the checking step, and say what changed — that’s an incident pipeline being born.
• Keep review faster than workaround. Every day the sanctioned path is slower than the shadow path, the culture drifts shadow-ward. Governance that wants to be obeyed has to be usable.
• Close the loop publicly. When a disclosure improves a guardrail, announce the lineage. People report into systems that visibly do something with reports.

It’s a Monday in June at a wealth-management firm in Charlotte, and the compliance director is reviewing quarterly AI attestations: 100% policy acknowledgment, zero reported incidents. Then an offhand comment at lunch unravels it — an associate mentions the “prompt doc” her team quietly maintains for a tool that isn’t on the sanctioned list, and has been drafting client communications for eight months. The attestations weren’t lies, exactly. They were the output of a system where the honest sentence had no safe place to land. Her actual governance program starts that afternoon, and its first project isn’t a policy. It’s making the next eight-months-late discovery arrive in week one.

Where this sits in the discipline

Governance culture isn’t a standalone program; it’s the trust layer of the broader operating discipline covered in AI leadership — the Define-through-Demonstrate sequence assumes people will tell you the truth about what’s working. The change side (AI change management) and the adoption side (AI adoption in the workplace) run on the same substrate. The AI Leadership skill builds the leader behaviors; the Psychological Safety skill builds the base layer under them.

Start with an audit no framework requires: ask three teams what AI tools they actually use, and watch the pause before they answer. The length of that pause is your governance culture, measured.