AI: applying governance and leading adoption in projects

Two things determine whether AI is used well. The first is governance: the controls and accountability that keep AI use responsible, transparent, and within agreed boundaries. The second is adoption: whether people use AI, trust it appropriately, and adapt their work practices. Governance without adoption produces controls that no one uses; adoption without governance produces enthusiastic but uncontrolled use. Both are needed.

Understanding AI governance in projects

AI governance is the policies, controls, roles, and oversight that ensure AI is used responsibly, transparently, and accountability across a project.

It defines how AI is used and who is accountable for its outputs. It also covers how data is managed and protected, and how risks such as bias, error, and inappropriate autonomy are identified and controlled. Above all, it ensures that, however capable the technology becomes, accountability and decision-making remain with people.

AI governance must be set at organizational level because AI crosses functions and disciplines. Separate approaches create inconsistent controls, conflicting accountability, and gaps. The ITIL AI Governance Official Book and ITIL AI Governance course provide an organization-wide approach, treating governance as a core capability. This book explains how that governance applies within a PRINCE2 project rather than introducing a separate project model.

AI governance should be integrated into existing project governance. AI risk belongs in normal project risk management, while decisions about AI use belong in the PRINCE2 digital and data management approach. The ITIL AI Governance Official Book identifies six characteristics that distinguish AI governance from traditional IT oversight:

1. Fit-for-purpose. The intensity of oversight matches both the AI system’s inherent risks and its operational boundaries. A lightweight use of AI to draft a summary warrants far less control than an agent acting autonomously across project systems. The aim is proportionality: enough oversight to protect value, trust, and accountability without preventing responsible progress.
2. Adaptive and evolving. Governance must remain capable of evolving as AI systems learn and as organizational understanding of their limitations deepens. Controls set at initiation should be reviewed at each stage boundary as the project and the technology change.
3. Integrated into the organization. Governance must integrate with existing organizational structures rather than creating parallel oversight systems that complicate decision-making. On a PRINCE2 project, this means AI risk sits within the risk practice, AI tool decisions sit within the digital and data management approach, and accountability sits with the defined roles — not in a separate AI governance exercise.
4. Holistic. AI governance should consider the whole system in which AI operates: not only the AI tool itself, but also data quality, team capability, supplier involvement, and decision authority. Decisions about AI authority, ethical implications, data usage, and regulatory compliance cannot be separated without creating governance gaps. A project that governs data well but ignores accountability, or that sets ethical principles but pays no attention to compliance, will find its governance fails in practice.
5. Ethical. AI should be judged not only by whether it works, but also by whether it is used in a way that is appropriate, fair, transparent, and accountable. On a project, this matters wherever AI influences decisions that affect people, including team members, suppliers, and stakeholders. Ethical governance requires clear accountability and escalation routes, not only good intent.
6. Sustainable. AI governance should look beyond immediate efficiency and consider long-term value, resilience, and responsible use. On a project, this includes ensuring that AI use is justified by meaningful outcomes, avoiding over-reliance on AI, and managing the risk of skill erosion over time.

Applying AI governance in projects

Governance becomes real when it shapes how a specific project uses AI. The starting point is the organization the project sits within: whether it already has AI governance in place determines how much the project inherits and how much it must establish for itself. In every case, the goal is always the same: a clear, proportionate set of decisions about how AI will be used, who is accountable, and how data and AI risk will be managed. These decisions are captured in the project’s digital and data management approach.

The project manager should confirm approved tools, controls, and data rules, then map them to the project’s uses of AI. Any new tool, autonomous use, or sensitive data source not covered by policy should be escalated through the project board and organizational governance route. Existing policy is usually the quickest route to safe adoption because risk appetite and approved tooling have already been considered.

Where organizational guidance is absent, the project should neither wait nor proceed uncontrolled. The project management team should establish proportionate controls: approved tools, boundaries for AI and agents, data rules, and mandatory human review. The strength of control should reflect what is at stake.

Whichever situation applies, the principle is the same: AI risk is owned and managed within the project’s normal risk management, the controls match the stakes, and the decisions are recorded, not held informally, so they can be reviewed and relied upon. That record is the digital and data management approach.

The PRINCE2 digital and data management approach is the primary management product for recording these decisions. For a project using AI, the project management team should:

• Record which AI tools are approved, and for what. Capture the defined toolset under the digital technology requirements, distinguishing tools approved for general use from those approved only for specific, lower-risk tasks.
• Set the data rules for AI use. Use the data management requirements to state what data may and may not be entered into which tools, the level of privacy required, how data quality will be assured, and what happens to data after the project closes – the questions the approach already asks, applied to AI.
• Define the boundaries for automation and agents. Record what AI and any agents may do, on whose authority, and when human review is mandatory – for example, for high-risk, low-confidence, or sensitive decisions.
• Make AI use traceable. Note how AI-supported outputs will be recorded where they materially support an important output, so they can be traced and challenged later.
• Assign responsibilities and timing. Name who owns the digital and data management activities and set when they happen, for example, agreeing on the approved toolset at initiation and reviewing it at stage boundaries as the project and the technology evolve.

Leading AI adoption

Governance sets the boundaries for using AI well, but boundaries alone do not deliver value. Successful AI adoption depends on people understanding the technology, trusting it appropriately, and using it confidently within the project’s governance arrangements. The project manager, therefore, has an important leadership role in helping the team adopt AI effectively and responsibly:

• Build calibrated trust. Help the team develop confidence in AI by being open about both its strengths and its limitations. Encourage people to review AI outputs critically, discuss where AI performs well and where it falls short, and treat questioning as good project practice rather than resistance.
• Start small and grow with experience. Begin with low risk uses such as summarizing non-sensitive information, improving draft text, or preparing for meetings. Extend the use of AI as the team’s confidence grows and the project’s controls mature. Capability and governance should develop together.
• Lead the change deliberately. Explain why AI is being introduced and how it supports the project’s objectives. Give people time to learn new ways of working and opportunities to develop practical skills, including effective prompting, reviewing outputs, protecting information, and recognizing potential risks. Visible leadership and realistic expectations encourage adoption.
• Support the team through change. AI changes established ways of working, and not everyone will welcome those changes. Some people may feel exposed if their previous value came from knowledge or administrative work that AI now supports. Where AI creates efficiencies, project managers should consider how the time released can be redirected towards higher-value activities such as stakeholder engagement, coaching, problem solving, and decision-making.
• Agree on shared ways of working. Establish practical expectations for the team. These might include using only approved tools, protecting sensitive information, reviewing outputs before sharing them, identifying when AI has materially contributed to an important output, maintaining controlled project records as the authoritative source, and escalating concerns about inaccurate, biased, or inappropriate outputs. These practices turn governance decisions into consistent day-to-day behaviour.

Led this way, AI adoption becomes stewardship rather than a technical rollout. AI helps the team manage complexity and uncertainty, while people retain the judgement, leadership, and accountability on which successful projects depend.

The Importance of Training for AI Governance and Project Management

Effective AI governance depends on more than policies and tools. It also requires people who understand how to use AI responsibly, recognise its limitations, and apply the right controls in their daily work. Training helps project managers and their teams develop these skills, build appropriate trust in AI, and turn governance principles into practical ways of working.

For project managers, combining AI governance knowledge with established project management practices is particularly valuable. It helps them identify risks, define clear responsibilities, protect project data, and ensure that AI-supported decisions remain transparent and accountable. It also supports adoption by giving teams the confidence to explore new possibilities without losing sight of project objectives.

QRP International offers training to help professionals develop these capabilities. The ITIL AI Governance course explores how organisations can manage AI responsibly, establish appropriate oversight, and balance risks with the benefits of AI. For professionals looking to strengthen their project management foundations, PRINCE2 training provides a structured approach to managing projects, including governance, risk management, and clear accountability.

Text adapted from: “PRINCE2 Project Management AI Practice Guide Global Best Practice” (ISBN: 978-9925-39-529-3). Copyright© 2026 PeopleCert International Limited and its affiliates (“PeopleCert”)