AI governance: what it is, which frameworks apply and how to build a programme

AI governance is the combination of policies, accountability, processes and technical controls that direct how an organisation designs, procures, deploys and monitors AI systems. Its aim is to keep AI use lawful, safe, fair and aligned with the organisation's objectives and risk appetite.

It differs from related terms. Data governance manages data quality, access and lifecycle. Model risk management, common in financial services, validates statistical models. AI compliance is the narrower task of meeting specific legal and standards requirements. AI governance is the wider system that decides who may build or buy what, under which conditions, and who answers for the outcome. See our note on AI governance versus compliance for the distinction in more detail.

AI governance matters because AI use is spreading faster than oversight, and regulators, customers and boards now expect evidence of control. Three pressures drive it.

• Law: the EU AI Act already prohibits certain practices (since 2 February 2025), regulates general-purpose AI models (since 2 August 2025) and sets transparency duties (from 2 August 2026), with high-risk system obligations to follow.
• Customers and procurement: buyers increasingly ask suppliers for AI policies, risk assessments and, sometimes, ISO/IEC 42001 certification.
• Operational risk: unmanaged AI creates data leaks, unreliable outputs, discrimination claims and unplanned vendor dependencies. Staff adopting AI tools without approval (shadow AI) makes these risks harder to see.

An AI governance framework has seven working components: an inventory of AI systems, a risk classification method, defined roles and accountability, controls, evidence, approval gates and ongoing monitoring. Policy sits on top of these; without them it stays aspirational.

Build an AI governance programme in seven steps: inventory every AI system, classify risk, assign owners, set proportionate controls, collect evidence, gate changes with approvals, and monitor continuously. Start with your highest-risk systems and expand, rather than trying to cover everything at once.

1. Inventory. List every AI system you build, buy or embed, plus unsanctioned tools staff use. Record purpose, owner, vendor, data used and where it runs. Include AI features inside existing SaaS products.
2. Classify. Assign a risk tier using a consistent method. Include legal categories (for example, whether a system is prohibited, high-risk or subject to transparency duties under the EU AI Act) and your own impact criteria, such as effect on individuals' rights, safety and money.
3. Assign ownership. Name one accountable owner per system and an executive sponsor for the programme. Define who can approve, who reviews and who is consulted (legal, privacy, security).
4. Set controls. Choose controls proportionate to the tier: data quality checks, testing for accuracy and bias, human oversight, logging, security, transparency notices, and vendor due diligence.
5. Collect evidence. For each control, record what was done, by whom and when. Evidence should be retrievable per system, not scattered across inboxes.
6. Approve and manage change. Require a documented approval before launch and before material changes such as a new model, new data source or new use case. Record exceptions with an expiry date.
7. Monitor and review. Track performance, incidents and complaints, reassess on a schedule and on triggers (model update, regulatory change, incident), and report to leadership.

Aim for a working version in weeks, not a perfect one in months. A single page policy, a spreadsheet inventory and named owners beat a long framework nobody applies.

AI governance is a shared responsibility with clear single-point accountability: the board sets direction and risk appetite, an AI governance lead runs the programme, and each system has a named owner. Legal, data protection and security provide specialist input.

The main references are the EU AI Act, ISO/IEC 42001, the NIST AI RMF, the OECD AI Principles, the GDPR for personal data, and a growing patchwork of US state laws. Binding law and voluntary frameworks do different jobs, and most programmes use both. Status below was checked on 3 October 2026; confirm dates with the official sources before you rely on them.

Not legal advice. Laws and effective dates change, particularly in the EU and the United States. Confirm current status on the European Commission and relevant state legislature sites.

The GDPR applies whenever an AI system processes personal data, regardless of the AI Act. Governance programmes should link AI system records to existing data protection processes: lawful basis, data protection impact assessments for high-risk processing, transparency to individuals, and rights relating to automated decision-making.

In practice, give your DPO a seat in the approval workflow and reuse DPIA findings as evidence in the AI risk assessment, so the same facts are not recorded twice.

Good AI governance is proportionate, owned, evidenced and repeated. The following practices separate working programmes from policy documents.

• Scale controls to risk: light-touch for low-risk tools, rigorous for systems that affect people's rights, safety or finances.
• Make the inventory the single source of truth, and refresh it on a schedule, including vendor AI and shadow AI.
• Tie every control to evidence you can produce on request.
• Put approvals at defined gates, with reassessment triggered by material change rather than the calendar alone.
• Train staff on acceptable use. The EU AI Act's AI literacy provision, as amended by the Digital Omnibus, requires providers and deployers to take measures to support it.
• Map once, report many times: align controls to ISO/IEC 42001, the NIST AI RMF and legal requirements instead of running separate programmes.
• Report to the board on a fixed rhythm: inventory size, high-risk systems, open findings, incidents and exceptions.

AIGovernr is a workspace for running this programme: an AI system register, classification, governance plans, controls, evidence records, approvals and a shadow AI registry. It carries versioned releases of frameworks such as the EU AI Act, NIST AI RMF, ISO/IEC 42001 reference metadata and the GDPR, mapped to your controls. It supports your governance work; it does not make an organisation compliant or certified.