Bans don't work. Training falls short. Here's what actually controls AI risk inside your organization.