Governing AI in Practice: A Typology of Four Risk-Driven Archetypes

Paper in proceeding, 2026

Organizations are rapidly adopting Artificial Intelligence (AI), but the governance frameworks needed to manage its risks remain poorly understood, creating a gap between high-level policy and real-world practice. Addressing this, our paper presents findings from an in-depth case study of a large Engineering, Procurement, and Construction (EPC) company, supplemented by five comparative interviews with leaders from other engineering and technology organizations. Our primary contribution is the identification of four distinct governance archetypes: High-Assurance, Cautious, Enterprise-Driven, and Developer-Led. We argue that their adoption is based on an organization’s specific risk profile, defined by operational domain, AI application, and organizational scale. We further show how these governance archetypes directly shape technical architectures, from mandated hybrid systems in high-assurance environments to emergent designs in developer-led settings. The resulting typology provides a novel diagnostic framework for practitioners and an explanatory tool for researchers, bridging the crucial gap between regulation and implementation.