AI Governance
Also called: artificial intelligence governance, AI risk governance, responsible AI
AI governance is the set of policies, processes, roles, and controls an organization uses to develop, deploy, and operate AI systems responsibly and in compliance with applicable laws, standards, and stakeholder expectations.
Effective AI governance is multi-layered. At the strategic layer, it sets the organization's risk appetite and ethics commitments. At the operational layer, it provides the policies, review boards, and tooling that let teams ship AI without inventing controls each time. At the tactical layer, it produces the artifacts (model cards, system inventories, impact assessments) that survive audit.
Common AI governance components:
- Acceptable use policy for AI tools (employee-facing)
- AI vendor/third-party risk program — questionnaires, contractual data-handling terms, ongoing monitoring
- AI system inventory with risk classification (an AI BOM at minimum)
- Pre-deployment review — risk assessment, fairness/bias testing, security review, privacy impact assessment
- Production monitoring — drift, performance, incident detection
- Incident response specifically for AI failures (hallucinations causing harm, prompt injection breaches, model degradation)
- Regulatory compliance program — EU AI Act, NIST AI RMF, ISO 42001, sectoral regs
- Governance body — a cross-functional committee with decision authority (typically including security, legal, privacy, engineering, business owners)
Smaller organizations often start with just an acceptable use policy and an inventory. That's fine — what matters is that the program scales as AI usage scales.
Why it matters
Without governance, every AI deployment becomes a one-off improvisation. Each team invents its own review process, each audit becomes a fire drill, and each new regulation triggers a panic. With governance, the program absorbs new requirements without rebuilding from scratch. It's the difference between operating AI as engineering practice and operating it as compliance theater.
Related terms
NIST AI RMF
The NIST AI Risk Management Framework (AI RMF 1.
ISO/IEC 42001
ISO/IEC 42001:2023 is the first international certifiable management-system standard for artificial intelligence.
EU AI Act
The EU AI Act (Regulation 2024/1689) is the European Union's binding legal framework for artificial intelligence systems.
AI Bill of Materials (AI BOM)
An AI Bill of Materials (AI BOM or AIBOM) is a structured inventory of every component used to build, train, and deploy an AI system: training data sources, foundation models, fine-tuning datasets, prompts, libraries, dependencies, and downstream integrations.
Model Risk
Model risk is the potential for adverse outcomes — financial loss, regulatory action, reputational damage, customer harm — arising from errors in the development, implementation, or use of an AI/ML model.