Inside an AI governance foundation for a mid-market life insurer.

The work opens with a structured discovery that maps the AI surface area across the operating model, function by function, wherever the work touches policyholder data or claim outcomes. Each session produces a documented operational picture: current workflow volumes, the Shadow AI behaviors people are actually relying on, and the specific friction points slowing adoption of the tools already approved.

Discovery is built to do something most assessments do not. It is structured so that the pilot candidates it surfaces independently reflect the priorities leadership already holds privately, without leadership being asked to hand those priorities over first. When an outside process arrives at the same shortlist a senior leader had in their own head, the leader sees their judgment validated rather than second-guessed. That is what earns the mandate for everything that follows.

From discovery, the engagement narrows to a small set of candidate pilots, each scored against three criteria: regulatory exposure under the state's NAIC alignment, the behavioral readiness of the team that would actually use the tool, and projected return given the current workflow constraint. The scoring is built for consensus rather than a decision handed down out of context. Leadership scores the candidates and chooses the final one together.

Before any build specification is locked, the chosen workflow is prototyped in a clickable, client-safe form and designed alongside the person who does the work every day. Designing with the operator rather than for them surfaces the workflow gaps a written specification always misses, and it builds the buy-in that decides whether a tool gets used or quietly abandoned. This is consistently the highest-leverage moment in the engagement.

The governance foundation then produces the artifacts a state regulator would expect to see if it invoked the NAIC AI Systems Evaluation Tool: an AI inventory aligned to the state's bulletin definitions, an Acceptable Use Policy calibrated to the carrier's data classification tiers and shaped to how the workforce actually operates, a Vendor Risk Framework for evaluating new AI tool contracts before they are signed, a Governance Committee Charter that establishes who owns AI decisions and how oversight runs, an ROI measurement structure for the chosen pilot, and a Regulatory Alignment Checklist mapped to the provisions the state has adopted.

The behavioral-science layer runs in parallel through all of it. Where most governance consultants stop at a written policy, this work produces policies designed for the real conditions under which people will be asked to follow them. Cyberpsychology research on disclosure, organizational scrutiny, and workflow friction shapes how the Acceptable Use Policy is rolled out, how Shadow AI is surfaced without punishing the people using it, and how managers are equipped to lead the change.

Two structural choices separate this from a typical compliance engagement.

The first is that discovery is designed to surface the operational truth of how AI is actually being used, not the version the policy documents claim. That means the governance work is calibrated to real conditions instead of theoretical compliance.

The second is that the human-side workstream runs alongside the document workstream from day one, so the policies that emerge are already built for adoption rather than retrofitted for it later.

Both reflect a single principle. In a regulated mid-market organization, AI governance fails when it treats the documents and the workforce as separate problems. The framework that survives a regulatory inquiry and the framework the workforce will actually follow are the same framework, or both are at risk.