What Is AI Governance? A Practical Framework for Companies Using AI

AI governance is the set of roles, rules and checks a company uses to control which AI it builds or buys, what each tool is used for, and which safeguards apply. In practice, it covers who approves AI use, a list of the systems in use, risk assessment, staff policies and ongoing monitoring.

Key Takeaways

• Two EU AI Act duties already apply to most companies that use AI at work: the ban on prohibited practices and the AI literacy duty, both since 2 February 2025.

• An AI governance framework has five working parts: named owners, an AI inventory, risk assessment, policies and training, and monitoring.

• The EU AI Act, ISO/IEC 42001, the NIST AI RMF and the OECD AI Principles can be used together. A growing company does not need to adopt all four to start.

What Is AI Governance?

AI governance answers a short list of questions for every AI system in the business. Who decided to use it? What data goes into it? What could go wrong, and for whom? Who checks that it is still working as intended?

It applies to AI you build and to AI you buy. For most companies, the second group is larger: chat assistants, AI features inside CRM or HR software, transcription tools and code assistants that staff signed up for themselves.

AI governance sits next to data protection and information security, and it reuses parts of both. A company that already keeps a GDPR record of processing activities and runs data protection impact assessments has a head start, because many AI systems process personal data.

The output is documentation that shows decisions were made intentionally: an inventory, risk assessments, approvals, policies, training records, and review notes.

Why Does AI Governance Matter Now?

The EU AI Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024 and applies in stages. Several of those stages have already passed, according to the implementation timeline published alongside the official text.

• 2 February 2025: the prohibited practices in Article 5 and the AI literacy duty in Article 4 started to apply.

• 2 August 2025: the rules for providers of general-purpose AI models in Chapter V started to apply, together with the governance chapter and certain penalty provisions.

• 2 August 2026: most of the remaining provisions started to apply, including the transparency duties in Article 50, unless the Act sets a different date.

Article 5 bans a short list of practices outright. They include social scoring, untargeted scraping of facial images from the internet or CCTV to build facial recognition databases, and emotion recognition in the workplace or in education, except for medical or safety reasons. A company should know that none of its tools does any of these.

Article 4 requires providers and deployers to take measures to support the AI literacy of staff and others who operate or use AI systems on their behalf. The Digital Omnibus amended this wording. The current text says the duty does not require a company to guarantee any specific level of AI literacy for each person. Our guide to AI literacy for businesses covers how to plan training.

What the Digital Omnibus Changed

The Digital Omnibus on AI, Regulation (EU) 2026/1744 of 8 July 2026, entered into force on 27 July 2026 and moved the high-risk dates:

• high-risk systems listed in Annex III (for example, AI used in recruitment, credit decisions or education) now follow the high-risk rules from 2 December 2027;

• high-risk systems covered by the product laws in Annex I now follow them from 2 August 2028.

The same regulation added prohibitions on AI systems that generate non-consensual intimate imagery and child sexual abuse material, which apply from 2 December 2026. Providers of generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking duty in Article 50(2).

The delay gives companies more time for high-risk work. It does not touch the duties that already apply. For a summary of the Act as a whole, see our EU AI Act summary.

What Goes Into an AI Governance Framework?

An AI governance framework is the written and working version of the questions above. Most frameworks, whatever they are called, contain five parts.

Roles and Accountability

Someone senior owns AI governance and can say no. Below that owner, each AI system has a named business owner who answers for how it is used. Larger companies often add a small review group drawn from legal, security, data protection, IT and the business.

AI Inventory

The inventory registers every AI system in use or in development. For each one, it records the purpose, the business owner, the vendor, the data it uses, who it affects, and whether the company is the provider or the deployer under the AI Act. The AI Act defines a deployer as a person or organisation that uses an AI system under its own authority, which covers most companies buying AI tools.

Risk Assessment

Each inventory entry gets a risk view. Under the AI Act, classification starts with: prohibited, high-risk, subject to transparency duties, or none of these. Our guide to AI risk classification explains the categories.

When personal data is involved, the GDPR also applies. A data protection impact assessment is required where processing is likely to result in a high risk to people’s rights and freedoms (Article 35 GDPR).

Policies and Training

An AI use policy tells staff which tools are approved, what data may go into them, when a human must check the output, and how to request a new tool. Training aligns the policy with each role, which also shows how a company took measures under Article 4.

Monitoring and Review

AI systems and vendors change. Monitoring covers incidents and complaints, changes to a vendor’s model or terms, new uses of an existing tool, and new legal dates. Reviews happen on a schedule and when something changes.

Which Frameworks Can You Build On?

Four frameworks come up most often. They have different purposes and can be combined.

EU AI Act

The EU AI Act is law. It sets duties based on a company’s role (provider or deployer) and the AI system’s risk category. For a company in or selling into the EU, it sets the minimum any governance framework must cover.

ISO/IEC 42001

ISO/IEC 42001:2023, published in December 2023, specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within an organisation. ISO describes it as the world’s first AI management system standard and says it applies to organisations of any size that develop, provide or use AI. It is a voluntary standard. See our guide to ISO/IEC 42001 implementation.

NIST AI Risk Management Framework

The NIST AI RMF is a voluntary framework from the US National Institute of Standards and Technology. Version 1.0 was published in January 2023 and is organised around four functions: Govern, Map, Measure and Manage. NIST states that a revised version is in progress.

OECD AI Principles

The OECD AI Principles were adopted in May 2019 and updated in May 2024. They set five values-based principles for trustworthy AI, covering areas such as human rights, fairness and privacy, security and safety, and accountability. According to the OECD, the EU, the United States and the United Nations use its definition of an AI system in their own frameworks and guidance.

How to Set Up AI Governance in 5 Steps

The steps below suit a company that already uses AI tools and has been asked to put governance in place.

Step 1: Name an Owner and a Small Group

Pick one accountable senior owner. Add the people who already handle data protection, security and procurement. Agree how you record decisions and who signs off on a new AI tool.

Step 2: Build the AI Inventory

Ask each team which AI tools and features they use, including free tools and features enabled within existing software. Check expense reports and software lists. Record each system with its owner, purpose, vendor, data and users.

Step 3: Classify and Assess Risk

For each system, check Article 5 first, then whether it falls into a high-risk area, then whether Article 50 transparency duties apply. Where you process personal data, decide whether you need a DPIA. Record the result and the reasoning.

Step 4: Write the Policy and Train Staff

Write a short AI use policy based on what the inventory shows. Train staff by role: everyone gets the basics, and people who choose, configure or rely on AI output get more. Keep a record of who was trained and when.

Step 5: Monitor and Review

Set a review date for each system. Add triggers that force an earlier review: a vendor changes its model or terms, a tool is used for a new purpose, an incident occurs, or a legal date approaches. Report status to the owner on a regular cycle.

AI Governance Best Practices for Growing Companies

Enterprise AI governance programmes can involve committees and dedicated tooling. A growing company can cover the same ground with a smaller set-up.

• Start with the inventory. A policy written before anyone knows which tools are in use tends to miss the tools that matter.

• Use one register. Keep AI systems in the same place as other processing records, or link the two, so that GDPR and AI Act work draw on the same facts.

• Put AI review into procurement. A new AI tool, or a new AI feature in an existing tool, goes through a short check before anyone signs.

• Record decisions as they happen. A dated note of why a tool was approved, and on what conditions, is easier to produce later than a reconstruction.

• Reuse what exists. DPIA templates, vendor questionnaires and incident processes can be extended to cover AI.

• Plan for the high-risk dates. If any system could fall under Annex III, use the time before 2 December 2027 to confirm its classification and plan the work.

Conclusion

AI governance comes down to knowing which AI the company uses, deciding on purpose how each tool may be used, and checking those decisions over time. The AI literacy duty and the prohibited practices have applied since February 2025, so a company using AI tools in the EU already has duties to meet, and the Digital Omnibus has moved only the high-risk dates.

GDPRLocal’s AI governance service, AIGo, gives high-level support and guidance across four pillars: AI governance and accountability, AI risk management, ethics and transparency, and continuous monitoring and improvement. It includes monthly coordination meetings and access to the GDPRLocal Compliance Hub, and covers building an AI management system, risk and impact assessments, and reviews of AI compliance documentation. Your team handles the technical implementation.

Frequently Asked Questions

Who Is Responsible for AI Governance in a Company?

In most companies, one senior person is accountable as the named owner. Day-to-day work sits with the business owners of each AI system, supported by legal, data protection, security, and IT. The AI Act places duties on the company as a provider or deployer.

Is ISO/IEC 42001 Mandatory?

No. ISO/IEC 42001 is voluntary. The EU AI Act sets legal duties, and some companies use ISO/IEC 42001 as a structured way to run their AI management system alongside those duties.

Does the EU AI Act Apply to Companies Outside the EU?

It can. Under Article 2, it applies to providers placing AI systems or general-purpose AI models on the EU market wherever they are established, and to providers and deployers outside the EU where the AI system’s output is used in the EU.

When Do the High-Risk Rules Apply?

After the Digital Omnibus, the high-risk rules apply from 2 December 2027 for systems listed in Annex III and from 2 August 2028 for systems covered by the product laws in Annex I.

Disclaimer: This blog post is for informational purposes only. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.