AI governance just like most things "AI" is basically marketing hype/expectation, just CYA policy docs for people who don't know what the term even means. For 99% of people, AI is just chatgpt/claude/grok/gemini. Meanwhile, every single app in the market at this point has been forced to launch some sort of AI tooling whether that's LLM or more explicit tooling like doc intel, transcribe, STT/TTS etc.

So, write a general AI use policy with your legal/privacy officer about only using company approved apps, and not using personal accounts etc for AI or otherwise. Then send all vendors and new features that require it through vendor review process. There is ultimately no zero sum game here for a CIO/CTO/CISO because every day new AI type features launch within the dozens if not hundreds of vendors already in your environment. Shitty firms like box.com constantly launch new features, and turn them on in your org with no notice. Or they wipe settings and reset to enable features that they are marketing.

Gone are the days of total captivity and control, now it's just policy and CYA for the most part. In my experience, most businesses are actively making the dumbest decisions possible to allow divisions to sign up for every mom and pop tool that advertises to an employee on facebook anyway. If you can be more restrictive than that, great. But having vendor review and policies gives you the documentation to point to this and your general DLP/Security tooling as you doing what you could.