Most organizations believe they have AI risk handled. They have a policy. They have a list of approved tools. They have a security team watching the perimeter. That is not governance. That is inventory. The harder problem is not controlling the technology; it is governing the decisions the technology now influences. And sitting at the center of every one of those decisions is an asset most organizations have not even named yet: the prompt.
A Record Hiding in Plain Sight
I have spent more than two decades helping organizations govern their records, digitizing county government files, managing discovery for law firms, and building the systems that determine what an organization can prove about its own past. I know what a business record looks like. The prompt is one.
Every prompt captures how a question was framed, what context was supplied, what the model returned, and how that output shaped what happened next. When AI helps draft a contract, evaluate a loan application, inform an HR decision, or summarize a legal matter, the prompt is not a technical input. It is the reasoning trail behind the decision, frankly it is the modern equivalent of the memo, the meeting notes, the marked-up draft.
Organizations spent a generation learning that email was discoverable, that documents required retention schedules, and that “we didn’t think of it as a record” was not a defense. The prompt is that lesson repeating itself, and most enterprises are early enough in the cycle to get ahead of it.
Picture the Deposition
Here is the test I put to leadership teams. Imagine a decision your organization made this quarter?! Did you deny a claim, terminate an employee, or challenge a contract clause that later became contested, where AI touched the work? Now imagine opposing counsel, an auditor, or a regulator asking four questions:
Who created the prompt? What information was provided to the model? How was the output reviewed? Who approved the final decision?
If your organization cannot answer those questions, the issue is not that your AI was insecure. It is that your decision cannot be explained. No firewall fixes that.
This Is Governance, Not Cybersecurity
The reflex in most organizations is to hand AI risk to the security team. Let me be clear, security matters, but I am asking you to ask a different question. Security asks whether the system can be breached. Governance asks whether the decision can be defended.
Answering the second question requires legal, compliance, audit, records management, business leadership, and technology working from the same playbook: what gets retained, for how long, reviewed by whom, and disclosed under what circumstances. Those are records management questions. We have simply never applied them to this kind of record before.
Leaders Who Wait for Regulation Are Already Behind
In my experience, the organizations that navigate technology transitions well share one habit: they build controls before they are mandatory. They treated email retention seriously before the case law forced them to. They invested in data governance before privacy regulation made it table stakes.
Prompt governance deserves the same posture, not because a regulator requires it today, but because the organizations that can explain their AI-assisted decisions will move faster, not slower. Governance is not the brake on AI adoption. It is the license to expand it. Teams deploy AI more aggressively when leadership can stand behind the results.
The Pattern Always Repeats
Every consequential technology eventually forces a reckoning with accountability. Paper documents did. Email did. AI is doing it now, only faster and closer to the decisions that matter most.
The winners of this transition will not be the organizations with the most advanced models. They will be the ones that can show their work. Specifically, who asked what, what the machine contributed, who decided, and why that decision deserves trust.
So, the question for every leadership team is no longer whether your people are using AI. They are. The question is whether your organization is prepared to govern the decisions AI is helping to shape, and to prove it when someone asks.