Can AI help govern AI? We asked four models how IT leaders should get started

Everyone agrees governance is important, but not on how to implement it – or even what it is

Young woman with a cup of coffee and a humanoid robot working while sitting at a laptop in a modern office, fist to fist gesture. Collaboration between humans and artificial intelligence.

AI governance today feels a lot like HIPAA did in the early 2000s: important, unavoidable and overwhelming. We asked four leading AI models where organisations should start. Their answers revealed a surprising consensus - with a few interesting blind spots.

When HIPAA first arrived in healthcare, I was a green IT director handed a three-ring binder stuffed with hundreds, if not thousands, of pages explaining a new federal law with which my organisation suddenly had to comply.

I remember being absolutely bewildered.

I wasn't a lawyer. I wasn't a compliance officer. Yet I was tasked with helping translate these massive federal guidelines into IT-related procedures, policies and controls.

Like many others in the industry at the time, we relied on internal collaboration, consultants and federal guidance to eventually help us become a HIPAA-compliant facility.

Twenty years later, many IT leaders are facing a similar challenge with artificial intelligence.

Everyone agrees that AI governance is important. But fewer seem to agree on what AI governance really means, how much of it is needed to create a governed organisation, and perhaps most critical of all - how best to begin implementing it.

If AI had existed when HIPAA was dropped onto my desk, my first instinct would have been to ask it for assistance.

Which raises a timely question: can AI help organisations govern AI? We decided to give it a quick test.

Our methodology

To test, MES Computing asked four leading AI assistants the same question after starting a fresh session with each:

"You are advising a midsize company with 250-2,500 employees. What are the five most important AI governance practices that should be implemented in the next 12 months, and why?"

We then put the responses to an AI governance expert for his opinion.

The responses came from:

The results were revealing.

Our Findings

Finding 1

The models agreed far more than they disagreed.

Despite being developed by different vendors and drawing from different sources, all four models provided advice around the same core themes:

Finding 2

Every model recommended a risk-based approach rather than banning AI.

While each model differed on implementation details, all four recommended risk-based governance overblanket restrictions. Copilot argued: "Governing approved use is far more realistic than trying to eliminate usage altogether," while ChatGPT explicitly stated that it would "not treat every use of AI equally."

Claude and Gemini similarly recommended classifying AI applications according to risk and applying controls based on potential impact.

Finding 3

Every model viewed shadow AI as inevitable.

All four models assumed employees are already using AI tools throughout the organisation. Claude noted employees are "almost certainly using AI tools already, sanctioned or not," while Copilot bluntly asserted, "attempting to ban AI typically fails."

Gemini flagged that employees are likely already entering sensitive information into consumer AI services, and ChatGPT recommended tracking employee "shadow AI" as part of enterprise AI inventory.

Finding 4

The models disagreed on sequencing.

Each model offered different advice on where midmarket IT leaders should begin with AI governance:

Copilot → start with data

Claude → start with inventory

Gemini → start with governance structure

ChatGPT → start with ownership and risk management

Finding 5

Overall, the models did not treat AI agents as a top governance issue.

Despite increasing industry attention on agentic AI, only one model, Microsoft Copilot, made AI agents a prominent governance concern. Copilot recommended assigning ownership to every "AI application and agent" and noted that governance becomes more important as agentic systems gain the ability to take actions rather than simply generate content.

Gemini briefly referenced autonomous AI actions, but Claude and ChatGPT focused primarily on inventories, risk management, oversight and policy.

The lack of emphasis on agentic AI is also in contrast with recent MES coverage highlighting a recurring theme: midsize organisations are increasingly enthusiastic about AI agents, but governance, visibility and accountability controls are struggling to keep pace.

Interestingly, the expert's preferred response aligned with the model that prioritised visibility.

Image
Description
Created with Copilot

The models largely agreed on what AI governance should include. Their biggest disagreement was where midsize organizations should begin.

Want to review the complete responses yourself? MES Computing has published the full unedited responses from Copilot, Claude, Gemini and ChatGPT so readers can compare them directly and decide which approach is most useful for their organizations.

Read the full AI model responses here.

An AI governance thought leader's reaction

In the spirit of keeping the "human-in-the-loop," MES contacted AI governance practitioner and industry thought leader West McDonald, founder and partner at GoWest.ai, for his feedback on the models' responses. We did not disclose which model said what.

Observation No.1: Visibility before governance

For McDonald, the most surprising finding is not where the models disagreed, but where they converged.

"All four models landed in roughly the same place even though they took different routes to get there," he said in a message to MES Computing.

McDonald rated Claude's response as strongest overall because it starts with a very practical reality facing IT leaders: the difficulty tracking how much AI is being used throughout operations.

Or, as McDonald put it, "You can't govern what you cannot see."

Observation No. 2: Governance doesn't mean locking everything down

While McDonald largely agreed with the models' recommendations, he felt the responses lacked emphasis on what he considers an important part of a solid AI governance strategy: enablement.

"Governance," McDonald said, "cannot just be a list of things employees are not allowed to do."

He said organisations often make the misstep of focusing exclusively on restrictions, policies and approval processes without providing sanctioned alternatives.

"If you do not give people safe, approved AI tools and show them how to use them, shadow AI is going to keep happening."

McDonald recommends that organisations enable approved AI tools and provide employee education and practical guidance alongside governance policies.

Observation No. 3: AI agents need more attention

McDonald also believes most of the responses underestimated the governance implications of AI agents.

Only Copilot explicitly discussed AI agents and autonomous actions. The other responses focused more on inventories, policies, risk management, oversight and training.

McDonald emphasised that agentic AI governance will become critical as organisations move from chatbots and copilots to autonomous agents.

"That means permissions, logging, human approval and authority levels are going to become a much bigger part of the governance conversation," he said.

Takeaways For Midmarket IT Leaders

The experiment revealed that the four AI models agreed more than they disagreed.

All four concluded that AI governance should include:

The biggest difference wasn't what the models recommended. It was how they suggested midsize organisations begin their AI governance journeys.

Image
Description
Created with Copilot

For resource-strapped midsize IT teams, that distinction matters. Few midsize organizations have the staffing, budget or in-house expertise to take on every governance challenge.

Instead, McDonald recommends organisations first focus on creating a practical governance programme offering approved AI tools and clear employee guidance.

"If a midsize organisation could focus on only one governance initiative in 2026, I would build a formal AI acceptable use and governance program tied to sanctioned AI tools," he said.

Ultimately, the experiment suggests the models most AI users work with every day - and ones I would have turned to had the tech been available when HIPAA rolled out - have a surprisingly consistent governance playbook.

The challenge for midmarket IT leaders is certainly not determining if AI governance is important. It's deciding which initiatives to prioritise.

As McDonald put it: "The goal is not to stop people from using AI. The goal is to make responsible AI use easier than irresponsible AI use."

This article first appeared on our sister site MES Computing.