AI can significantly ease the workload on teams – but as soon as it starts working with client briefings, project knowledge or related tools, legitimate questions arise: Where is data processed? Who is authorised to access what? What is an agent permitted to do independently? An AI-ready agency needs not only good use cases, but also clear guidelines. Governance does not slow AI down; rather, it ensures it can be used reliably.
[.b-important-block]Secure AI usage is not purely a legal matter. Data protection, authorisations, context and human oversight are integral to every AI roll-out.[.b-important-block]
[$tag]💡 Good to know[$tag]
Why AI governance is so important, particularly for agencies
[.toc-name]AI governance for agencies[.toc-name]
Agencies work with sensitive information: client data, briefings, budgets, HR and project data, and much more. Even without the use of artificial intelligence, this data must be handled responsibly. An AI tool can utilise this context to, for example, improve processes. However, this also increases the level of responsibility.
Without clear rules, shadow processes emerge: teams copy information into ad-hoc solutions, permissions are granted too liberally, and nobody has an overview. Depending on how AI is used, sensitive company data may be processed. If, for example, an unauthorised AI tool is used to summarise a client presentation, names, contact details or prices contained therein may be transferred to the external provider.
The uncertainty surrounding this is understandable, but it must not lead to a blanket refusal to use AI. In case of doubt, failing to use AI can give rise to other data protection issues. It is therefore much more a question of creating a framework within which teams can use AI tools effectively and responsibly.
What does AI governance actually mean?
AI governance describes the rules, responsibilities and technical safeguards used to manage the use of AI.
The four levels of AI governance
- Data protection & compliance: What data may be processed? Which contracts and processes apply?
- Technical security: Where does data flow? Which providers, models and interfaces are involved?
- Authorisations & rights management: Who is permitted to view data, use tools or trigger actions?
- Accountability & Control: What can happen automatically – and when must a human review or make a decision?
[.b-important-block]Governance does not mean banning or approving every AI application individually. It is about creating a framework within which teams can work safely and independently.[.b-important-block]
[$tag]💡 Good to know[$tag]
GDPR & Data Protection: What happens to data in awork AI?
[.toc-name]GDPR & Data Protection[.toc-name]
awork configures AI processing for European regions, thereby providing clarity rather than unclear data flows. Requests are directed specifically to the provider best suited to the situation – rather than being sent to all available providers at once. Enterprise set-ups and contractual safeguards create a controlled framework that protects your data and meets GDPR requirements.
DPA, sub-processors and a transparent contractual basis
- The existing core provisions of the data processing agreement remain in place.
- The AI-specific addendum describes additional processing activities, data categories and relevant sub-processors.
- When awork AI is activated, the appropriate data protection framework is taken into account.
- For your agency, this simplifies your own data protection review and provides a transparent basis for dealing with clients and internal stakeholders.
Rights management: AI only has access to what you grant it
[.toc-name]AI rights management[.toc-name]
AI becomes useful when it can access projects, tasks and connected systems. In awork AI, the principle of least privilege applies: agents are only granted access to context, data sources, tools and connections that have been explicitly authorised for them. Context is valuable and should be meted out sparingly.
In practical terms, this means: only grant an agent access to the projects and data sources they need for their specific job. Only connect external tools if the use case is clear, and regularly check whether permissions are still necessary. Use separate agents for separate tasks, rather than granting an agent blanket access to everything, and document who is responsible for configurations and authorisations.
Workspace admins can also deactivate models that are available for regular selection – without blocking the workflow. The specific model catalogue and the available functions remain transparent and under your control in awork.
Automation requires accountability: What agents are permitted to do
[.toc-name]Agents permissions[.toc-name]
Agents can do more than just prepare content or summarise information; depending on their configuration, they can also carry out actions in awork or connected systems. An agent never acts beyond the permissions granted by the system. Responsibility for instructions, data sources, tools, connections and triggers lies with you – that is, with the organisation carrying out the configuration.
Automated decisions with legal or similarly significant consequences require appropriate human oversight. Particularly sensitive areas of application, such as automated candidate selection, employee appraisals or dismissal decisions, have no place in an uncontrolled AI workflow.
External tools, MCP & connections: Where your responsibility begins
[.no-toc]External tools, MCP & connections: Where your responsibility begins[.no-toc]
Clearly separating awork AI from external systems
External systems and MCP servers can be connected. For third-party providers you choose yourself, their own data protection policies, hosting regions and authorisation models also apply. Therefore, external connections should always be carefully selected, configured and regularly reviewed.
Before connecting an external tool
- What specific added value does the connection provide?
- What data is transferred to the external system?
- What permissions does the connection actually need?
- Where and under what data protection conditions does the third-party provider process data?
- Who reviews the connection regularly?
AI roll-out in practice: your governance guide
- Define responsibilities: Who decides on AI use cases, permissions, external tools and special legal cases?
- Prioritise use cases: Start with clearly defined, simple, low-risk workflows – for example, summaries, project status or preparatory planning.
- Configure data sources and permissions carefully: Don’t ‘connect everything’; instead, provide only the specific context that an agent needs.
- Define rules for external tools: Specify which connections are permitted and how they are authorised.
- Empower the team: Explain how AI is used, which information is sensitive, and when human oversight remains necessary.
- Review and refine regularly: Governance is not a one-off document. As new use cases, tools and agents emerge, the framework should evolve accordingly.
Conclusion: Good governance makes your agency AI-ready
[.no-toc]Conclusion: Good governance makes your agency AI-ready[.no-toc]
AI does not become productive through maximum openness, but through usable, controlled context. Data protection, permissions and human oversight are not obstacles, but the foundation for scalable AI workflows. We bring together work context, permissions and AI functions right where your agency operates. Ensuring that AI doesn’t become an uncontrolled tool stack, but rather part of your value creation.
Do you want to do more than just try out AI in your agency? Discover in the AI Hub how you can progress from initial prompts to secure, productive AI workflows.
