Ask most businesses what "AI governance" means, and pay attention to how quickly the answer arrives, because the speed itself tells you something. You'll get a version of the same answer: are we legally exposed, and could this embarrass us. Both fair questions. Both, I'd argue, the wrong starting point, because they're built entirely around protecting the company, and a brand that only asks "could this hurt us" will happily ship something that's perfectly safe for the business and quietly corrosive for everyone on the other end of it, without a single alarm bell going off anywhere in the organization to say so.
Two different questions that get treated as one
Risk management asks: what's the worst that could happen to us, and how do we minimize the odds and the damage. It's a defensive posture, and a necessary one — nobody should skip it. But it has a blind spot built into its own logic, because it's optimizing entirely for the company's exposure. A chatbot that never says anything legally actionable, never generates a PR crisis, and never triggers a regulator can still leave every customer who talks to it feeling handled rather than helped. Risk management would call that a total success. Nothing went wrong. Nobody sued anyone. The brand is, by every metric risk management tracks, completely fine.
I don't think "nobody sued us" is a high enough bar for what a brand's automated systems should be accountable to, and this is the gap the third pillar of my own framework — Governance for Human Flourishing — is built to close. It asks a completely different question than risk management does: is this actually good for the humans on the other end of it, not just efficient or defensible for the company deploying it.
Where the idea of "flourishing" actually comes from
I'm borrowing this framing deliberately from outside brand theory, because brand theory doesn't have a native concept for it. Economist Amartya Sen built what's now called the capability approach specifically to argue that wellbeing shouldn't be measured by resources delivered, but by what people are actually able to do and be as a result — their real, substantive freedom to live a life they have reason to value, not just the presence of an input that's supposed to help. Martha Nussbaum extended that into a more concrete list of core human capabilities worth protecting — things like bodily integrity, practical reason, and genuine affiliation with others, not just survival-level resource access. Neither of them was writing about branding or artificial intelligence, and I think that's part of why the framing holds up so well once it's imported — it wasn't built to flatter a business's existing incentives in the first place.
Translate that into a brand context and the question shifts in a way that actually changes decisions. It's not "did we deliver the service efficiently." It's "did the person on the other end of this interaction come away more capable of doing what they actually needed to do, or did we just process them through a funnel that was efficient for us and merely tolerable for them."
What this catches that risk management misses entirely
Think back to Air Canada's chatbot, which I've written about before. The legal risk framing eventually caught that failure — a tribunal ruled the airline responsible for what its chatbot said, and Air Canada paid the fare difference. But the risk-management lens only caught it after the harm had already landed on a grieving customer who'd been given confidently wrong information at the worst possible moment to receive it. A flourishing-oriented governance check would have asked a different, earlier question: is a customer navigating a bereavement fare — a genuinely vulnerable, time-pressured moment — the kind of interaction we should ever let an unsupervised system handle alone, regardless of whether it happens to answer correctly. That's not a legal question. It's a "is this good for the human in front of us right now" question, and it would have caught the risk before it became one, simply by asking a more honest question earlier in the process, well before any tribunal was ever involved.
Why this pillar is the one most businesses skip first
It's the pillar with no obvious business case attached, which is exactly why it's the one that gets quietly dropped when a team is moving fast. Brand Integrity has an obvious commercial argument: drift costs you customers who notice. Oversight has an obvious commercial argument: unsupervised AI creates liability. Flourishing has a much harder argument to make in a quarterly review, because its cost shows up as slow, generalized erosion of trust rather than a single traceable incident — the customer who quietly stops feeling like a person and starts feeling like a ticket number, who doesn't complain, doesn't sue, just leaves and tells two friends why, in a conversation the business will never see or measure.
I think that's precisely why it deserves to be asked out loud on a schedule rather than left to instinct. The businesses I respect most in this space aren't the ones that never automate anything sensitive. They're the ones that ask, before they do, whether the thing they're about to make more efficient is also something they're comfortable making less human.
The compliance trap specifically
I want to name a specific version of this trap, because I see it constantly in how AI governance conversations get framed regionally and globally alike: treating a risk-tiered compliance framework as the finish line rather than the floor. Regulatory frameworks that classify AI systems by risk level exist for good reason, and meeting their obligations matters. But "we meet our regulatory obligations" and "our AI is good for the people it touches" are not the same claim, and a business that stops at the first one has done the legally required minimum, not the actually sufficient work, often while genuinely believing in good faith that the job is finished. The gap between those two claims is exactly where Governance for Human Flourishing lives, and it's a gap no regulator is currently positioned to close for you, because it's not really their job to. It's yours.
What asking this question actually changes, in practice
This isn't only a philosophical distinction — it changes concrete decisions once you actually ask it before a rollout instead of after. A wellness brand automating intake questionnaires might discover, once they ask the flourishing question honestly, that a fully automated flow works fine for a routine booking but actively fails someone disclosing something vulnerable partway through, because the system has no way to notice the shift in what the person actually needs and hand them to a human at exactly the right moment. A financial services brand automating early-stage customer support might find that efficiency gains are real for simple account questions but actively harmful for anyone showing signs of financial distress, where a fast, efficient, technically correct answer is precisely the wrong thing to optimize for. In both cases, the fix isn't "remove the AI." It's building a specific, deliberate handoff point where the system recognizes it's reached the edge of what it should be handling alone — which is a design decision, not a policy statement, and one that a purely risk-based governance lens has no particular reason to ever surface.
The question, stripped down
Before your next AI rollout touches a customer, ask one thing that has nothing to do with legal exposure: if I were the person on the receiving end of this, right now, in whatever state they're likely to be in when they reach it, would I come away better equipped to do what I actually needed to do — or just processed. If you can't answer that with confidence, you haven't finished governing it yet, no matter how airtight the compliance checklist looks, and no matter how many boxes your legal team has already ticked.
I don't think this makes governance harder to justify to a leadership team, incidentally, even though it sounds like the softer, less commercially urgent of the three pillars at first glance. Trust that erodes quietly, one dismissed customer at a time, still eventually shows up on a revenue line — it just shows up months later, disguised as unexplained churn, by which point almost nobody thinks to trace it back to the specific automated interaction that started the slide, months or quarters earlier, when the pattern was still small enough to fix cheaply.
Curious whether your own AI-touched customer journeys pass this test, not just the legal one? Get Your Free Brand Audit → and let's find out together.
References
CBC News. (2024, February 16). Air Canada found liable for chatbot's bad advice on bereavement rates.
Nussbaum, M. C. (2011). Creating Capabilities: The Human Development Approach. Harvard University Press.
Sen, A. (1999). Development as Freedom. Oxford University Press.
Civil Resolution Tribunal of British Columbia. (2024). Moffatt v. Air Canada, 2024 BCCRT 149.