Governing AI Across a Sales Team
AI in sales is now a governance question as much as a productivity one. Here is the operating model we recommend: approval, visibility, and a clear audit trail.
Most sales organisations did not decide to adopt AI. It arrived one rep at a time, through note takers, writing assistants, and research tools bought on personal cards. The productivity is real, and so is the exposure: customer data in unreviewed tools, messaging that nobody approved, and no record of what was sent on the company's behalf.
Start with an inventory, not a policy
A policy written before you know what is in use governs an imaginary team. Ask what people are actually using, without blame, and you will usually find a longer list than expected. That inventory tells you which risks are theoretical and which are live this week.
- Which tools touch recorded customer conversations.
- Which tools generate customer-facing text.
- Which tools write to systems of record such as the CRM.
- Where the data goes and whether it trains a third party model.
Classify by what the system can do, not what it is called
The useful distinction is not chatbot versus agent. It is read, draft, and act. A tool that reads and summarises carries data risk. A tool that drafts carries brand and accuracy risk. A tool that acts, meaning it sends, updates, or commits on your behalf, carries all of that plus operational risk, and deserves a different level of control.
Anything that can act on a customer relationship should be as reviewable as a person doing the same job.
Keep a human on the consequential steps
We designed Grw around approval for exactly this reason. The system does the preparation, the review, and the drafting, and a person approves anything that reaches a customer or changes a record. That keeps the speed benefit while leaving accountability where it belongs. Full autonomy is appropriate for low-consequence internal tasks, and it is a poor trade on anything a customer will see.
Write down what needs approval
Ambiguity here creates either paralysis or quiet workarounds. A short, specific list works better than a principle. Customer-facing emails, pricing and commercial terms, CRM stage and forecast changes, and anything shared externally with your logo on it.
Insist on an audit trail
When something goes wrong, and eventually something will, the question will be what the system did, on what basis, and who approved it. Any AI system in your revenue stack should be able to answer that without an engineering investigation. If it cannot show its inputs, its output, and the approving human, it is not ready for customer-facing work.
- Every generated output is stored with the inputs that produced it.
- Every approval records who approved it and when.
- Admins can see usage across the team, not only their own activity.
- Access follows your existing permission model rather than a separate one.
Give the team a sanctioned path
Shadow AI is a symptom. Reps reach for unapproved tools because the approved path is slower or does not exist. The most effective governance we have seen pairs a clear boundary with a genuinely good sanctioned option, so the compliant choice is also the easiest one. Ban without an alternative and usage moves somewhere you cannot see.
Review it quarterly
This space moves fast enough that an annual review is out of date on arrival. A short quarterly pass over the inventory, the approval list, and any incidents keeps the model current, and it keeps security, legal, and sales leadership looking at the same picture rather than three different ones.
