Every IT portfolio I talk to now has AI in it somewhere. Sometimes it's a headline programme. More often it's a chatbot in customer service, a forecasting model in finance, and three "quick pilots" somebody started with a credit card.

That's not a bad thing. But it raises questions your normal portfolio controls weren't built to ask. What data does it use? Who checks the model's output? What happens when it's wrong? Is a person still making the decision?

The good news is that you don't need a separate AI governance bureaucracy. You need your existing portfolio process to ask a few extra questions, at the right moments, and keep the answers. Here's how we'd set that up in Fluid.

Start with a proper AI intake

Most AI governance problems start at the front door, with a request that says "use AI to improve X" and not much else. So give AI ideas their own intake form, and ask for the things your reviewers will need anyway:

• What's the business goal, and how will we know it worked?
• What kind of use case is it: internal, customer-facing, automation or decision support?
• What data does it touch, and how sensitive is it?
• Which model or provider are we using?
• How much human oversight is there?
• Any security or compliance concerns?
• Roughly what will it cost, and how complex is it?

Fluid lets people save a request as a draft and work on it with colleagues before they submit it. Once it's submitted, it's locked and auditable. That's what you want: messy collaboration up front, a clean record afterwards.

Approvals that don't clutter the front door

Not every AI check belongs on the intake form. Some only make sense once a project is under way: an architecture review, a data protection assessment, a model risk evaluation, a production readiness sign-off.

For these we like what we call "headless approvals". These are workflow boards that don't appear in the normal request menu at all. They're triggered from inside the project when they're needed. Requesters never see them, and the right reviewers get a decision request at the right time.

Approvals can also fire automatically. When a card reaches a given stage, Fluid creates the decision requests, assigns them, and moves the work on based on the outcome. Nobody has to remember to email the data protection officer.

Not every AI idea deserves the same scrutiny

An internal tool that summarises meeting notes is not the same as a model that decides who gets a loan. Treat them the same, and you'll either smother the small stuff or under-review the big stuff.

So classify the risk at intake, and let routing rules do the rest:

• Low-risk internal automation takes the fast lane.
• Customer-facing AI, or anything that uses regulated data, picks up extra approvals.
• Big-ticket initiatives escalate to financial governance.

Done well, this speeds things up. The low-risk ideas stop queueing behind the high-risk ones.

Keep the evidence, and keep it intact

When someone asks "why did we approve this?", you want to answer with a link, not a story. Capture the business case, risk assessment, data protection documents, architecture design and supplier evaluation inside the workflow. Then lock the key fields once a decision is made, so the record can't quietly change afterwards.

Use stage gates as the real checkpoints

Stage gates are where governance gets teeth. For AI work, a gate model like this works well:

1. Idea qualification: does it fit the strategy, and what's the first view of risk?
2. Data and compliance review: is the data use legitimate and legal?
3. Solution design: architecture, controls and the human oversight model.
4. Pilot approval: scope, success criteria and how you'll monitor it.
5. Production approval: operational readiness and support.
6. Post-implementation review: did it deliver, and are the controls working?

In Fluid, each gate can require specific approvals before the project can move on. Reaching the gate triggers the requests automatically. Nobody has to police it by hand.

Make the decisions visible on the project

Governance decisions are only useful if people can see them. Fluid syncs workflow outcomes back to the project, so approval status, risk class and conditions show up on the project record and in portfolio reports. They don't stay buried in a workflow card.

Then manage by exception

Once every AI project carries its governance data, the PMO doesn't need to review each one in detail. Governance rules in Fluid flag the projects that need attention: missing approvals, high-risk initiatives without the right controls, gates overdue. You spend your time on the handful that matter.

Where Fluid's own AI fits

We hold our own AI to the same standard. FluidAI drafts summaries, risk reviews and suggestions using your PMO's own standards, and nothing is saved until a person reviews and accepts it. From October 2026, Fluid AI Connectors (MCP) let teams work with Fluid from Claude, Codex and Copilot, behind enterprise sign-in, consent and admin controls.

That makes FluidAI a useful assistant at intake: it can help shape an AI proposal and spot the risks before a reviewer sees it, while the decision stays with your governance board. We don't train models on customer data, and Fluid holds SOC 2 Type 2 certification.

There's more in AI that works the way your PMO works, our AI strategy and roadmap.

The short version

Good AI governance shouldn't slow you down. Done well, it's the reason you can say yes to more ideas, faster, because you know the risky ones will get the right attention.

Ask better questions at intake. Route by risk. Use gates as real decision points. Keep the evidence with the project. And manage the portfolio by exception. None of it needs a new framework, just your existing one doing a bit more.

If you'd like to see it working, book a demo and we'll show you on real data.