EXPLAINER

AI Governance

conceptfreshness: volatilesources not yet verified

AI governance is the set of policies, roles, processes and legal controls an organisation or government uses to ensure AI is developed and used responsibly, safely and lawfully.

Short answer: Governance = who decides, what is allowed, how risk is assessed, and how it is documented and audited across the AI lifecycle. In practice it maps to risk frameworks (NIST AI Risk Management Framework), management standards (ISO/IEC 42001 (AI Management System)) and regulation (EU AI Act).

What is it?

Governance is the rulebook and the people who enforce it: which AI uses are allowed, who approves them, how risks are checked, what records are kept, and who is accountable when something goes wrong.

Also known as: responsible AI, AI policy, AI risk management, AI compliance, AI ethics board, AI accountability, AI audit, trustworthy AI.

Technical definition

Typical components: an AI inventory, risk classification by use case, impact assessments, roles and accountability (owners, review boards), data and vendor governance, testing and monitoring requirements, incident response, transparency documentation (Model Cards and Datasheets (AI Documentation)) and audit trails. Reference points: NIST AI RMF (Govern, Map, Measure, Manage), ISO/IEC 42001 (management-system standard), the EU AI Act (risk-based regulation), and sector rules. Regulatory scope and dates vary by jurisdiction and change; this entry gives orientation, not legal advice.

Entity type: concept · Freshness class: volatile.

When should I use it?

Needed once AI affects customers, employees or regulated decisions.

Implementation patterns

  • Inventory all AI systems and vendors.
  • Risk-tier use cases and require controls per tier.
  • Pre-deployment review and post-deployment monitoring.
  • Incident reporting and rollback plans.
  • Training for staff on acceptable use.

Technologies and frameworks

Commonly associated: NIST AI RMF, ISO/IEC 42001, model cards, AI inventories, GRC tooling. Names are examples of what exists, not recommendations, and projects change quickly.

Practical guide

  1. Create an AI inventory.
  2. Define risk tiers.
  3. Assign owners.
  4. Adopt a framework (e.g. NIST AI RMF).
  5. Review regularly and track regulation.

Common failure modes

  • Policy documents with no enforcement.
  • Shadow AI use outside governance.
  • Vendor risk ignored.
  • No ownership for monitoring.
  • Treating compliance as one-off.

Troubleshooting

Contrasted with

  • AI Alignment — Alignment is a technical property of models; governance is organisational and legal control of AI use.

Questions this page answers

  • What is AI governance?
  • How do I create an AI policy for my company?
  • What is responsible AI?
  • What is an AI impact assessment?
  • Which AI regulations apply to me?

Typical goals: set up AI governance in an organisation; map frameworks and regulations.

Sources and verification

Status: not independently verified. This entry was authored on 2026-10-06 from general technical knowledge, without live checking of the sources below. Treat every source as a lead to confirm (identifier, title, authorship, current version) before publication or citation.

Freshness class: volatile — Products, versions, protocols, benchmarks, leaderboards, regulations and dates. Verify against the primary source before relying on specifics; re-review every 3 months.

Time-sensitive claims to verify before relying on them:

  • Regulatory scope, applicability dates and standards status.
  • Any jurisdiction-specific legal conclusions.

Canonical sources (unverified leads):

  • NIST, AI Risk Management Framework 1.0 (NIST AI 100-1) (2023) — nist.gov/itl/ai-risk-management-framework
  • ISO/IEC 42001:2023, Artificial intelligence — Management system — iso.org
  • Regulation (EU) 2024/1689 (AI Act) — eur-lex.europa.eu
Learning path: Governing AI (step 1 of 7)
NIST AI Risk Management Framework →