An AI risk process needs to sit inside the workflow where decisions are made, tools are chosen, and people actually use the system. This week’s OpenAI reporting raises that organizational question. The public dispute concerns whether the company disbanded its preparedness team; business leaders also need to examine how risk checks work in daily operations.
The Verge reported on August 18 that, according to the Financial Times, OpenAI had disbanded its preparedness team at the end of July. That team assessed whether models posed serious risks and worked on ways to reduce them. OpenAI disputed the report, telling The Verge, “We have not disbanded the Preparedness team,” and said research leaders across cybersecurity, biological and chemical risk, and AI self-improvement now report to its head of safety, Saachi Jain.
Fine. Take OpenAI’s denial seriously. The structure still matters.
The org chart is the control system
Business leaders tend to treat AI risk as a policy question. Write the acceptable-use policy. Create a review group. Ask legal to weigh in. Maybe assign an executive sponsor. Then everyone returns to buying tools, automating tasks, and asking teams to “find efficiencies.”
AI use can spread between governance meetings, so teams need controls they can apply during the work.
Gallup reported in July that 52% of US employees now use AI at work at least a few times a year, up from 27% two years earlier. It also reported that employees saying their employer has integrated AI tools into daily work rose from 41% in the first quarter of 2026 to 47% in the second quarter. That means the operating reality is moving faster than most companies’ control systems.
The same pattern is visible at the platform level. The Verge reported on August 11 that ChatGPT hit 1 billion weekly users in July, while Google said Gemini reached 1 billion monthly users. At that scale, the tools are becoming default work surfaces.
When a tool becomes default, a separate risk function becomes too slow by design.
Test how AI governance works in practice
Most companies can produce an AI governance document if asked. Test how its rules work in practice.
The real test is operational:
When someone adds an AI tool to a workflow, who reviews what changes?
When an employee uses customer data in a prompt, who knows?
When an AI output becomes part of a financial model, sales recommendation, legal summary, customer email, or hiring screen, what catches the failure?
If the answer is “the AI committee,” identify the person responsible for checking that particular workflow.
Committees and policies need a way to reach the sales process, the support queue, the analyst spreadsheet, the marketing calendar, the claims review, the recruiting screen, and the executive assistant’s inbox. Those are the places where AI creates value and risk.
Risk work has to follow the work there.
Centralize standards, distribute ownership
The mistake is choosing between a centralized AI risk team and total decentralization. Both break.
A fully centralized team becomes a bottleneck. People route around it because they have targets to hit and customers to serve. A fully decentralized approach becomes shadow AI with nicer language. Every team invents its own rules, and leadership discovers the problem only after something leaks, breaks, or quietly produces bad decisions for three months.
The better pattern is centralized standards with distributed ownership.
One group should define the non-negotiables: what data cannot be used, which tools are approved, what needs a human review, what records must be kept, what use cases are off limits, and what escalation looks like when something feels wrong.
Every operating team needs a named, accountable owner for AI use inside its own workflow. That person must understand the process, know where AI touches it, and be able to explain the risk controls in terms the team can use.
Choose that owner for their AI literacy and operational authority: they need to know what can go wrong and be able to change how the team works. The role can sit with someone who already owns the business process.
What to do this week
Pick one workflow where AI is already being used in daily work.
Map it in plain language. Where does information enter? Where does AI touch it? Where does the output go? Who relies on it? What happens if it is wrong? Who checks it before it affects a customer, employee, financial decision, or public claim?
Then assign ownership at the workflow level.
Named ownership and workflow-level checks give teams a usable structure for AI adoption. Build those checks into the way work moves.
OpenAI operates at the frontier, but the organizational question also applies to ordinary businesses: how can risk review keep pace as AI becomes part of normal work?
Put the policy into practice at the points where AI enters the workflow and its output affects a decision.