Effective and scalable AI governance operates at two levels: organizational systems that provide the foundation, and use case-specific processes that handle individual AI systems. Both levels must work together to create comprehensive coverage.
AI Governance at the organizational level
An AI Management System (AIMS), as specified in ISO 42001, provides the foundation for this. Think of it as your internal operating system for managing AI responsibly: defining roles, documenting systems, handling incidents, and ensuring compliance.
Start simple. Most organizations don’t need a full AI governance bureaucracy from day one. Start with the essentials and build complexity as your AI use grows.
Step 1: Assign ownership and define responsibilities
You don’t need a new governance department from day one. Instead, assign AI governance responsibilities to existing roles. In smaller organizations, one person might take multiple roles initially.
Clear ownership ensures accountability, someone needs to be responsible for each AI system in use, its purpose, and its risk profile.
Step 2: Establish essential AI policies and templates
Start with a few focused documents and processes that bring consistency to AI use across the company. Four core policies are usually enough to begin with.
AI Use Policy
Define what AI can and cannot be used for within your organization. Include:
- Approved tools and services (e.g., “Teams Copilot is approved, ChatGPT for confidential data is not”)
- Prohibited uses (e.g., “No AI for HR decisions without human review”)
- Data handling rules (e.g., “No personal customer data in external AI services”)
- Guiding principles and ethical standards
Model & Data Documentation
Create lightweight documentation, model or data cards, to describe:
- Data used for training
- Design decisions and intended use
- Experiment tracking and testing results
- Controls for models running in production
Risk Assessment Process
Set up a simple process to evaluate new AI use cases:
- Use a short questionnaire to classify risk (high / limited / minimal)
- Include a decision tree outlining when additional approvals are required
- Keep a standard template for documenting decisions
Incident Response
When AI goes wrong, everyone should know what to do. Document:
- Who to contact if AI systems malfunction
- How to disable or override AI outputs quickly
- Minimum documentation requirements for reporting incidents
Step 3: Build basic AI infrastructure
Once policies exist, you need basic infrastructure to make them operational.
AI registry
Keep a clear overview of every AI system and model your organization uses, both internal and external. Track:
- What AI systems you’re using (internal and external)
- Who’s responsible for each one (owner)
- Risk level and compliance status
- Last review date
- Implement regular reviews & approval
Documentation templates
Create simple templates for:
- New AI use case proposals
- Risk assessments
- User instructions for AI systems
- Technical documentation
Deployment & monitoring
Deploy models on reliable infrastructure (“MLOps”) and monitor performance.
- Track outputs and set alerts for anomalies
- Log predictions and changes for auditing
- Ensure human oversight for critical decisions
AI Governance at the use case level
While your AIMS provides the organizational foundation, each individual AI system must also be assessed to ensure compliance with both regulation and internal policy.
Preliminary risk assessment
For every AI use case:
- Identify the organization’s role (developer, deployer, user)
- Determine risk classification (high, limited, minimal)
- Identify potential harms
- Decide which further assessments are required
Required assessments by risk level
Based on the risk assessment, organizations may need to conduct:
Data Protection Impact Assessment (DPIA)
For systems processing personal data, required under GDPR Article 35.
Fundamental Rights Impact Assessment (FRIA)
For high-risk systems, evaluates potential effects on fundamental rights.
AI Impact & Performance Assessment (AIPA)
Measures model performance and reliability; required for certain high- and limited-risk systems.
Third-Party (Vendor) Assessment
For external or closed-source AI systems, to evaluate transparency and accountability.
Conformity Assessment
A formal compliance check required for high-risk AI systems under the EU AI Act.
When to scale up your AI Governance framework
Expand your governance structure as complexity or risk increases. You’ll likely need more formal oversight when:
- You have more than five AI systems in production
- You operate high-risk systems under the EU AI Act
- Multiple departments use AI independently
- You face regulatory or compliance inquiries
- Significant AI-related incidents have occurred
Learn more: Get the AI Governance & Control Framework Whitepaper
This discussion is just one section of our broader framework. To explore the full picture download the our latest whitepaper. It covers all essential topics across the AI lifecycle and offers a clear roadmap for compliance and risk management.
- Define ownership and responsibilities
- Establish oversight and controls
- Embed governance across the AI lifecycle
