The PMO for AI Programmes: Governing Work That Isn't a Project

Most programme management offices were built to govern work with a known destination: an ERP rollout, a site move, a product launch. Scope is agreed, a plan is baselined, stage gates release funding, and success means delivering what was specified, on time and on budget. That model fails in a particular way when applied to AI.

A PMO for AI programmes has to govern work whose outcome is uncertain at the start, whose quality is a matter of degree, and whose cost continues long after go-live. The answer is not to exempt AI from governance, which is how organisations end up with dozens of unowned pilots. It is to change what the PMO asks for, funds and measures.

Why AI initiatives break stage-gate governance

Stage-gate governance assumes that enough analysis up front will tell you what you are going to get. AI work violates that assumption in four ways.

• Outcomes are uncertain. Nobody knows whether a model will perform well enough on your data, in your process, until it has been tried. A business case written before that point is a hypothesis, not a commitment.
• Evaluation replaces acceptance testing. Conventional software passes or fails a test. An AI system is right most of the time, and the question is whether "most" is good enough for this use, with these controls. That needs an evaluation set, agreed thresholds and a judgement about acceptable error.
• The work does not end at go-live. Models drift as data and behaviour change. Underlying models are updated or withdrawn by their providers. Prompts, retrieval sources and guardrails need upkeep. A project that closes on launch day leaves an asset with no owner and no budget.
• It is a portfolio of experiments, not a single bet. Some initiatives should fail, cheaply and early. A governance model that treats every stopped initiative as a failure teaches teams to keep weak ideas alive.

The symptoms are familiar: pilots that never end, green status reports on work with no route to production, benefits claimed once and never checked.

What a modern PMO for AI programmes changes

A modern PMO keeps its delivery discipline and changes five things.

• Portfolio funding in stages. Fund AI work the way a disciplined investor would. Small amounts release quickly for discovery and proof of value, and larger amounts follow evidence. The PMO balances low-risk productivity improvements against fewer, larger bets on core processes, and the business case and operating model for each initiative is revisited at every funding point, not written once and filed.
• Kill criteria agreed up front. Every initiative starts with written conditions under which it will be stopped or reshaped: the accuracy it must reach, the data it needs, the adoption it must achieve, the cost per transaction it cannot exceed. Agreeing these before work starts removes most of the politics from stopping later.
• Gates based on evidence, not documents. Is there an accountable business owner? Is the data available and lawful to use? Does the system meet its thresholds on an evaluation set that reflects real conditions? Are human oversight, monitoring and rollback in place? Has the process actually changed? These questions track the path for moving agentic AI from pilots to production.
• Benefits tracking that survives go-live. Baseline the measure before the build, name the executive who owns the benefit, and track it after launch against the full cost of running the system. Hours released only become financial benefit when something is done with them, a point we develop in measuring AI ROI from pilots to P&L.
• Capacity and run cost. The constraint on most AI portfolios is not money. It is a few people: data engineers, security reviewers, process owners and the change capacity of receiving teams. Plan against those constraints, limit work in progress, and require a named run owner and operating budget before anything enters production.

A PMO that has never stopped an AI initiative is not governing a portfolio. It is keeping a list.

Stopping should be routine and blameless, with the learning captured and the capacity released to something better.

Risk and compliance gates that arrive early

AI raises questions that a standard project risk log does not ask: what the system decides or influences, whose data it uses, how errors are detected, and who is accountable. The PMO does not need to own the answers, but it should make sure they are asked at intake, not at launch.

A simple risk tiering at intake does most of the work. Low-risk internal uses move quickly through a light path. Uses that affect customers, employees, safety or regulated decisions take a fuller review with legal, security and data protection involved from the start. The EU AI Act, which entered into force in August 2024 with obligations phasing in over the following years, takes a similar risk-based approach, and organisations operating in the EU should confirm with counsel which obligations and dates apply to them. Frameworks such as ISO/IEC 42001 and the NIST AI Risk Management Framework offer useful structure for the underlying management system. The PMO's contribution is to connect that AI governance and compliance work to the delivery calendar, so that it shapes designs instead of delaying launches.

How AI assists the PMO itself

The PMO is also a candidate for the tools it governs. Much of its effort goes into collecting, reconciling and reformatting information, and AI is well suited to that work.

• Status synthesis. Drafting programme reports from delivery tools, meeting notes and financial data, and highlighting where the narrative and the numbers disagree.
• Risk and dependency detection. Reading across plans, logs and minutes to surface conflicts, slipped dependencies and risks that several teams have raised separately.
• Administration. Minutes, actions and change requests.

The cautions are the ones the PMO applies to everyone else. Summaries can be wrong, so a person stays accountable for anything that informs a decision, and sensitive programme data needs proper access controls. The benefit is that analysts spend less time assembling reports and more time challenging them.

Questions to ask your PMO this quarter

• How many AI initiatives are in flight, and who owns each one? If nobody can produce the list, start there.
• Which of them have written kill criteria, and when was one last stopped?
• What evidence does each gate require? Look for evaluation results and adoption data, not only documents.
• Who pays to run each system after launch, and who re-evaluates it?
• Which benefits have been measured after go-live, against a baseline set before it?
• At what point do legal, security and data protection see a new AI use case?

Common questions

Do we need a separate PMO for AI programmes?

Usually not. A separate structure tends to duplicate reporting and isolate AI from the business change it depends on. Most organisations do better by adding an AI pathway to the existing PMO, with staged funding, evaluation-based gates and run ownership, and by building the skills to operate it.

How is governing an AI project different from governing a software project?

A software project delivers specified functionality and is accepted when it passes its tests. An AI initiative delivers performance that is probabilistic, depends on data, and changes over time. Governance therefore shifts from checking delivery against a plan to checking evidence against thresholds, and it continues after launch.

What should a PMO report to the board about AI?

Report on the portfolio, not on individual tools: how much is invested at each stage, what has been stopped and why, which benefits have been verified, where the main risks and compliance obligations sit, and what constraints limit progress. Boards need enough to judge whether the organisation is learning quickly and spending sensibly.

Where Ganexa can help

Ganexa works with transformation and PMO leaders to adapt governance for AI without losing delivery discipline. Our PMO and programme management practice designs the portfolio funding model, evidence-based gates, benefits tracking and run ownership described here, and can operate alongside your team while the new habits take hold. To review how your current governance handles AI work, book a free consultation.