An organization has moved beyond early AI pilots and is now supporting AI use across several business teams. Initially, every AI request required…

The organization's approach has evolved from highly restrictive, centralized oversight to a more nuanced system. By implementing "differentiated approval paths based on use-case risk" and allowing independent use of predefined tools, they are balancing the need for control with the goal of enabling broader adoption. This risk-based, flexible approach is a hallmark of the "Growth Stage," where governance matures to support scaling AI responsibly without stifling innovation.

A. Early Stage – Restrictive Controls: This describes the organization's past state, not its current, more flexible approach.
C. Mature Stage – Enabling Guardrails: This stage implies more automation and federated autonomy within established guardrails, a step beyond the current "balanced" approach.
D. Early Stage – Manual Review Processes: The organization is actively moving away from universal manual review, making this description outdated.

1. National Institute of Standards and Technology (NIST). (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). (NIST AI 100-1). The framework's "Govern" function emphasizes establishing risk-based governance that adapts to context, moving beyond one-size-fits-all controls (Section 4.1, p. 20).

2. Stanford Institute for Human-Centered Artificial Intelligence (HAI). (2021). Building a National AI Research Resource: A Blueprint for the National AI Research Cloud. This report discusses governance models for AI resources, highlighting the need for tiered access and risk-based controls to balance safety with broad access as a platform matures (Chapter 4, "Governance").