Can AI Help Govern AI? We Asked Four Models How Midmarket IT Leaders Should Get Started

For many midmarket IT leaders, AI governance today feels a lot like HIPAA did in the early 2000s: important, unavoidable and overwhelming. We asked four leading AI models where organizations should start. Their answers revealed a surprising consensus with a few interesting blind spots.

When HIPAA first arrived in healthcare, I was a green IT director handed a three-ring binder stuffed with hundreds, if not thousands, of pages explaining a new federal law with which my organization suddenly had to comply.

I remember being absolutely bewildered.

I wasn't a lawyer. I wasn't a compliance officer. Yet I was tasked with helping translate these massive federal guidelines into IT-related procedures, policies and controls.

Like many others in the industry at the time, we relied on internal collaboration, consultants, and federal guidance to eventually help us become a HIPAA-compliant facility.

Twenty years later, many midmarket leaders are facing a similar challenge with artificial intelligence.

Everyone agrees that AI governance is important. But fewer seem to agree on what AI governance really means, how much of it is needed to create a governed organization, and perhaps most critical of all—how best to begin implementing it.

If AI had existed when HIPAA was dropped onto my desk, my first instinct would have been to ask it for assistance.

Which raises a timely question: can AI help organizations govern AI? We decided to give it a quick test.

Our Methodology

To test, MES Computing asked four leading AI assistants the same question after starting a fresh session with each:

"You are advising a midsize company with 250-2,500 employees. What are the five most important AI governance practices that should be implemented in the next 12 months, and why?"

The responses came from:

Microsoft Copilot (Version number: 2.20260808.34.0)

Anthropic Claude (Sonnet 5)

Google Gemini (3.6 Flash)

OpenAI ChatGPT (GPT-5.6 Luna)

The results were revealing.

Our Findings

Finding 1

The models agreed far more than they disagreed.

Despite being developed by different vendors and drawing from different sources, all four models provided advice around the same core themes:

Knowing when AI is being used

Assigning ownership and accountability

Managing sensitive data

Controlling shadow AI

Preserving human oversight

Applying governance based on risk

Finding 2

Every model recommended a risk-based approach rather than banning AI.

While each model differed on implementation details, all four recommended risk-based governance rather than blanket restrictions. Copilot argued: "Governing approved use is far more realistic than trying to eliminate usage altogether," while ChatGPT explicitly stated that it would "not treat every use of AI equally." Claude and Gemini similarly recommended classifying AI applications according to risk and applying controls based on potential impact.

Finding 3

Every model viewed shadow AI as inevitable.

All four models assumed employees are already using AI tools throughout the organization. Claude noted employees are "almost certainly using AI tools already, sanctioned or not," while Copilot bluntly asserted, "attempting to ban AI typically fails."

Gemini flagged that employees are likely already entering sensitive information into consumer AI services, and ChatGPT recommended tracking employee "shadow AI" as part of enterprise AI inventory.

Finding 4

The models disagreed on sequencing.

Each model offered different advice on where midmarket IT leaders should begin with AI governance:

Copilot → start with data

Claude → start with inventory

Gemini → start with governance structure

ChatGPT → start with ownership and risk management

Finding 5

Overall, the models did not treat AI agents as a top governance issue.

Despite increasing industry attention on agentic AI, only one model, Microsoft Copilot, made AI agents a prominent governance concern. Copilot recommended assigning ownership to every "AI application and agent" and noted that governance becomes more important as agentic systems gain the ability to take actions rather than simply generate content.

Gemini briefly referenced autonomous AI actions, but Claude and ChatGPT focused primarily on inventories, risk management, oversight and policy.

The lack of emphasis on agentic AI is also in contrast with recent MES coverage highlighting a recurring theme: midmarket organizations are increasingly enthusiastic about AI agents, but governance, visibility, and accountability controls are struggling to keep pace.

Interestingly, the expert's preferred response aligned with the model that prioritized visibility.

(Created with Copilot)

The models largely agreed on what AI governance should include. Their biggest disagreement was where midsize organizations should begin.

[Want to review the complete responses yourself? MES Computing has published the full unedited responses from Copilot, Claude, Gemini and ChatGPT so readers can compare them directly and decide which approach is most useful for their organizations.

Read the full AI model responses here.]

An AI Governance Thought Leader's Reaction

In the spirit of keeping the "human-in-the-loop," MES contacted AI governance practitioner and industry thought leader West McDonald, founder and partner at GoWest.ai, for his feedback on the models' responses (we did not disclose which model said what).

Observation No.1: Visibility Before Governance

For McDonald, the most surprising finding is not where the models disagreed, but where they converged.

"All four models landed in roughly the same place even though they took different routes to get there," he said in a message to MES Computing.

McDonald rated Anthropic Claude's response as strongest overall because it starts with a very practical reality facing midmarket IT: organizations have a hard time tracking how much AI is being used throughout operations.

Or, as McDonald put it, "You can't govern what you cannot see."

Observation No. 2: Governance Doesn't Mean Locking Everything Down

While McDonald largely agreed with the models' recommendations, he felt the responses lacked emphasis on what he considers an important part of a solid AI governance strategy: enablement.

"Governance," McDonald said, "cannot just be a list of things employees are not allowed to do."

He said organizations often make the misstep of focusing exclusively on restrictions, policies, and approval processes while not providing employees with sanctioned alternatives.

"If you do not give people safe, approved AI tools and show them how to use them, Shadow AI is going to keep happening."

McDonald recommends that organizations enable approved AI tools and provide employee education and practical guidance alongside governance policies.

Observation No. 3: AI Agents Need More Attention

McDonald also believes most of the responses underestimated the governance implications of AI agents.

Only Copilot explicitly discussed AI agents and autonomous actions. The other responses focused more on inventories, policies, risk management, oversight and training.

McDonald emphasized that agentic AI governance will become critical as organizations move from chatbots and copilots to autonomous agents.

"That means permissions, logging, human approval and authority levels are going to become a much bigger part of the governance conversation," he said.

Response A = Microsoft Copilot (Version number: 2.20260808.34.0)

Response B = Anthropic Claude (Sonnet 5)

Response C = Google Gemini (3.6 Flash)

Response D = OpenAI ChatGPT (GPT-5.6 Luna)

Takeaways For Midmarket IT Leaders

The experiment revealed that the four AI models agreed more than they disagreed.

All four concluded that AI governance should include:

Accountability and ownership

Visibility into AI use

Human oversight

Risk-based decision making

Data governance and protection

The biggest difference wasn't what the models recommended. It was how they suggested midsize organizations begin their AI governance journeys.

(created with Copilot)

For resource-strapped midsize IT teams, that distinction matters.

Few midsize organizations have the staffing, budget, or in-house expertise to take on every governance challenge.

Instead, McDonald recommends organizations first focus on creating a practical governance program offering approved AI tools and clear employee guidance.

"If a midsize organization could focus on only one governance initiative in 2026, I would build a formal AI acceptable use and governance program tied to sanctioned AI tools."

Ultimately, the experiment suggests the models most AI users work with every day. and ones I would have turned to had the tech been available when HIPAA rolled out. have a surprisingly consistent governance playbook.

The challenge for midmarket IT leaders is certainly not determining if AI governance is important. It's deciding which initiatives to prioritize.

As McDonald put it: "The goal is not to stop people from using AI. The goal is to make responsible AI use easier than irresponsible AI use."