AI governance

AI governance turns principles into decisions that someone owns. It defines who may approve a new AI use case, which risks must be assessed before deployment, what documentation is kept, who monitors systems in production and when an issue must be escalated to senior management or the board. ISO/IEC 38507 frames it as part of corporate governance, ISO/IEC 42001 gives it the structure of a management system, and the Govern function of the NIST AI RMF describes the culture, accountability and policies that support every other risk activity.

Good AI governance is proportionate: a spelling assistant does not need the same scrutiny as a credit scoring model. It also connects to existing programs such as data protection, information security, enterprise risk and internal audit instead of creating a parallel bureaucracy. A practical example is an intake process in which every proposed AI system is registered, classified by risk and approved by a named owner before it reaches users.