AI Governance & Strategy
Sherpa's Stories
Digital Tourism Think Tank
Governance is the thing that lets you move faster.
79% expect AI to significantly contribute to revenue by 2030.
Only 24% have a clear view of where that value will come from. For DMOs the same gap exists, and governance is one of the strongest tools for closing it. It forces an organisation to decide what AI is actually for.
The EU AI Act comes into full effect in August 2026.
High-risk system provisions take force. Waiting for full enforcement to take governance seriously is the wrong strategy. The organisations building frameworks now will be better placed, not just more compliant.
The four DTTT AI Transparency Framework models.
You'll audit your own policy fragment against each model, find the gaps, and write the rules that close them. The session uses the framework as the diagnostic tool, not as background reading.
The AI Transparency Framework
Each approach focuses on a specific type of operational failure. The mapping exercise you are about to do will reveal which risks your current guidelines already manage, which are only partially addressed and where the gaps lie.
What does your team have today?
The activity audits a real piece of governance text. Paste an excerpt from your AI policy, brand guidelines or content rules. If you have nothing written, describe what your team currently does. The audit on the next slide reads against whichever you provide.
Any length works. Even one paragraph is enough for the audit on the next slide.
The more honest the description, the more useful the audit will be.
The classify step on the next slide reads your text against the four framework models. Specific text produces a specific audit. Vague text produces a vague audit, which is itself a useful finding.
Run your fragment against the four models.
For each of the four DTTT AI Transparency Framework models, look at the specific operational questions that model asks. Then classify whether your fragment covers it, touches it partially, or does not address it at all. This is the read your next four slides are built on.
- Approval path for AI-generated visual content before it goes public
- Disclosure of AI involvement to visitors and audiences
- A position on photorealistic AI imagery depicting the destination
- Verification that AI-generated facts are correct before publication
- What AI tools your visitor-facing systems are allowed to confirm
- How AI tools handle uncertain or unverified information
- Internal disclosure of AI use across team outputs
- A verification cadence for any data the AI uses to answer visitors
- Whether partner-submitted AI content must declare AI use
- A register of approved and prohibited AI tools for team use
- Accountability for outputs across AI-assisted and human work
- How AI productivity gains are measured and reported
- Which AI vendors process visitor data and on what legal basis
- Consent posture for visitors whose data is AI-processed
- Data retention and training-data exclusion in AI vendor contracts
- Annual reporting on the scale of AI use across the organisation
A visitor accuses your DMO of misleading them with an AI image.
Your team used an AI image generator to produce a hero shot for the spring campaign. The image shows your region's coastline with visitors enjoying a sunlit beach. It was visually compelling and on-brand, so it went live across social and the website without disclosure. A visitor who travelled because of the campaign posts publicly that the beach in the image does not exist and the photo "lied to them about what your destination actually looks like." Local press picks it up the next morning.
Your chatbot tells a wheelchair user a venue is accessible. It isn't.
A visitor using a wheelchair asks your website's AI chatbot which beaches and coastal paths are accessible. The chatbot confidently lists three locations and confirms step-free access for each. The visitor travels and discovers the second location has no accessible path to the beach itself, the path stops 200 metres short. They contact your office angry and exhausted. The chatbot has no record of what it said, no source for its claims and your team has never validated its accessibility information.
A partner submits AI-generated content for your channels. It contradicts your facts.
An operator partner submits a guest blog post for your destination website. The post is well written, on-brand and arrives on deadline. Two weeks after publication a local resident emails to say one of the venue descriptions is factually wrong, the opening hours and one of the listed amenities do not match reality. The partner confirms they used ChatGPT to draft the article and did not check the venue details before submitting. Three other partners are now in the queue with similar content.
Visitor data flows through three AI tools before anyone has named where it sits.
Your insights team runs visitor feedback through an AI sentiment tool to produce monthly reports. The chatbot on your website processes thousands of queries a month, all stored on the vendor's servers. A campaign agency uses a third AI service to segment audiences for a paid campaign. A GDPR audit asks where personal data is being processed, by which AI vendors, under which legal basis, and whether visitors have consented to AI processing of their data. Your team cannot produce a clear answer to any of these questions.
Your one-page policy, drawn from your own answers.
Eight rule slots populated from what you typed. A reading of how your governance sits across the four models. And three private prompts to help you take this back to your leadership team next week.
Your readiness score, model by model.
Each model is scored on three signals from your scenario answers: a position (you wrote something), specificity (named roles, time periods, concrete thresholds) and accountability or disclosure language. Higher means a stronger starting position. Lower means a genuine gap, not a failure.
- Complete the scenario to surface strengths.
- Complete the scenario to surface gaps.
- Complete the scenario to surface strengths.
- Complete the scenario to surface gaps.
- Complete the scenario to surface strengths.
- Complete the scenario to surface gaps.
- Complete the scenario to surface strengths.
- Complete the scenario to surface gaps.
No data yet
Complete the four scenarios and your weakest model will be named here, with the specific gap pattern your answers revealed and a link to that model on the framework site.
open_in_newRead this model on the framework siteNo data yet
Complete the four scenarios and your strongest model will be named here, so your table can see what you're already doing well and build the rest of the framework from that foundation.
You haven't written a rule for this model yet. Go back to slide 4 and complete the scenario to populate this rule slot.
A rule slot for Content Integrity.A second slot, surfaced from your "what would actually happen today" answer.
A rule slot built from your honest description of current practice.You haven't written a rule for this model yet. Go back to slide 5 and complete the scenario to populate this rule slot.
A rule slot for Transparency.A second slot, surfaced from your "what would actually happen today" answer.
A rule slot built from your honest description of current practice.You haven't written a rule for this model yet. Go back to slide 6 and complete the scenario to populate this rule slot.
A rule slot for Productivity.A second slot, surfaced from your "what would actually happen today" answer.
A rule slot built from your honest description of current practice.You haven't written a rule for this model yet. Go back to slide 7 and complete the scenario to populate this rule slot.
A rule slot for Environmental.A second slot, surfaced from your "what would actually happen today" answer.
A rule slot built from your honest description of current practice.For you alone, to translate the group output into something you can take to your own leadership.
Take the framework with you.
Each model on the DTTT AI Transparency Framework site goes deeper than today's session could. Start with the model where you found the most pressure, then work outward. The framework is open and free to use as the basis of your own governance.