AI governance explained: what it is and how to start

01What does AI governance mean in plain English?

AI governance is how an organisation decides which AI systems it may build, buy or use, who may approve them, and how it checks that they keep working as intended. Think of it as the rulebook, the named owners and the paper trail around AI, not the AI itself.

The IAPP, a professional body for privacy and AI governance, describes it as a mix of principles, laws, policies, processes, standards and frameworks that applies from design through everyday use (IAPP, AI Governance in Practice Report 2024). That is why the work is spread across legal, privacy, security, product and management teams instead of sitting in one place.

It overlaps with AI safety (making systems behave well), AI ethics (deciding what is right) and compliance (meeting legal duties). Governance is the part that assigns responsibility and keeps records, so the other three actually happen.

02Where in an AI system's life does governance apply?

Governance is not a single sign-off at launch. The IAPP report sketches a simple life cycle and shows a governance question at every stage (IAPP). The NIST framework sets out a fuller version, with testing, evaluation and verification points for each phase.

• Planning: write down what the system is for, and plan for the legal rules that apply.
• Design: gather data, check its quality, and document what the dataset contains.
• Development: choose the method, train, test and verify.
• Deployment and use: pilot first, verify legal compliance, then monitor performance and reduce risks after launch.

03Why are more organisations doing it now?

Laws set duties, customers ask for proof of control, and public incidents show what having no control can cost. Survey data shows the shift. Stanford's 2026 AI Index reports that the share of businesses with no responsible AI policy fell from 24% to 11%, and that AI-specific governance roles grew 17% in 2025 (Stanford HAI, 2026 AI Index, Responsible AI).

The same chapter lists what still slows organisations down: gaps in knowledge (59%), budget limits (48%) and uncertainty about regulation (41%). ISO/IEC 42001 and the NIST framework are newly named there among the influences on practice.

04Which three frameworks do people name most?

All three below are voluntary. None is a licence, and following one does not make an organisation legally compliant. We explain them and link the publisher; we do not certify anyone against any of them.

• NIST AI Risk Management Framework 1.0 (NIST AI 100-1), released 26 January 2023 by the US National Institute of Standards and Technology. It is free and organised around four functions: Govern, Map, Measure and Manage. NIST also publishes a Playbook and a Generative AI Profile (NIST AI 600-1, 26 July 2024). Its framework page says a revision is under way as part of the White House AI Action Plan, with no date given.
• ISO/IEC 42001:2023, an international standard published on 18 December 2023. It sets requirements for an AI management system, meaning the policies, roles and routines an organisation keeps running over time. It is a paid publication (IEC store listing).
• OECD AI Principles, adopted in May 2019 and updated in May 2024. They set five values (inclusive growth and well-being; human rights and democratic values; transparency and explainability; robustness, security and safety; accountability) and five recommendations for governments. They are guidance for countries, not a company checklist. OECD's page listed 47 adherents when we read it.

05What does the law add?

Frameworks are optional. Laws are not. In the EU, the AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. Its bans and its AI literacy duty have applied since 2 February 2025, and its rules for general-purpose AI models since 2 August 2025 (AI Act Explorer timeline).

An amending regulation, (EU) 2026/1744, is recorded as in force from 27 July 2026. It moved the main high-risk duties to 2 December 2027 for listed uses such as hiring and education, and to 2 August 2028 for AI built into regulated products (AI Act Explorer, Digital Omnibus). That is the position as of 24 October 2026, and these dates have already moved once.

Outside the EU, existing privacy, consumer and anti-discrimination law already covers AI use. This page is general information, not legal advice. For a real decision, ask a lawyer or the regulator for your sector.

06What are seven first steps for a small team?

You do not need a committee to begin. These steps follow the ideas in the NIST framework, scaled down. They are a starting point, not a compliance programme.

1. List every AI tool and AI feature people use, including chatbots in browsers and features inside software you already pay for. You cannot govern what you have not found.
2. Name one owner for AI decisions and one backup. Write the names down.
3. Write a one-page rule: what the tools may be used for, what data must never be pasted in, and what always needs a human check.
4. Sort each use by what happens if it is wrong. NIST says the highest-risk uses, especially those that affect people directly, deserve the most effort.
5. For any use that affects a person, keep a human able to review and reverse the result.
6. Ask each vendor what data they keep, whether they train on your data, and how they test the system. Keep the answers.
7. Keep a simple log of problems and near misses, and review the list and the rules every quarter or whenever a tool changes.

07What can governance not do?

Governance does not prove an AI system is safe. NIST notes that being unable to measure a risk does not mean the risk is low or high, and that organisations must set their own risk tolerance where no rule exists. Stanford's index adds that reporting on responsible AI benchmarks is still sparse, so evidence for many claims is thin. Good governance makes problems easier to see and own. It does not remove them.