Observations
Where the Response Has to Start
Most organisations try to build AI governance from the top down: write a policy, hold a training session, expect behaviour to follow. It rarely does, and not for lack of good intentions. Behaviour doesn’t change because a policy asked it to. It changes because people have built the capability to do things differently, and that capability has to be built from the ground up, not handed down in a document.
That’s the logic behind the Not For Humans AI Governance Model: individual and team capability with AI, paired with a working awareness of human behaviour, is the enabler of good AI governance in small organisations, not the other way around. Invest in people’s capability first, and stronger governance and policy application follow as a natural consequence. Write the policy first and hope capability catches up, and in practice it usually doesn’t, especially in a sector as resource-constrained as for-purpose organisations.
There’s a practical reason this order matters more now than ever. AI tools are changing weekly, not yearly. A policy written around today’s tools is describing a target that will have moved by the time it’s approved. A team with genuine capability doesn’t have that problem. The same underlying judgement applies to a tool they’ve never seen before, because the capability travels with the people, not with the policy.
- Why capability has to start with the individual, not the policy
- How individual capability becomes a team culture
- How that culture makes honest conversations about bias possible
- How honest conversation is what makes real review possible
- Why policy and governance work best last, built on top of all of this
Photo: Vitaly Gariev / Unsplash
The Build Order
Each part of that sequence depends on the one before it. A team can’t build honest review on top of a culture where naming bias feels like an accusation. A policy can’t govern behaviour nobody has had the chance to practise noticing in themselves yet.
The diagram below is the same one from the last article, shown here for a different reason: not to name where the risk sits, but to show the order in which a response actually has to be built.
Not For Humans, 2026 (original artwork)
The five stages below build this diagram from the centre outward: human judgement first, then individual behaviour, then operational practice, then organisational commitment. That’s the design logic behind everything that follows, not five separate fixes for five separate problems, but a build order, starting closest to where the behaviour actually happens and working outward toward policy, rather than the reverse.
Stage One
Build individual capability first.
Photo: Effydesk / Unsplash
AI use in most organisations is largely ungoverned in practice, whatever the policy says on paper. That starts changing at the individual level, before it’s a team question or a policy question at all:
- AI disclosure is actively encouraged, not merely permitted. There’s a difference between a rule that allows disclosure and a practice that expects it.
- How AI was used gets documented, in whatever form fits the work: a line in a case note, a declaration attached to a document, something concrete rather than assumed.
- Ownership and accountability sit with a named person. Not “AI was used somewhere in this,” but a specific person who checked it and stands behind it.
Naming a named, accountable person before a decision is made isn’t a formality. Research on decision-making under automation found that requiring people to account for their reasoning before making a decision, rather than only being able to explain it afterward, reduced errors from over-reliance on automated advice. Accountability built in before the fact changes behaviour in a way accountability after the fact doesn’t.
“Pre-decisional accountability, being asked to account for a decision before making it, reduces errors from over-reliance on automated advice. Accountability sought only after the fact does not.”
Skitka, Mosier and Burdick, 1999
Read the paper →This is the foundation everything else sits on. A team can’t build a culture of openness about AI use if no individual in it has practised being open about their own.
A Free Resource
Not For Humans has built an AI Authorship Statement along exactly this logic, a declaration a person completes themselves, gradated by the stakes of the work. It’s free and available by request. Email contact@notforhumans.com.au for a copy.
Stage Two
Build team culture, not just individual habits.
Photo: WOCinTech Chat / Unsplash
Once disclosure is normal for one person, it can become expected across a team, not through a rule, through repetition and visible example:
- A team culture of sharing AI outputs, so what one person produced with AI’s help is visible to colleagues as a matter of course, not an exception.
- Transparency about how AI was, or wasn’t, used, on both sides. Silence about not using it can carry as much judgement as silence about using it.
- Early, informal team practices for reviewing AI-assisted work, before anything is formalised into a process.
- A shared vocabulary for naming bias and challenges, so a colleague can say “that might be leaning on the AI’s framing a bit heavily” without it landing as a criticism of the person.
This is a specific, well-studied precondition, not a general aspiration. Team psychological safety, a shared belief that the team is safe for interpersonal risk-taking, is what determines whether people raise problems and admit mistakes at all. Teams with it show measurably more learning behaviour. Teams without it don’t stop making mistakes. They stop mentioning them.
“A shared belief held by members of a team that the team is safe for interpersonal risk-taking.”
Amy Edmondson’s definition of team psychological safety, 1999
Read the paper →None of this works if leadership doesn’t visibly do the same thing. A team will only be as open as the example set above it.
Stage Three
Build the capability to name bias without judgement.
Photo: Gabriel Weyand / Unsplash
With that culture in place, something becomes possible that isn’t possible without it: talking honestly about bias, in the moment, rather than after something has already gone wrong. That takes more than awareness. It takes:
- Capability built through the habit of sharing and reviewing outputs together, since bias becomes easier to notice in someone else’s work first, and then in your own.
- Psychological safety in how that review happens, so raising a concern about a colleague’s AI-assisted work doesn’t read as an attack on their competence.
- Enough time and space for the practice to actually happen. Bias-spotting under deadline pressure doesn’t happen, no matter how much the culture supports it in principle.
- Deliberate nudges and training that reinforce the habit, because awareness alone fades without something that keeps bringing it back into view.
It’s worth being precise about what training can and can’t do here. Simply knowing that “confirmation bias” exists doesn’t reliably stop it operating. What does work is different: structured, practice-based interventions with feedback. A well-known set of experiments found single training sessions built around active practice and personalised feedback produced measurable, lasting reductions in bias, effects that held up two months later and transferred into professional field settings, not just the lab. The distinction matters: a one-off lecture explaining a bias rarely helps. A structured practice session that gives someone feedback on their own reasoning does.
Reduction in biased decision-making after a single structured training session, with effects still measurable two months later
- Morewedge, C.K., Yoon, H., Scopelliti, I., Symborski, C.W., Korris, J.H., & Kassam, K.S. (2015). Debiasing Decisions: Improved Decision Making With a Single Training Intervention. Policy Insights from the Behavioral and Brain Sciences, 2(1), 129–140.
- Sellier, A.L., Scopelliti, I., & Morewedge, C.K. (2019). Debiasing Training Improves Decision Making in the Field. Psychological Science, 30(9), 1371–1379.
Stage Four
Build review into a process, not a good intention.
Photo: Vitaly Gariev / Unsplash
Once bias can be discussed openly, review stops being a matter of individual vigilance and becomes something a team can actually build a process around:
- Clear documentation of how AI was used, what was asked, what was checked, and by whom.
- An agreed process for what gets reviewed and by whom, decided in advance rather than left to whoever happens to notice something.
- A record of what was agreed, so a decision about an AI-assisted piece of work is traceable afterward, not just remembered informally.
The evidence for structure over good intentions is strongest outside the AI conversation entirely, which is exactly why it’s worth borrowing. A simple, two-minute surgical checklist, tested across eight hospitals worldwide, cut major surgical complications by a third and deaths by more than 40 per cent. Nothing about the checklist required new equipment or new skill. It worked because it replaced reliance on memory and good intentions, under real pressure, with a fixed, structured step nobody could skip. The same principle applies to reviewing AI-assisted work: a structure that exists whether or not anyone remembers to be careful that day.
Reduction in surgical deaths from a two-minute structured checklist, not through new equipment or skill, but through structure replacing memory under pressure
This stage only works because the parts before it already exist. Documentation without a culture of honest disclosure is just paperwork nobody trusts. Process without psychological safety is a checklist people learn to satisfy rather than a real check.
Stage Five
Build policy on top of capability, not instead of it.
Photo: Vitaly Gariev / Unsplash
This is the payoff for building everything above properly. A team that discloses, discusses bias openly, and reviews well doesn’t need governance to regulate which specific tool someone opened this week. It needs a stable set of principles the team already knows how to apply, to any tool, including ones that don’t exist yet.
That’s a genuinely different governance task to the one most organisations are attempting, and it has a name in regulatory theory outside the AI conversation: principles-based regulation is consistently found to adapt better to fast-changing conditions than detailed, prescriptive rule lists, precisely because a principle doesn’t go out of date when the specific technology changes. A rules-based list of approved and banned tools is the opposite bet, one that has to be rewritten every time the market moves, which in AI now means every few months.
“Principles-based regulation is better equipped to adapt effectively to continuously changing circumstances.”
Institute of Chartered Accountants in England and Wales, 2009
Read the briefing →Instead of a growing list of approved and banned tools that’s out of date within months, it’s a small number of durable principles and a team capable of applying them to whatever turns up next. Policy stops chasing every new release, because the people using the tools were never depending on the policy to tell them how to think in the first place.
Where This Leaves Us
Build in this order, individual capability, team culture, honest conversation about bias, real review, and policy, and governance stops being the hard part. It becomes the natural conclusion of everything already in place beneath it.
This is also the logic behind the resource suite Not For Humans has built, and why it’s shaped the way it is:
- An Authorship Statement, for the individual layer, a declaration that makes disclosure the easier choice.
A Human Behaviour Cards suite, for the team layer, a shared, physical vocabulary for naming risky patterns and stabilising practices without it landing as personal criticism.- A Leadership and AI Reflection Workbook, for the honest individual reflection that has to happen before a group can discuss bias openly together.
- An AI in Use Audit and Accountability Statement, for the review layer, giving a reviewer something concrete to check rather than a general instruction to be careful.
- A Governance Model, Policy Template, and Action Plan, for the outermost layer, built to sit on top of the capability below it rather than instead of it.
None of that is a shortcut. It’s the same order this article has just made the case for, individual capability first, policy last, because that’s the order that actually holds up as the tools keep changing.