Sixty percent of executives now use AI regularly to support their decisions. Only 5% say their organization manages that use well. Those two numbers come from the same Deloitte 2026 Global Human Capital Trends report, and the gap between them is the story of AI in the workplace right now. Adoption has already happened. Oversight has barely started.
Sit with what those executive decisions actually are. Some are about forecasts and spend. But a large share are about people: who’s ready for a stretch role, who needs a hard conversation, how to word a review, whether someone gets another quarter or a formal plan. Leaders are making those calls with AI in the room today, and almost no one has decided how that should work.
This is easy to file under IT. A new tool is in the building, so it must be a rollout problem, something to secure and provision. That framing misses what’s actually new. These models process HR data faster, sure, but the deeper shift is judgment: they’re shaping how leaders read the humans who report to them. An ungoverned layer has formed on top of how people are managed, and most of the organizations running it don’t yet have language for what it is.
Policy is not governance
The distinction that organizes everything below is simple to state and easy to skip. A policy grants or withholds permission. Governance is about oversight, quality, and accountability: one answers whether AI can be used, the other answers how it’s used, how well, and who owns the outcome when it goes wrong.
Most organizations have raced to write the policy and stopped there. “Managers may use approved AI tools to draft communications” is a permission statement. It settles the “can they” question and says nothing about the questions that actually determine whether this helps or harms: what quality bar the output has to clear before a manager acts on it, who’s accountable when AI-shaped advice steers a people decision badly, and how anyone would know if the whole arrangement is working. A permission slip is not an operating model.
The standards world already draws this line. The NIST AI Risk Management Framework is built around four functions, Govern, Map, Measure, and Manage, and the reason they’re separate is that permission and oversight are different problems requiring different work. You can grant use in a sentence. Measuring and managing it is ongoing. The framework exists because organizations kept doing the first and calling it the second.
A newer reference point is ISO/IEC 42001:2023, the first certifiable standard for an AI management system, which gives structure to what mature governance looks like as an ongoing discipline rather than a one-time approval. Risely holds no certification against it and makes no such claim; it’s worth knowing as a marker of where the bar is heading. What matters is the signal it sends. The people building formal standards treat governance as something you operate over time, an ongoing discipline rather than a box you check once.
Why this is HR and L&D’s job, not IT’s or Legal’s
The instinct to hand AI governance to IT and Legal is reasonable, because for most AI questions they’re exactly right. IT governs the models, the data, and the security perimeter. Legal governs regulatory exposure and liability. When the question is whether a tool leaks data or breaks a law, those are the seats that answer it.
But consider the actual moment this is about. A manager is preparing a redirect conversation, or drafting a performance review, or weighing whether a report is ready for a bigger role, and they turn to AI for help. What makes that AI’s input good or bad has nothing to do with the model’s architecture or its data-handling. It has to do with whether the advice reflects what good coaching and good feedback actually look like. That’s a leadership-development judgment.
And it’s a specific competency. Knowing that a review has gone from honest to sanded-down, that coaching advice is generically plausible but wrong for this person, that a manager is being nudged toward avoidance dressed up as diplomacy, requires expertise in how people develop and how feedback lands. IT doesn’t have that expertise, and neither does Legal. Judging the quality of people development is what L&D does all day and the other functions don’t, which makes this a statement about capability, not about who’s allowed to weigh in. This belongs to HR and L&D because they’re the ones equipped to do it.
The stakes rise with seniority, which makes the ownership question sharper. The SHRM State of AI in HR 2026 report found adoption climbing as you go up the org chart: 73% among HR directors and above, 66% among managers, 65% among individual contributors. The people with the most authority over others are also the heaviest AI users. So the population whose AI-assisted judgment matters most for other people’s careers is the population using it most, and the least likely to have anyone checking the quality of what they’re absorbing.
Almost no one is checking. The World Economic Forum reported in 2026 that fewer than 1 in 100 organizations has implemented full responsible-AI practices. That’s the vacuum in plain terms. HR isn’t losing this race to IT. At every function, in almost every company, the practitioner layer of AI governance simply hasn’t been built yet.
The mess this creates today
When there’s no shared standard for what good AI-assisted coaching looks like, you get exactly what you’d expect. Advice varies wildly from manager to manager, and most of that use happens where no one can see it. Underneath both is a quieter drift: a general-purpose model, not the organization, ends up defining what “good” feedback sounds like, one prompt at a time.
We’ve documented what this looks like on the ground in our piece on shadow AI among managers, the concrete case study this guide zooms out from. Rather than repeat it here, treat that post as the field report and this one as the map. The pattern it describes is real, widespread, and already running inside most companies.
The bridge from that mess to a solution starts with a question the mess itself can’t answer: what does good AI-assisted coaching actually look like? We’ve laid out our view of that in what purpose-built AI coaching for managers is. You can’t govern toward a standard you haven’t defined, and defining it is where this work begins.
What governing AI for people management actually covers
Naming the standard is only the start. A real framework for governing AI in people management has to answer a handful of questions that no permission policy touches. This is the territory, sketched at altitude. Working through it in full needs its own space, which is what the AI Governance Canvas for leadership development lays out box by box.
The first question is where AI is a reasonable input and where judgment has to stay human. Some uses are low-stakes and genuinely helpful, like tightening the wording of a note. Others, like deciding whether someone keeps their role, are places where an AI suggestion should never carry the weight of a decision. Drawing that line deliberately is governance work. We’ve written about where it falls in our comparison of AI and human coaching, which examines where AI should and shouldn’t be trusted for people decisions.
The second is the quality bar. Before a manager acts on AI-assisted advice about a person, what does that advice have to clear? Without a defined bar, “the model said so” quietly becomes the standard, and the model optimizes for whatever sounds fluent and reassuring, which is rarely the same thing as accurate or honest.
The third is accountability. When AI-shaped advice contributes to a decision that turns out badly, who owns that? “The AI recommended it” is not an answer any organization should accept, and governance is what makes sure no one can hide behind it.
The fourth is visibility. How does the organization know this is working, not just that it’s permitted? That means some form of measurement and aggregate insight, held in a way that respects the difference between a manager’s private development and a decision that lands on someone else. A framework that names these four and gives HR a way to act on them is what this category needs. That is what the Canvas sets out to do.
The decisions HR and L&D must own
Above the framework sits a set of decisions that can’t be delegated to IT or Legal, because they’re judgments about people development rather than technology or law. Four of them deserve to be on the table now.
Decide what counts as an acceptable AI-assisted coaching interaction. Get concrete about it. When a manager uses AI to prepare for a hard conversation, what does a good version of that look like, and what would make you uncomfortable? Until you’ve said so, every manager is answering it privately and differently.
Decide what managers are trained to check before they act. AI advice about a person should be a first draft a manager interrogates, something to pressure-test before acting rather than a script to read aloud. The skill of pressure-testing it, spotting where it’s generic, where it’s confidently wrong, where it’s avoiding the honest thing, is teachable, and teaching it is L&D’s work.
Decide how privacy and visibility coexist. A manager working privately on their own skills should keep that privacy, the same way you wouldn’t demand a transcript of a coaching session. A decision that affects someone else’s role or pay is a different category, one where the organization has a legitimate interest in how the call was made. Getting that boundary right, private for self-directed growth, visible in aggregate for decisions that touch others, is a people-governance judgment no other function can make for you.
Decide how this gets revisited. The tools will change, and a governance stance frozen in 2026 will be wrong by 2027. Someone in HR and L&D has to own reviewing it as the ground shifts.
There’s a regulatory floor forming under all of this. Under the EU AI Act, AI used in employment and performance monitoring is classified as high-risk, which carries real obligations. The compliance timeline is phasing in, recently pushed toward late 2027, with exact dates still in flux; treat the specifics as live and verify them rather than banking on any single deadline. The strategic point stands regardless of the calendar: the floor is coming, and waiting for a regulator to force these decisions is not a governance strategy. The organizations that own them early will be shaping their practice; the ones that wait will be reacting to a rule.
Where most organizations actually are
Line up the numbers already on the table and a maturity picture emerges. Adoption near the top of the org chart is high and climbing. Executive use of AI in decisions sits at 60%. Confidence that any of it is well managed sits at 5%, and organizations with full responsible-AI practice number fewer than 1 in 100. Together those numbers describe an entire field still waiting for governance to catch up with adoption.
Read it as a spectrum. At one end, organizations where AI is in heavy use and nothing has been decided about it. In the middle, organizations that have written a policy, the permission slip, and mistaken it for oversight. At the far end, a rare few who’ve started building the practitioner layer, defining the standard, drawing the visibility line, naming who owns it. Almost everyone is in the first two bands. Locate yourself honestly for one reason: to see that being early here is still possible, because the field has barely begun.
The advantage of naming it now
The organizations that come out ahead won’t be the ones that waited for a mandate. They’ll be the ones that treated the governance of AI in people management as a leadership-development competency and built it on purpose, before a regulator or an incident forced the issue. Naming the category is the first move, because you can’t govern what you haven’t defined, and right now almost no one has defined this one.
That definition is the real work, and it starts inside HR and L&D. The framework can be built deliberately, the decisions can be owned rather than defaulted, and the standard for what good AI-assisted coaching looks like can be set by the organization instead of by whatever model a manager happens to open. If you’re making the internal case for that investment, the business case for leadership development is a useful next step, because governance and the return on developing your people are the same argument seen from two angles.
Some of what this guide describes, self-directed sessions staying private while HR sees aggregate engagement and skill signals rather than transcripts, is why we built Merlin the way we did. A coaching platform can hold that privacy-and-visibility boundary in a way a general chatbot can’t, which is the practical difference between Risely and a tool like ChatGPT and the reason an AI coach built for the work exists at all. Treat that as an existence proof. The governance itself is still yours to build.