Definition
AI governance is how an organisation decides who may use AI, for what, with which data, under what checks — and who is accountable when something goes wrong. It covers the whole life of an AI use case: choosing a tool, approving a use, training staff, monitoring results and retiring systems that no longer work.
Good governance is not a document that sits in a drawer. It is a working system made of four parts: policies (the rules), people (owners and decision-makers), processes (how uses are approved, reviewed and logged) and controls (technical and human checks such as access limits and human-in-the-loop review).
Why AI governance matters now
Employees are already using AI
The 2024 Microsoft and LinkedIn Work Trend Index found that 75% of knowledge workers use generative AI at work and 78% of those users bring their own AI tools. Without governance, company data flows into tools nobody approved, and nobody knows which decisions AI influenced.
Organisations are held responsible for their AI
In Moffatt v. Air Canada (February 2024), a British Columbia tribunal rejected the airline's argument that its chatbot was responsible for its own statements and held the airline liable for incorrect refund advice. In Mata v. Avianca (June 2023), lawyers were fined $5,000 for submitting AI-invented case citations. Both cases show the same principle: the organisation using AI owns the outcome.
Regulation has arrived
The EU AI Act entered into force on 1 August 2024 and applies in stages. Bans on prohibited practices and the Article 4 AI-literacy obligation have applied since 2 February 2025. Systems listed as high-risk in Annex III — including AI used in recruitment, employment decisions, education and credit scoring — carry obligations such as human oversight under Article 14. In data protection, GDPR Article 22 restricts decisions based solely on automated processing that have legal or similarly significant effects.
Frameworks you can build on
| Framework | Publisher | What it gives you |
|---|---|---|
| AI Risk Management Framework 1.0 | US NIST, January 2023 | Four functions — Govern, Map, Measure, Manage — for managing AI risk; voluntary |
| ISO/IEC 42001 | ISO and IEC, December 2023 | A certifiable management-system standard for AI |
| EU AI Act | European Union | Binding, risk-based legal obligations for providers and deployers |
| OECD AI Principles | OECD, 2019, updated 2024 | High-level principles adopted by many governments |
Most small and mid-sized companies do not need certification on day one. A practical approach is to use the NIST functions as a structure, the EU AI Act as the legal baseline if you operate in Europe, and ISO/IEC 42001 as a target if customers start asking for formal assurance.
The core components of AI governance
- An AI policy covering approved tools, permitted data, prohibited uses, review requirements and disclosure.
- Clear ownership — an executive sponsor, a governance lead and an owner for each AI use case.
- An AI use-case register listing every significant use, its risk level, its owner and its controls.
- Risk classification — for example low (drafting internal text), medium (customer-facing content with review) and high (decisions about people, money, health or legal rights).
- Data rules — what personal, confidential and customer data may enter which tool.
- Human oversight — named reviewers and the authority to override AI.
- Training and AI literacy — role-appropriate training with records, as Article 4 requires for deployers in the EU. See AI literacy.
- Monitoring and incident handling — tracking errors, complaints and model changes, with a way to report and fix problems.
Example
A 400-person insurance broker discovers through a staff survey that more than half of employees use AI assistants, mostly personal accounts, including for drafting client emails.
The COO appoints the head of compliance as AI governance lead and forms a small working group from IT, legal, HR and two business teams. In the first month they write a two-page AI policy: one approved enterprise assistant, no client personal data in any other tool, mandatory human review of anything sent to clients, and a ban on using AI to decide claims or pricing without a documented review process.
They build a use-case register and find 14 distinct uses. Eleven are low risk (internal summaries, meeting notes, first drafts). Two are medium (client email drafts, marketing copy) and get mandatory review. One — a team experimenting with AI to pre-screen job applicants — is classed as high risk under Annex III and paused until legal review and human-oversight procedures are in place.
All staff complete AI-literacy training with a test, and records are stored. Each quarter the working group reviews the register, incidents and new tool requests. Within six months, the company can answer the questions clients and auditors ask: which AI it uses, for what, with which safeguards, and who is responsible.
How to set up AI governance: step by step
- Get an executive sponsor. Governance without authority becomes advice nobody follows.
- Find out what is already happening. Survey staff and check IT logs for AI tools in use.
- Appoint a governance lead and working group. Include legal, IT/security, HR and business users.
- Write a short AI policy. Approved tools, data rules, prohibited uses, review and disclosure. Keep it readable.
- Create a use-case register. One row per use: purpose, tool, data, owner, risk level, controls.
- Classify risk. Check each use against Annex III and GDPR Article 22 if you operate in the EU.
- Add controls proportionate to risk. Review steps, access limits, logging and human sign-off for high-risk uses.
- Train everyone. Basic AI literacy for all staff, deeper training for owners of medium and high-risk uses; keep records.
- Set up incident reporting. Make it easy to report a harmful or wrong AI output.
- Review regularly. Quarterly review of the register, policy and incidents; update as tools and law change.
Common mistakes
- Banning AI entirely, which pushes usage into unapproved personal tools.
- Writing a long policy no one reads.
- Treating governance as an IT-only project.
- Forgetting vendors: AI features inside existing software also need review.
- Skipping training records, which are needed to demonstrate AI literacy.
Key takeaways
- AI governance combines policies, people, processes and controls.
- Courts and tribunals hold organisations responsible for their AI's outputs.
- The EU AI Act, NIST AI RMF and ISO/IEC 42001 provide the legal and practical structure.
- A use-case register and risk classification are the backbone of practical governance.
- Training with records is both a control and, in the EU, a legal obligation.