Every framework I've ever built started the same way: someone asked me a question I couldn't answer with the frameworks that already existed, and I got stubborn about it instead of letting it go. The question, this time, was simple enough to fit in an email: "Our team uses AI for basically everything customer-facing now — content, replies, even some sales conversations. How do we actually know if that's fine?"
I didn't have a good answer. Most of what's written on AI governance lives at the level of enterprise risk committees and regulatory compliance — real, necessary work, and almost none of it built for a ten-person team trying to figure out whether their chatbot is quietly saying things they'd never say themselves. So I built the thing I wished existed. I call it the BIG Framework — the operational arm of what I call Human-Centered Brand Governance — and it's three watch-points, checked together, not three separate departments handing off a form to each other.
Why three, and why together
Most attempts at "AI governance" collapse into a single question: is this legally safe? That's necessary, but it's a compliance question, and compliance questions have a habit of getting satisfied by a policy document nobody reads again after the day it's signed. I wanted three questions that couldn't be answered by a policy document alone, because each one requires someone to actually look at output, on a recurring basis, and make a judgment call that a checklist can't make for them.
Brand Integrity asks whether the output is still saying what the brand actually means, or whether it's quietly gone generic to make production faster. This is the one that catches drift early — not "is this technically correct," but "is this still recognizably us." A tone that's slightly flatter than your usual voice, a value that's stopped showing up in the specific language you'd normally use for it, an answer that's fluent and also could have come from any competitor in your category — that's Brand Integrity eroding, and it erodes quietly, months before anyone notices the brand "doesn't feel like itself" and starts asking why.
Intelligent Human Oversight asks whether a real, accountable person is checking the decisions that matter, all the way down the vendor chain, or whether "the AI handles it" has become an excuse for nobody checking at all. This is the pillar most teams think they have covered because someone glanced at the dashboard once, weeks ago, and it looked fine. Oversight, done properly, is scheduled, specific, and has a name attached to it — not a general sense that someone's probably watching, somewhere, eventually.
Governance for Human Flourishing asks the question most AI governance conversations skip entirely: is this actually good for the humans on the other end of it — the customer, the employee, the community — or is it just efficient for the company's bottom line? This is the pillar I care about most, honestly, because efficiency and identity get treated as the same thing constantly, and they're not. You can automate a process into something extremely efficient and quietly damage the exact relationship of trust that made people choose you in the first place, without a single metric on your dashboard ever flagging it.
What checking all three actually looks like, on a schedule
Here's the part that turns this from a nice paragraph into something you can actually run. Pick a cadence — monthly works for most small teams — and put three things on it, each one owned by a specific person, not a department:
A sample read of your last month's AI-touched output, against a written, specific list of what your brand would never say. Not "does this sound professional." Does it sound like you, specifically, on your worst honest day, and would you sign your name to it. This is the Brand Integrity check, and it takes less time than most people assume — twenty communications, read cold, is usually enough to surface a pattern if one exists, the same exercise I've recommended in earlier pieces on this exact topic.
A named owner for every AI system that touches a customer, including anything a vendor runs on your behalf, with actual visibility into what that system is allowed to say and do. Not a shared inbox. A person who could tell you, if you asked them today, what the guardrails are and when they last checked them. This is the Oversight check, and the honest test is whether that person exists at all, before you worry about whether they're doing a good job.
One question asked out loud, ideally by someone who isn't already invested in the answer being yes: is what we're automating actually making the people on the other end of it better off, or just making our lives easier? This is the Flourishing check, and it's the one most likely to get skipped, because it's the only one of the three with no obvious business case attached to asking it. Ask it anyway. It's usually the one that catches the thing your compliance checklist never would.
Running it across a real quarter
If you're wondering what this actually looks like stitched together rather than as three separate bullet points, here's the shape I'd suggest for a small team. Month one: write the "what we'd never say" list, however short, and assign the three owners by name. Month two: run the first full cycle of all three checks and treat the findings as data, not as a report card — you're establishing a baseline, not passing or failing anything yet. Month three: compare against the baseline. This is the point where drift, if it exists, becomes visible as a trend rather than a single data point, because you now have two readings to compare instead of one impression to trust.
The reason the quarter matters, rather than a single check, is that Brand Drift is defined by direction, not by a snapshot. A single read of your output tells you whether this month looks fine. Two or three reads, spaced out, tell you whether "fine" is holding steady or quietly eroding — which is the actual question underneath all of this.
What happens when you skip one
Skip Brand Integrity checks, and you get slow, undetected drift — the brand that quietly stops sounding like itself over a year and a half, discovered by an outsider before it's discovered internally. Skip Oversight, and you get the viral screenshot: a chatbot that agreed to sell a truck for a dollar, or swore at a customer, because nobody was watching the boundary of what it could say. Skip Flourishing, and you get something harder to name and just as costly — a brand that's technically compliant, technically on-voice, and still leaves people feeling handled rather than served, which erodes trust in a way that doesn't show up on any dashboard until retention quietly drops.
The framework only works checked together, because each pillar catches a different failure mode the other two miss. A brand can pass an integrity check and still fail its customers if nobody asked whether the efficient thing was also the good thing. A brand can have a named human in the loop and still drift if that human is checking for legal risk and nothing else, because legal risk and brand fidelity are not the same question wearing different clothes.
Why I resisted making this more complicated
I had an earlier draft of this framework with six pillars instead of three, and I cut it down deliberately, not because the other considerations weren't real, but because a framework nobody actually runs is worth exactly nothing, no matter how comprehensive it looks on a slide. Three is small enough to fit on an index card, assign by name in a single meeting, and actually check every month without it becoming its own full-time job. I'd rather hand a founder three questions they'll genuinely ask every quarter than nine they'll set up once, admire, and quietly stop running by month two. Rigor that doesn't survive contact with a busy team's actual calendar isn't rigor. It's decoration.
The honest caveat
I don't think this framework replaces judgment, and I'd be suspicious of anyone who told you a checklist could. What it replaces is the current default, which for most businesses I talk to isn't a bad framework — it's no framework at all. Three specific, scheduled, owned questions beat a vague sense that AI is "probably fine" every time, and they're cheap enough to run that there's no real excuse left for skipping them, especially once you've seen what skipping them cost the businesses that found out the hard way.
Want a second pair of eyes on whether your own AI-touched brand output would survive this framework? Get Your Free Brand Audit → and let's find out together.
References
Aaker, D. A. (1996). Building Strong Brands. Free Press.
OECD. (2019). OECD Principles on Artificial Intelligence. Organisation for Economic Co-operation and Development.
Zakim, A. (2025). The BIG Framework: Human-Centered Brand Governance in AI-Mediated Branding [Working paper, Brand Identity Governance in the Age of AI research program].