⌂
1 / 11
05 · AGENTIC GOVERNANCE

Agentic Governance

EXAMPLE GOVERNANCE FRAMEWORK

AGENTIC SYSTEM
KNOWLEDGEContext and method
ACTIONSTools and limits
HUMAN REVIEWDecisions and exceptions
VALUECost and evidence
OWNER · LOGS · LIMITS · STOP
WHERE TO START

What should we automate first?

Y · COMPLEXITY + RISK
START HERE
ASSESS FIRST
LOWER PRIORITY
PROJECT CONTROLWeekly Project Report + Risk Alerts
FINANCEBudget Variance Analysis
HRFinal Hiring Decision
SALESPre-call Briefing
OPERATIONSResource Allocation Recommendation
ONE-OFF TASKOne-off Document Formatting
LOWX · VALUE AT SCALEHIGH
DIRECT AUTOMATIONHUMAN REVIEWHUMAN DECISIONLOW PRIORITY
EXAMPLE APPROVAL PATH

From AI opportunity to development.

Each company adapts it to its structure and level of risk.

01

AI OPPORTUNITY

Is this process worth automating?

→
02

VALIDATION BY THE PROCESS OWNER

Is it useful and does it create value?

→
03

POC

Can we build a simple proof of concept?

→
04

TEST

Does it improve time, cost, quality or adoption?

→
05

DEVELOPMENT

Can IT make it secure, scalable and supportable?

Only tested POCs with proven value move to development.
SET THE BASELINE BEFORE TESTING

Did the pilot improve the work?

HUMAN WORK
SAME TASK→
HUMAN + AIAI SHOULD EMPOWER PEOPLE, NOT REPLACE THEM.
TIME SAVED
TOTAL COST
OUTPUT QUALITY
ADOPTION RATE
×STOP↻REFINE↑SCALE
REGULATION ESSENTIALS

Two regulations to know.

European UnionPERSONAL DATA

GDPR

Which data can we use, why, and under which conditions?

European UnionUSE + IMPACT

AI ACT

How much risk does the use case create, and which controls does it require?

A simple first lens:GDPR looks at the data · the AI Act looks at how AI is used.
Sources: GDPR · official text · AI Act · official text
BEFORE PUTTING DATA INTO A TOOL
European Union

GDPR + AI: what to check.

USE ONLY THE DATA YOU NEEDWith external tools, remove or anonymise personal and sensitive data first.
STAY INSIDE APPROVED COMPANY TOOLSUse accounts, permissions and apps already checked by the company.
KNOW WHERE YOUR DATA GOESCheck where it stays, whether it improves the model and when it is deleted.
ASK AI FOR A PRELIMINARY GDPR SCREENING

First ask me: tool, plan and account · business use · data types.

  • Use only official vendor documentation and EU/EDPB sources.
  • Check data location and transfers, training, access, retention, deletion and security.
  • Check the DPA, subprocessors, data minimisation, transparency and possible need for a DPIA.
  • Cite the exact link for every finding.
VERIFIEDNOT FOUNDINTERNAL VALIDATION

Conclude: potentially suitable, conditional or do not use until reviewed. Do not declare the tool “GDPR compliant”: final approval belongs to DPO, Legal, IT or Information Security.

AI can find the evidence.The final decision stays with the company, involving DPO, Legal and IT when needed.
Official sources: GDPR · European Commission · Data transfers. Educational guidance, not legal advice.
HOW TO REDUCE DATA BEFORE USING AN EXTERNAL TOOL

Not every tool
is safe.

PDFWordDOCXExcelXLSXPowerPointPPTX
FILES WITH SENSITIVE DATAPersonal data or confidential information
→
LOCAL PRIVACY LAYEROriginal content stays on the device
Open RedactOpen RedactIn-browser PDF redaction
OpenAI Privacy FilterOpenAI Privacy FilterLocal PII detection
PresidioPresidioConfigurable framework
✓HUMAN CHECK BEFORE SENDING
→
Abacus.AIABACUS / EXTERNAL AIData flow and terms must be verified
Removing identifiers does not guarantee anonymity.Human review and company approval are still required.
OPEN-WEIGHT MODELS + LOCAL AI HARDWARE

Powerful AI is moving in-house to keep company data private.

TOP MODELS · ONE PER DEVELOPERLLM STATS SCORE
01
GPT-5.6 SolOpenAI
57.2CLOSED
02
Claude Opus 5Anthropic
56.2CLOSED
05
Kimi K3Moonshot AI
54.7OPEN
06
GLM-5.3Zhipu AI
54.2CLOSED
07
DeepSeek V4 ProDeepSeek
54.1OPEN
08
Qwen3.8 MaxAlibaba
53.0OPEN
Company-controlled data centre

New, more efficient open-weight models.Data stays inside the company.

SOONMore AI workloads will stay local.
Sources: LLM Stats · 28 Aug 2026 · Stanford AI Index 2026 · Stanford AI Index 2025
INTERNAL USE IS NOT AN EXEMPTION
European Union

AI Act: Three Use Cases.

LOWER RISK · BASIC CONTROLS

Pre-call briefings and project reports

You can experiment.

Approved tools and authorised data.

HIGH-RISK CHECK · ESCALATE

CV screening or worker evaluation

Assess before any pilot.

Involve HR, Legal and human review.

PROHIBITED · DO NOT TEST

Emotion recognition in interviews or at work

Do not use it.

It is prohibited, except for limited medical or safety reasons.

NO HUMAN REVIEW?Public-interest documents must disclose the use of AI.
FROM KNOWLEDGE TO ACTION

Where should MSX start?

KNOW-HOW

How will MSX capture
its know-how?

PROCESSES

Which processes are
worth automating?

Let’s identify the first opportunities together.

FROM IDEAS TO A FIRST TEST

Let’s get back to practice.

PRACTICE + Q&A

Choose one opportunity discussed in the previous module.

SPLIT INTO TWO GROUPS

COPILOTBuild with Microsoft knowledge and tools.
ABACUSCreate a first proof of concept.
EXPERIMENT TOGETHER · ASK QUESTIONS · IMPROVE THE FIRST RESULT