AI governance
What it means
What is AI governance?
AI governance means deciding who may build or buy an AI system, and who answers, by name, when it fails. Policies, roles and controls set what data a system may touch and who signs off before it reaches customers.
AI governance sits above the technology itself. It covers who owns each AI system, what data it may touch, which use cases are off limits, and who signs off before a system reaches customers. That shows up as a register of the systems in use, a policy engineers actually follow, and a review step before anything new goes live.
A customer's procurement team asks for it during a security review. A board asks after a pilot nears production, once someone raises who is liable for a bad call. Regulators ask for pieces of it too, through frameworks like the NIST AI RMF and standards like ISO/IEC 42001.
In practice, it changes three things. Someone specific owns each AI system, instead of it belonging to whichever team built it. A new system needs sign-off before it touches customer data. A written answer exists the day a customer or auditor asks for one.
Published · Updated
In practice
Why it comes up
An insurer asks who owns AI risk before writing a policy. A board member reads about an AI failure elsewhere and asks what would happen here. An investor’s due-diligence checklist now has a line for it too. Write down who is responsible for each system, and who would notice if it started producing worse answers.
What to do about it
Start with a one-page register: every AI system in use, who owns it, what data it touches, and whether customer data leaves the building. Assign one named owner per system, not a team. Add a single sign-off step before a new system reaches production. Map what you already do against the NIST AI RMF or ISO/IEC 42001. Do this so you have a recognised structure to point at, not to get certified immediately.
Sources and neighbours
Sources
- NIST AI Risk Management Framework
nist.gov
- Regulation (EU) 2024/1689 (EU AI Act)
eur-lex.europa.eu
- ISO/IEC 42001:2023 - AI management systems
iso.org
Related terms