the framework

A2G2

Augment, Automate, Govern, Guard. A four-stage framework for adopting AI with control. Most organisations move through all four stages. The ones that plan for governance and security from the start get the gains without the clean-up.

Stage 1 · Explore

Augment

Individuals start using AI to draft, research, summarise and problem-solve. Value arrives quickly and usage spreads informally, usually before anyone has decided where AI belongs and where it doesn't.

the riskUnmanaged adoption. Staff on personal accounts, sensitive data in consumer tools, and no shared view of what good looks like.

the question to askWhere should we use AI, and, just as importantly, where shouldn't we?

what good looks likeAn approved set of tools, agreed use cases, and staff who know what AI is for here.

Stage 2 · Scale

Automate

AI moves from individual habit to business process: shared assistants, standard prompts and automated workflows that produce consistent output across the team. This is where productivity gains start to compound.

the riskAutomating because you can, not because you should. Errors scale just as fast as efficiency.

the question to askWhich processes genuinely benefit, and who checks the output before it reaches a customer?

what good looks likePrioritised use cases, each with a named owner and human review built in.

Stage 3 · Control

Govern

Policy catches up with practice. You define what AI is used for, how, when and by whom, covering acceptable use, data handling, disclosure and accountability.

the riskBanning it. Prohibition drives shadow AI and you lose sight of the one thing you're responsible for: your data.

the question to askWhat are our rules, does everyone know them, and when do we tell people AI was involved?

what good looks likeA living AI policy, trained staff, and transparency with customers.

Stage 4 · Protect

Guard

You defend the organisation against AI being used against it (voice cloning, deepfakes, convincing phishing and impersonation) and against data leaking out through AI tools.

the riskAssuming it won't happen to you. The tools to clone a voice cost less than a streaming subscription.

the question to askIf someone cloned our MD's voice this afternoon, would our processes catch it?

what good looks likeMFA on every account, secondary verification for payments and sensitive instructions, and a culture that checks before it acts.

the principle

Plan for stage four on day one.

Most organisations work through the stages in order and discover their governance and security gaps after the fact. Think about stages three and four alongside your first experiments, and the controls are largely in place before you need them.

Read the column that introduced A2G2 →

Not sure which stage you're in?

Most organisations are in two at once. Happy to compare notes.

Talk to Dan →