Case: responsible AI governance that supports everyday work
Published
A leading Finnish creative agency worked with Ikoni to build a lightweight but scalable AI & DPA Governance model that keeps business needs, data protection and client obligations in balance.
The use of AI grew rapidly at a leading Finnish creative agency. The organisation clearly saw the potential of AI in client work, analytics and internal efficiency, but wanted to make sure that this development happened in a controlled and responsible way.
The goal was never to slow down experimentation or to build a heavyweight governance regime. Instead, the company wanted a clear and practical way of using AI that keeps business needs, data protection and client obligations in balance.
The project produced a hands-on AI & DPA Governance model, developed together, that supports the organisation’s daily work and enables safe use of AI going forward.
The challenge: fast-growing AI use needed shared ground rules
The organisation had already identified a number of opportunities to apply AI. At the same time, practical questions began to surface:
- What data can be given to an AI service?
- When is a risk assessment or DPIA required?
- Who makes the call in unclear situations?
- How do we keep the process from becoming a bottleneck?
The hardest cases involved unstructured data whose content could not be fully anticipated in advance. It was well understood that adopting AI is not purely a technical question — it is above all a question of operating models and leadership.
The solution: a lightweight but scalable governance model
Ihmeitätekevä Ikoni designed and facilitated the AI governance model together with the client team, with practicality and business flow as the starting point.
The core principle was simple: the risk level of AI use is determined by the combination of data and service. The project delivered:
- a three-tier data classification model
- a classification model for AI services
- a decision-making and escalation path
- operational assessment templates
- and practical ways of working for day-to-day use
The design placed particular emphasis on making sure that the business owns the decisions, responsibilities are clearly defined, and governance supports the work rather than slowing it down.
Collaboration was at the core of the project’s success
The project involved extensive discussions with business stakeholders, leadership, data management and technical specialists. The client team’s strong grasp of their business combined with Ikoni’s experience in data governance, AI and governance models. Together we found solutions that were both workable in practice and defensible from a regulatory standpoint.
It was especially important to build a shared understanding of where the risks genuinely arise, which situations are unambiguous, and where judgement and risk management are needed.
Working this way produced a model that genuinely fits how the organisation operates, rather than a policy document that sits on the shelf.
The outcome: a clear operating model for safe AI development
The project delivered a coherent AI & DPA Governance package that includes:
- a governance framework
- a data classification policy
- a classification model for AI services
- a decision-making model
- and practical tools for assessing projects
The result enables faster decision-making, consistent risk management, responsible AI development, and an operating model that scales to future needs. At the same time, the organisation’s internal understanding of the risks, responsibilities and opportunities of AI use grew significantly.
In closing
Good AI governance does not block innovation — it makes innovation safe. By combining business-led thinking, clear responsibilities and practical ways of working, we built a solution that will support the organisation’s AI journey well into the future.