AI Governance
As agile teams incorporate AI agents into their workflows, governance stops being an abstract matter of corporate policy and becomes part of the team's everyday operational practice.
Dimensions of AI governance
Usage policies
They define which AI tools the team can use, for what types of task, and with what restrictions. They include:
- What data can be provided to an external model (especially relevant with customer data or confidential information).
- What tasks can be delegated to autonomous agents and which require human intervention (HITL/HOTL).
- What AI models or services are authorized.
Shadow AI and levels of usage
"Shadow AI" refers to the use of tools that have not been evaluated or authorized by anyone. It tends to emerge when the rules—what is permitted and what is not—are unclear; individuals who are unsure whether they are allowed to use an AI assistant may either hide their usage or forgo the technology altogether. DORA proposes categorizing usage into three levels: "prohibited," "permitted with guardrails," and "permitted." An effective team policy can fit on a single page and should outline which tools are used, what data they process, what requires review, what must be disclosed, what an AI agent is authorized to do autonomously, and how the team learns; this policy should be reviewed during the retrospective, just like any other team working agreement.
AI Literacy
The European AI Regulation requires providers and deployers to adopt measures that support AI literacy among their personnel (Article 4). Following the amendment introduced by Regulation (EU) 2026/1744, this has become a mandatory requirement, with the Commission and the Member States playing a greater role in its promotion.
Autonomy limits
They establish the HITL/HOTL model for each type of agentic action: which actions require prior human approval, which can be executed automatically with subsequent notification, and which are prohibited for agents.
Output auditing
Processes for reviewing and logging the output of AI agents, especially in critical tasks. They include:
- Logs of which agent performed which action and with what instructions.
- Periodic reviews of the quality of AI outputs in production.
- Mechanisms to detect and correct hallucinations or unexpected behaviors.
Accountability
Clearly define who is responsible for the AI’s output. Responsibility for the result always lies with people: whoever submits a piece of work is accountable for it, regardless of how it was produced. AI may make suggestions or execute tasks, but it does not hold a role or assume responsibilities.
The Role of the Scrum Master
The Scrum Master helps the team reach an agreement on the use of AI and its boundaries, document this agreement, and review it during the retrospective. These team agreements must align with the organization’s policies and applicable regulations; if this framework fails to address a specific need of the team, the Scrum Master escalates the matter to the appropriate party.
Some organizations use new titles for this role, such as "agile enabler", although none has become established as a standard.
Common mistake
Waiting for incidents to happen before defining governance. AI governance is more effective and less costly when it is designed preventively, before agents are in production. A team that starts using autonomous agents without clear policies on autonomy, data, and accountability is not "being agile": it is accumulating operational and regulatory risk that may well lead to an incident.
Resources
🏦 IA aplicada al trabajo ágil [AI Applied to Agile Work, in Spanish]State of the art and guide · Skill Arena
📄 Scrum Master en equipos con IA [Scrum Master in Teams with AI, in Spanish]Free download · Scrum Manager
References
- DORA, "Clear and communicated AI stance", Dora: https://dora.dev/capabilities/clear-and-communicated-ai-stance/
- IBM (2025), *Cost of a Data Breach Report*
- Article 4 of the Regulation: https://artificialintelligenceact.eu/article/4/.
See also
Want to advance in agility? You can search for course and exam calls, or go at your own pace by becoming a member of the Agile Club. This membership includes exclusive resources, e-learning classrooms, and access to Skill Arena: a space to practice and measure your agile skills at your own pace.