AI Governance Framework

AI governance is the system of policies, processes, roles, and controls that an organisation establishes to ensure that its development and use of artificial intelligence is responsible, ethical, lawful, and aligned with its strategic objectives. Before the EU AI Act, AI governance was largely voluntary — a matter of corporate responsibility statements and industry best practices. The entry into force of Regulation 2024/1689 has transformed AI governance from a discretionary programme into a regulatory obligation for any organisation placing AI systems on the EU market or deploying them within the EU.

The EU AI Act does not prescribe a specific governance model, but its requirements — risk management, data governance, technical documentation, human oversight, transparency, post-market monitoring — collectively assume that the organisation has a functioning governance apparatus capable of managing AI systems across their entire lifecycle. Without governance, there is no mechanism to ensure that risk classifications are accurate, that prohibited practices are detected and prevented, that high-risk system obligations are met, or that incidents are reported. Governance is the connective tissue that makes compliance operationally viable.

Beyond legal compliance, effective AI governance serves business objectives. It reduces the risk of reputational damage from biased or harmful AI outputs, it builds trust with customers and regulators, it improves the quality and reliability of AI systems through structured oversight, and it creates a defensible record of due diligence if an AI system causes harm. Organisations that treat AI governance as a pure compliance cost are missing the strategic opportunity — the organisations that build governance into their AI development and deployment processes from the outset will move faster and with greater confidence than those that retrofit governance after problems emerge.

An AI inventory — sometimes called an AI register or model registry — is the operational prerequisite for effective AI governance. You cannot govern what you cannot see. The inventory must capture every AI system that the organisation develops, deploys, or procures, along with sufficient metadata to support risk classification, compliance monitoring, and lifecycle management.

The minimum data fields for the AI inventory should include: system name and unique identifier, description of the system and its intended purpose, provider (internal team or third-party vendor), deployment status (development, testing, production, retired), risk classification under the AI Act, date of classification and reviewer, data inputs and outputs, the model type and architecture, training and evaluation data sources, identified risks and mitigation measures, human oversight mechanisms, responsible owner within the organisation, and the date of last review.

For high-risk AI systems, Article 26(5) of the AI Act requires deployers to register in the EU database before putting the system into use. The EU database (established under Article 71) is a publicly accessible register of high-risk AI systems and their providers. The registration obligation means that the organisation's internal AI inventory must contain sufficient information to complete the EU database registration — and the two must be kept consistent.

Building the AI inventory is a discovery exercise as much as a documentation exercise. AI systems are not always visible to central governance functions. They may be embedded in third-party SaaS tools, built by individual business units, integrated through APIs, or operating as components within larger systems. The inventory process should include surveys of all business units, reviews of procurement records for AI-related services, code repository analysis for ML model deployments, and interviews with technology teams. Shadow AI — systems adopted without central IT or governance approval — is a significant and growing risk that the inventory process must actively hunt for.

AI governance should not exist as an isolated programme. Organisations with mature GRC (Governance, Risk, and Compliance) capabilities should integrate AI governance into their existing frameworks rather than building a parallel structure. This integration reduces duplication, leverages established processes and tooling, and ensures that AI risks are assessed alongside other enterprise risks rather than in a silo.

The most natural integration points are with information security management (ISO 27001/27002), data protection (GDPR), and enterprise risk management. ISO 27001 already provides a management system framework for information security that covers many of the same organisational controls needed for AI governance — risk assessment, asset management, access control, incident management, audit, and continuous improvement. AI-specific controls can be layered onto the existing ISMS rather than duplicated in a separate management system.

For organisations subject to DORA or NIS2, the AI governance framework should align with the ICT risk management and third-party risk management requirements of those regulations. AI systems are ICT systems, and AI providers are ICT third-party providers. The risk assessments, contractual arrangements, incident reporting, and business continuity planning required by DORA and NIS2 apply equally to AI systems and providers. A unified approach avoids the fragmentation that arises when each regulation is managed by a separate team with separate processes.

Practically, integration means: using a single risk register that includes AI risks alongside other operational, ICT, and compliance risks; applying the same vendor due diligence and contractual standards to AI providers as to other critical ICT providers; routing AI incident reports through the same incident management workflow as other cybersecurity and operational incidents; including AI systems in the scope of internal audit and assurance programmes; and reporting AI governance metrics alongside other GRC metrics to the management body. The governance framework document should explicitly map its components to existing policies and processes to demonstrate integration and avoid gaps.

Implementing an AI governance framework is a multi-quarter programme that should be approached in phases. Phase one — discovery and baseline — focuses on understanding the current state: conducting the AI inventory, identifying existing policies and processes that touch AI, assessing the maturity of current risk management and oversight practices, and mapping the regulatory requirements that apply to the organisation's AI activities. This phase typically takes 6-8 weeks and should involve stakeholders from legal, compliance, IT, data science, business units, and executive leadership.

Phase two — framework design — produces the governance architecture: the AI governance policy, the risk classification methodology, the roles and responsibilities framework (including an AI governance committee or board), the integration plan with existing GRC processes, and the control catalogue. The design should be informed by ISO 42001 structure where the organisation intends to pursue certification, and should be explicitly mapped to EU AI Act requirements. This phase typically takes 8-12 weeks and should produce a set of documented policies and procedures ready for management body approval.

Phase three — implementation — activates the framework: deploying the AI inventory tool, conducting risk classifications for all inventoried systems, implementing required controls for high-risk systems, establishing human oversight mechanisms, developing training programmes for AI overseers and general AI literacy, and operationalising monitoring and reporting. This is the longest phase and runs in parallel with the organisation's AI Act compliance timeline. Priority should be given to systems classified as high-risk, as these carry the heaviest compliance burden and the greatest exposure.

Phase four — assurance and improvement — establishes the ongoing governance cycle: internal audits of AI governance controls, management review of framework effectiveness, performance metrics tracking, incident review and lessons learned integration, and periodic framework updates in response to regulatory developments, organisational changes, and technology evolution. This phase never ends — it is the steady-state operating mode of the AI governance programme. Organisations pursuing ISO 42001 certification should align their internal audit and management review cycles with the certification timeline.