Full Responses: What Copilot, Claude, Gemini And ChatGPT Told Us About AI Governance

MES Computing asked four leading AI models the same question about AI governance for midsize organizations. Here are the complete responses, unedited.

As part of our analysis,"Can AI Help Govern AI? We Asked Four Models How Midmarket IT Leaders Should Get Started," we asked Microsoft Copilot, Anthropic Claude, Google Gemini, and OpenAI ChatGPT the same question in separate, fresh sessions with no follow-up prompts or steering. Here are the complete responses so readers can review them and draw their own conclusions.

[RELATED: Can AI Help Govern AI? We Asked Four Models How Midmarket IT Leaders Should Get Started]

Microsoft Copilot (Version number: 2.20260808.34.0):

For a midsize organization (250 to 2,500 employees), I would argue that the next 12 months should be less about creating a massive AI bureaucracy and more about putting practical guardrails around how AI is actually being used. The biggest governance failures today tend to come from unmanaged data access, shadow AI, unclear accountability, and a lack of oversight, not from sophisticated model-development mistakes. This aligns with both industry guidance and the governance themes appearing repeatedly in your organization's AI governance coverage.

1. Establish Clear AI Ownership and Accountability

Why it matters: If nobody owns an AI system, nobody owns its risks.

Every AI use case should have a named business owner, not just an IT owner. Someone should be responsible for approving the use case, defining acceptable outcomes, and determining when the system should be paused or retired. Several governance frameworks emphasize accountability as the foundation of responsible AI adoption.

What to implement:

AI governance committee with IT, security, legal, HR, and business representation

Named owner for every AI application and agent

Approval process before any AI system moves into production

Executive-level oversight for high-risk use cases

The payoff: Faster decision-making, clearer accountability, and fewer "who approved this?" moments when something goes wrong.

2. Put Data Governance Ahead of AI Governance

Why it matters: Most AI failures are actually data failures.

AI systems can only be trusted if organizations know what data the systems can access, who owns it, and whether it contains sensitive information. Recent governance discussions increasingly focus on controlling how AI interacts with enterprise data, not merely governing model behavior.

What to implement:

Data classification policies

Named owners for critical datasets

Access controls and least-privilege permissions

Rules defining what data may and may not be entered into AI tools

Controls around customer, financial, intellectual property, and regulated information

The payoff: Reduced risk of information leakage, compliance violations, and expensive remediation projects later.

3. Create An Approved AI Tools Program

Why it matters: Employees are already using AI.

Your own internal research highlights shadow AI as a growing challenge, with many employees using AI tools outside approved channels. Attempting to ban AI typically fails. Governing approved use is far more realistic than trying to eliminate usage altogether.

What to implement:

List of approved AI tools and services

Clear acceptable-use policy

Requirements for vendor security reviews

Standards for purchasing or subscribing to new AI products

Central inventory of AI systems and agents

The payoff: Greater visibility into AI use while enabling innovation rather than blocking it.

4. Require Human Oversight for High-Impact Decisions

Why it matters: AI should assist decisions, not silently make them.

Many organizations are discovering that governance must define where human review remains mandatory. This becomes even more important as agentic AI systems gain the ability to take actions rather than simply generate content.

What to implement:

Risk-tiering framework (low, medium, high)

Mandatory human review for:

Hiring decisions

Customer disputes

Financial approvals

Security actions

Regulatory filings

Escalation procedures for questionable AI outputs

The payoff: Lower legal, ethical, and reputational risk while maintaining trust among employees and customers.

5. Build Monitoring, Auditing, and Documentation Into Every Deployment

Why it matters: Governance only works if you can prove it.

One recurring theme in governance frameworks is that mature organizations document decisions, maintain audit trails, and monitor AI systems after deployment. Organizations that can demonstrate governance are often far more confident in audits and regulatory reviews.

What to implement:

AI deployment checklist

Logging of prompts, outputs, and actions where appropriate

Model performance reviews

Bias and accuracy testing

Incident response process for AI-related failures

Annual governance audits

The payoff: Audit readiness, stronger compliance posture, and early detection of problems before they become public incidents.

If I Were a Midmarket CIO Starting Tomorrow...

I would focus on these priorities, in order:

Data governance and access controls

Approved AI tools policy

Named ownership for every AI use case

Human-review requirements for high-risk decisions

Audit trails and monitoring

The biggest mistake midsize companies make is treating AI governance as a compliance exercise. The organizations getting the most value from AI are the ones that treat governance as an operating model that enables safe adoption at scale. As one governance expert put it in your organization's podcast coverage: governance starts with defining what AI is allowed to do, what data it can access, who is accountable, and how risk is managed.

SOURCES:

MES Computing (in-house AI), Pivot Point Security, Helium42m Data-Sleek, Hartman Advisors, Data-Sleek, Haney Strategy, ForgeAgenticAI

Anthropic Claude (Sonnet 5):

Five AI Governance Priorities for the Next 12 Months

For a company in the 250–2,500 employee range, you're past the "everyone just uses ChatGPT informally" stage but well short of having the compliance infrastructure of a Fortune 500. That gap is exactly where risk concentrates — you have real AI usage and real exposure, but usually no formal ownership of it. Here's where I'd focus.

1. AI Inventory and Risk Tiering

You can't govern what you don't know exists. Most midsize companies discover they have AI embedded in customer support tools, HR screening software, marketing platforms, and dozens of employee-adopted tools like ChatGPT or Copilot — often with no central record.

Why first: Every other governance practice depends on knowing what you're governing. Build a living inventory (owner, purpose, data touched, vendor vs. in-house) and tier each use case by risk — e.g., a low-risk internal writing assistant vs. a high-risk system influencing hiring, credit, or medical decisions. Regulations like the EU AI Act and emerging U.S. state laws (Colorado, Illinois, others) are increasingly risk-tiered, so this also sets you up for compliance work later.

2. A Clear, Enforceable Acceptable Use Policy

Employees are almost certainly using AI tools already, sanctioned or not. Without a policy, you get inconsistent, ad hoc decisions about what's okay — often made by whoever's closest to the deadline.

Why it matters: This is the highest-leverage, lowest-cost control available. It should cover what data can and can't go into external AI tools (especially customer PII, source code, financials), which tools are approved, and disclosure expectations (e.g., do customers need to know AI touched their support ticket). Pair the policy with actual training — a PDF nobody reads doesn't change behavior.

3. Human Oversight for Consequential Decisions

Any AI system that materially affects people — hiring, firing, credit, pricing, medical or legal outcomes — needs a defined human-in-the-loop checkpoint, not just a disclaimer.

Why it matters: This is both an ethical and legal necessity. Regulators (and plaintiffs' attorneys) are increasingly focused on automated decision-making, and several jurisdictions now require disclosure or human review for high-stakes AI use. It's also where reputational damage concentrates — a biased hiring algorithm or a wrongful denial makes headlines in a way that a clunky chatbot doesn't.

4. Vendor and Third-Party AI Due Diligence

Most midsize companies get their AI exposure through vendors, not in-house models. If a vendor's AI feature mishandles your data or produces a discriminatory outcome, you're still accountable to your customers and regulators.

Why it matters: Add AI-specific questions to procurement and contract renewal: What data trains their models? Is your data used for training at all? What are their bias-testing practices? Do they support audit rights? This is cheap to implement now and expensive to retrofit after a vendor incident.

5. Incident Response and Escalation Path

When something goes wrong — a hallucinated output sent to a customer, a data leak through a chat tool, a biased outcome — there needs to be a predefined path: who's notified, who decides remediation, whether legal or PR gets looped in.

Why it matters: Most midsize companies have this for cybersecurity but not for AI specifically, and the failure modes are different enough (e.g., an AI confidently fabricating a policy to a customer) that generic IT incident response doesn't map cleanly. This doesn't need to be elaborate — a short runbook and a named owner is enough to start.

A note on sequencing: practices 1 and 2 are foundational and genuinely achievable in weeks, not months. Practices 3–5 take longer because they require cross-functional buy-in (legal, HR, procurement), so I'd start those in parallel but expect them to mature over the full 12 months rather than landing all at once.

One thing worth flagging: I'm not a lawyer, and AI-specific regulation is moving fast and varies by jurisdiction and industry (healthcare, finance, and hiring all have distinct rules layered on top of general AI governance). I'd treat this as a solid operational starting framework, but loop in counsel before finalizing policy language, especially for anything touching employment or consumer protection law.

SOURCES: NIST, EU AI Act, Colorado's revised AI law, Sentinel One, RansomLeak, Norton Rose Fulbright, Crowly Law LLC, Ogletree, Mitratech

Google Gemini (3.6 Flash)

For a midsize company (250–2,500 employees), AI governance cannot be a bureaucratic roadblock, nor can it be ignored. Organizations in this size range need proportionate governance—agile enough to maintain speed and innovation, but structured enough to mitigate legal liability, data leakage, and operational errors.

The 5 Essential AI Governance Practices

1. Establish a Lean, Cross-Functional AI Steering Committee

Why it matters: Midsize organizations don't need a massive, dedicated compliance department, but leaving AI decisions isolated within IT or ad-hoc department heads leads to uncoordinated risk.

How to implement it: Form a monthly governance body made up of key leaders: IT/Security, Legal/Compliance, HR, and core Business Unit leads. Assign an executive sponsor (e.g., CTO, COO, or General Counsel) to own final decision authority. This committee acts as the single entry point for evaluating new AI projects, vendor requests, and policy updates.

2. Roll Out an Acceptable Use Policy & Address "Shadow AI"

Why it matters: Employees are likely already pasting proprietary source code, customer records, or internal strategy into consumer LLMs. Unsanctioned AI usage creates major intellectual property loss, data breach exposure, and regulatory compliance violations.

How to implement it:

Draft a plain-language AI Acceptable Use Policy defining acceptable tools, prohibited data types (e.g., PII, trade secrets), and copyright/IP guidelines.

Deploy automated discovery tools (e.g., CASB/web gateway filters) to identify unsanctioned SaaS tools across the company.

Provide employees with sanctioned, enterprise-tier alternatives (e.g., enterprise LLMs with data opt-out guarantees) so they do not feel forced into workarounds.

3. Build a Centralized AI Inventory & Tiered Risk Classification

Why it matters: You cannot govern what you don't track. A draft generator for social posts carries minimal operational risk, while an automated resume parser or financial credit model carries high regulatory exposure (such as the EU AI Act or US state privacy laws) and bias risks.

How to implement it: Create an organization-wide registry cataloging every active AI tool, internal model, and embedded vendor AI capability. Categorize each use case into a simple 3-tier risk system:

Low Risk: Internal productivity, drafting support, routine administrative tasks.

Medium Risk: Customer-facing chatbots, internal data search, code deployment.

High Risk: Automated hiring decisions, performance evaluations, financial scoring, or critical operations.

4. Upgrade Third-Party & Vendor AI Risk Assessments

Why it matters: Midsize companies buy roughly 80% or more of their AI capabilities through third-party vendors (Salesforce, Microsoft, HR platforms, specialized SaaS) rather than building models from scratch. If a vendor trains public models on your customer data or suffers algorithmic drift, your organization bears the fallout.

How to implement it: Integrate mandatory AI questions into standard vendor procurement and contract renewal workflows:

Is enterprise data used to train foundation or third-party models?

What are the data residency, encryption, and logging standards?

How are model updates, hallucinations, and security vulnerabilities communicated?

5. Mandate "Human-in-the-Loop" Controls & Staff Assurance Training

Why it matters: Autonomous AI actions and unverified model outputs lead to costly hallucinations, biased customer decisions, and operational mistakes.

How to implement it: Enforce explicit Human-in-the-Loop (HITL) approval requirements for all medium- and high-risk outputs before they reach customers, partners, or executive decisions. Train employees on assurance literacy—teaching staff how to critically audit, fact-check, and challenge AI recommendations rather than blindly accepting them.

12-Month Execution Roadmap

Phase, Months, Primary Objective, Key Deliverables

Foundation, Months 1–3, Governance setup & baseline visibility, Form Steering Committee, publish Acceptable Use Policy, perform initial AI inventory scan.

Control, Months 4–6, Risk classification & vendor controls, Implement 3-tier risk framework, update procurement contracts, secure enterprise AI licenses.

Operationalization, Months 7–12, Workflows & continuous monitoring, Embed HITL review workflows, launch workforce assurance training, conduct bi-annual governance reviews.

Sources: Domo, Marantis, Thinking Inc., Wipfli, TTMS, Partnership on AI

OpenAI ChatGPT (GPT-5.6 Luna)

For a 250–2,500 employee company, I would avoid building a heavyweight “AI bureaucracy.” The goal for the next 12 months should be a lightweight governance system that gives the business clear rules, assigns accountability, and concentrates scrutiny where the risk is highest.

The five priorities I would implement are:

Priority, Practice to implement, Why it matters

1. Create an AI governance owner + risk-based decision process, Establish an executive sponsor and a small cross-functional AI governance group (IT/security, legal/privacy, HR, business, risk/compliance). Define who can approve, reject, or escalate AI use cases. Classify uses as low, medium, high, or prohibited risk., Without clear ownership, AI governance becomes either nobody's job or an IT-only exercise. NIST explicitly treats governance as a cross-cutting function involving leadership, accountability, risk tolerance, and lifecycle oversight.

2. Build and maintain an enterprise AI inventory, Create a single register of every material AI application/model: purpose, owner, vendor, data used, users, risk tier, jurisdictions, human oversight, testing status, and approval date. Include employee “shadow AI,” not just officially purchased systems., You cannot govern what you cannot see. An inventory is the foundation for risk assessment, regulatory compliance, vendor management, incident response, and eventually retiring systems safely. NIST specifically calls for mechanisms to inventory AI systems and manage them throughout their lifecycle.

3. Establish minimum controls for data, security, privacy, and third parties, Set rules for what employees may put into public AI tools; require approved enterprise AI services for sensitive information; conduct AI-specific vendor due diligence; address data retention, training-on-your-data, IP ownership, security, subprocessors, and breach/incident notification in contracts., The biggest near-term AI exposures for a midsize company are often mundane: confidential information entering a model, insecure integrations, questionable vendor terms, or IP/privacy problems. NIST's GenAI guidance specifically highlights data provenance, third-party considerations, and additional oversight for GenAI.

4. Require testing and human oversight for consequential AI, Before deployment, test higher-risk systems for accuracy, bias/fairness, security, privacy, hallucination/failure modes, and robustness. Define when a human must review or override the output. Continue monitoring after deployment and establish an AI incident/escalation process., AI risk doesn't end when procurement or development ends. NIST recommends continuous risk management across the AI lifecycle and emphasizes pre-deployment testing and incident disclosure for GenAI.

5. Make AI literacy mandatory and role-specific, Give every employee basic training on acceptable use, confidential data, hallucinations, verification, copyright/IP, phishing/deepfakes, and reporting problems. Give developers, HR, procurement, executives, and AI owners deeper training appropriate to their roles., Governance fails if employees don't understand the rules. This is also becoming a regulatory expectation: EU AI Act Article 4 requires providers and deployers to take measures to support AI literacy, with enforcement of that provision beginning August 3, 2026.

What I would actually deliver over the 12 months

Months 1–3: Establish control

Name the executive AI owner and governance committee.

Publish an interim acceptable-use policy.

Start the AI inventory.

Identify the 10–20 highest-risk AI applications.

Define the risk-tiering methodology.

Immediately restrict sensitive-data use in unapproved public AI tools.

Months 4–6: Put the machinery in place

Implement standardized AI-use-case intake and approval.

Add AI questions to security/privacy/vendor procurement.

Create minimum testing requirements by risk tier.

Establish an AI incident-reporting process.

Launch company-wide AI literacy training.

Months 7–9: Test and monitor

Perform formal assessments of high-risk systems.

Review AI vendors and contracts.

Begin periodic monitoring of accuracy, bias, security and performance.

Audit whether employees are following the acceptable-use policy.

Months 10–12: Institutionalize

Report AI risks and major use cases to senior leadership/board-level risk oversight.

Retire or remediate systems that don't meet requirements.

Update policies based on incidents and regulatory developments.

Consider aligning the program with NIST AI RMF and, if commercially valuable, ISO/IEC 42001, which provides a formal AI management-system framework.

The key principle

I would not treat every use of AI equally. A marketing employee using an AI tool to brainstorm headlines should not face the same governance process as an AI system screening job applicants, making credit decisions, handling health information, or controlling a production process.

A good midsize-company model is:

Low risk → lightweight rules and employee training
Medium risk → documented owner + assessment + controls
High risk → formal approval + testing + human oversight + ongoing monitoring
Unacceptable risk → prohibit

That approach gives the company enough control to manage legal, security, privacy, reputational, and operational risks without turning AI adoption into a six-month approval process. It is also consistent with the risk-based philosophy of NIST's AI RMF and the management-system approach in ISO/IEC 42001.

If I had to pick only three things to get right in year one: an accurate AI inventory, clear risk-based accountability, and strong controls around sensitive data and high-impact decisions. Those three create the foundation on which the other governance practices can scale.