How Do You Govern AI Across a Multi-Brand SaaS Portfolio?

Most AI governance conversation happens at the product level: which model do we use, how do we test outputs, what data are we allowed to use? Those are real questions, but they are the wrong starting point for a holding company. At the portfolio level, the first question is structural: who is accountable for AI decisions that cross brand lines, and what principles hold regardless of which venture is involved?

At voolama, the answer is a shared governance layer built on four brand values that predate the current AI wave and were not written for it: Flow (AI should reduce friction, not create it), Human Experience (every AI output that touches a customer must be reviewable by a human), Clarity (AI decisions must be explainable to the people affected by them), and Innovation (we adopt new capabilities deliberately, not reactively). Because these values were already embedded in how the portfolio operates, applying them to AI governance did not require a separate AI ethics policy. It required mapping existing accountability structures onto new capability decisions.

The practical result is two distinct layers. Portfolio-level principles are set at the voolama holding-company level and are non-negotiable across all four brands. Brand-level execution, meaning which tools, which workflows, which integrations, is the responsibility of each venture. DAVE, as an AI workflow orchestration product, has the highest AI exposure in the portfolio: AI is the product, not a feature. That means DAVE's internal review cadence is tighter and more frequent than Airport Online's, where AI capabilities are peripheral to the core SaaS microsite offering. Applying the same governance depth to both would be disproportionate in both directions.

Two external frameworks inform this proportionality thinking without being adopted wholesale. The NIST AI Risk Management Framework (AI RMF 1.0, published January 2023) organises governance into four functions: Govern, Map, Measure, and Manage. The Govern function, covering policies, accountability structures, and organisational roles, maps to the holding-company layer. The Map, Measure, and Manage functions sit at the brand level. The EU AI Act (Regulation 2024/1689, in force August 2024, Articles 6-9) classifies AI systems by risk tier and requires governance depth to match that tier. voolama does not claim conformance with either framework, but both inform where governance effort is concentrated.

The key limitation of any holding-company governance layer is that it cannot substitute for product-level expertise. The portfolio layer sets the principles and the accountability structure. It does not and should not attempt to specify how DAVE's engineering team tests a specific model output or how The DAM Republic's advisors validate an AI-generated metadata suggestion. Those decisions require domain knowledge that lives at the brand level, not the holding-company level.

What this section does not cover: this governance model addresses the operating and deployment layer. It does not address model training, foundation model selection, or upstream data provenance, which sit with the third-party AI providers voolama's ventures use.

AI sprawl is the portfolio-level version of shadow IT. It happens when individual teams adopt AI tools independently, without shared visibility into what is being used, what data it touches, or who is accountable if it produces a bad output. In a single-product company, sprawl is a management problem. In a multi-brand portfolio, it is a compounding risk problem: four brands, four sets of customers, four potential failure surfaces, and no shared view of where the exposure sits.

The voolama approach to sprawl prevention is outcome accountability rather than tool approval. A central approved-tools list would be obsolete within months and would create the illusion of control without the substance. Instead, each venture is required to answer three questions before deploying any AI capability that touches a customer workflow or a brand output:

• What is the intended outcome? Defined in plain language, not in model or vendor terms. For example: 'surface the three most relevant asset tags for a given file' is an outcome. 'Use a classification model' is not.
• Who reviews the output before it affects a customer or a brand asset? A named role, not a process description. If the answer is 'the system,' the deployment is not ready.
• How do we detect and correct a bad output? A specific mechanism with a named owner, not a general commitment to quality.

These questions apply whether the brand is DAVE (where AI workflow orchestration is the core product and the questions are answered at the product design stage), The DAM Republic (where AI-assisted metadata suggestions are reviewed by an advisor before being applied to a client's asset library), or Rarovera (where AI tools may support consulting deliverables and the reviewing human is the consultant accountable for the output). The questions are the same; the answers differ by product context, and that is by design.

The NIST AI RMF's Map function (section 2 of the framework, published January 2023) specifically calls for identifying and classifying AI risks in context before deployment. At the portfolio level, that means the holding company maintains a shared view of which AI capabilities are active across which brands, updated on a regular cadence, so concentration risks, such as multiple brands depending on a single vendor for a critical capability, are visible before they become a problem rather than after.

It is worth being direct about what this approach does not prevent. It does not prevent individual brand teams from making poor tool choices within the guardrails. It does not guarantee that every AI output is correct. What it does guarantee is that when a bad output occurs, there is a named human who is accountable for it and a mechanism for correcting it. That accountability structure is what makes the governance layer real rather than nominal.

What this section does not cover: the three questions above are a minimum bar, not a complete AI risk assessment. Ventures with higher-risk AI deployments require a more structured risk assessment aligned to the NIST AI RMF Measure function or equivalent.

Human oversight is not a compliance checkbox. It is the mechanism that keeps AI-generated outputs aligned with brand trust and customer expectations over time, especially as the underlying models and tools change. The EU AI Act, Regulation 2024/1689, Article 14(4), requires that human oversight measures be proportionate to the risk level of the AI system and that humans be able to understand, monitor, and intervene in AI outputs. That proportionality principle is useful even for companies not yet in scope: it frames oversight as a workflow design decision, not an afterthought added at audit time.

In a multi-brand operating model, human oversight operates at two distinct levels. The first is operational: every consequential AI output has a named human accountable for reviewing it before it affects a customer. The specific form of that review differs by brand and by the nature of the AI output. At DAVE, workflow outputs are reviewed before they trigger downstream actions in a client's process. At The DAM Republic, AI-assisted metadata suggestions are reviewed before they are applied to an asset library. At Rarovera, the consultant who delivers the work is accountable for any AI-assisted content within it. At Airport Online, where AI exposure is lowest, oversight is lighter but the accountability structure is the same: a named role, not a process.

The second level is strategic: the holding company reviews AI adoption decisions across the portfolio on a regular cadence, not to approve every tool, but to identify patterns that are only visible at the portfolio level. Are multiple brands converging on the same vendor in ways that create concentration risk? Is a capability that works well in one brand's context being adopted uncritically in another where the risk profile is different? Is the gap between DAVE's AI exposure and Airport Online's widening in ways that require the governance layer to be updated? These questions require a human with portfolio visibility to ask them consistently.

The NIST AI RMF Govern function (section 1.1, published January 2023) identifies organisational accountability structures as a prerequisite for effective AI risk management. At the holding-company level, that means the person asking the strategic oversight questions has a defined role and a defined cadence, not just a general mandate to 'keep an eye on AI.'

It is also worth being direct about the limits of this model. Human oversight at the portfolio level does not mean that every AI output is reviewed by a human before it reaches a customer. At scale, that is neither practical nor the right design. What it means is that the accountability for AI outputs is always human, that the mechanism for detecting and correcting bad outputs is always defined, and that the decision about how much automation is appropriate for a given workflow is made deliberately by a human with the right context, not by default.

What this does not cover: human oversight as described here applies to AI outputs in deployed products and workflows. It does not substitute for legal compliance review, data protection impact assessments under GDPR Article 35, or sector-specific regulatory requirements that may apply to individual ventures in their respective markets.

Disclosure: voolama has a direct commercial interest in AI workflow orchestration through its DAVE venture. This article describes voolama's internal governance approach and the external frameworks that inform it. It is not a product pitch, a compliance guarantee, or legal advice.