Governance framework & guidance
What should be reported?
Report behaviour, outcomes or circumstances that may need attention: unexpected AI output, inappropriate reliance, questionable use of information, a control that is not being followed, a significant supplier change, an affected person raising a concern, or another issue connected with an AI Use.
You do not need to classify the Risk
Contributors are not expected to decide whether something is a privacy breach, security incident, legal issue or formal AI Risk. Record the facts you know. Governance owners and specialist reviewers determine what formal process is required.
Why this matters
A governance framework works better when employees can surface uncertainty early. The objective is not to make every employee an AI governance expert; it is to create a clear path from observation to accountable review.
Using Swell AI
What should I write?
- What happened or what you observed.
- Which business activity or AI Use it relates to, if known.
- When it occurred or was noticed.
- Who or what may be affected.
- Any immediate action already taken.
What happens next?
The concern can be reviewed and, where appropriate, connected to a formal Risk, Governance Action, Material Change, Incident, reassessment or other governance response. A plain-language concern is a signal for review, not an authoritative risk determination on its own.