AI governance

What it is

AI governance covers decision rights, risk management and accountability for AI systems across their life cycle. It sits alongside data governance, which covers the data those systems use.

How it works

1. Name an owner and list approved tools and use cases.
2. Set data rules: what may and may not go into which tools.
3. Define review and approval steps, keep a simple register of AI uses, and revisit it on a schedule.

Two public references help with structure:

• The NIST AI Risk Management Framework (released January 2023) is for voluntary use. NIST publishes a companion Playbook.
• The EU AI Act sorts AI systems into four risk levels: unacceptable (banned), high, transparency and minimal. Most AI systems in use in the EU fall into minimal or no risk, which the Act doesn’t regulate. Transparency rules include telling people when they’re talking to a chatbot.

The European Commission says the Act entered into force on 1 August 2024 and became applicable on 2 August 2026. Bans on prohibited practices and the AI-literacy duties have applied since 2 February 2025. After the 2026 “AI Omnibus” amendment, most high-risk rules apply from 2 December 2027, and rules for AI embedded in regulated products from 2 August 2028.

Benefits

• Faster, safer adoption, because people know the rules.
• Clear answers for clients who ask how you use AI.
• A head start where regulation such as the EU AI Act applies.

Limits and risks

• Heavy process can stall useful experiments.
• Policies go stale as tools change, so schedule reviews.
• Whether and how the AI Act applies depends on your role and use case. This page explains concepts. It isn’t legal advice. Check obligations with a qualified advisor in each country where you operate.