AI Compliance Vendors

Guide

What is AI governance? Definition, frameworks and how to build a program

AI governance is the set of policies, roles, processes and controls an organization uses to decide which AI it builds, buys and uses, and to keep that AI lawful, safe and accountable for as long as it runs. In NIST’s AI Risk Management Framework it is the GOVERN function: the culture, policies and accountability structures that the rest of AI risk management depends on [1]. This guide explains what AI governance covers, how it differs from responsible AI and model governance, how the four main frameworks compare, the six parts of a working program, who owns it, and the best practices that hold up under audit.

Reviewed 5 Nov 2026 · next review by 3 Feb 2027 · 24 sources · report an error

What is AI governance?

AI governance is how an organization decides three things about every AI system: whether to use it, how it may be used, and who answers for it. It covers AI you build, buy or get inside software you already use, from first request to retirement. NIST’s AI Risk Management Framework (AI RMF) puts this in its GOVERN function, which it describes as cross-cutting: it informs the other three functions (MAP, MEASURE and MANAGE) rather than sitting beside them [1].

Two definitions anchor most programs. NIST’s GOVERN function asks for documented legal requirements, policies that build in the characteristics of trustworthy AI, an inventory of AI systems, clear roles, and processes for safely decommissioning AI [1]. ISO/IEC 42001, published in December 2023, frames the same work as an AI management system: requirements for establishing, implementing, maintaining and continually improving how an organization manages AI, for any organization that develops, provides or uses AI [4].

  • Decisions: which use cases go ahead, which are refused, and what conditions apply [1].
  • Rules: an AI policy, acceptable use rules and standards for testing, documentation and human oversight [1][18].
  • Records: an inventory of AI systems, risk ratings, impact assessments and evidence of controls [1][18].
  • People: named owners, an executive who takes responsibility for AI risk decisions, and a committee or board that reviews the riskiest cases [1][15].
  • Feedback: monitoring, incident handling and periodic review, so the program improves over time [1][5].

AI governance is not the same as AI compliance. Compliance means meeting a specific law or standard. Governance is the standing machinery that lets you meet whichever ones apply, and decide sensibly where none does.

Why does AI governance matter?

77%
of organizations surveyed were working on AI governance[11]IAPP survey of 670+ respondents, spring 2024
63%
of breached organizations had no AI governance policy or were still developing one[13]IBM study of 600 organizations, Mar 2024–Feb 2025
3.4×
more likely to report high AI governance effectiveness when using an AI governance platform[12]Gartner survey of 360 organizations, Q2 2025
$492M
forecast spending on AI governance platforms[12]Gartner forecast for 2026

Law. The EU AI Act sets fines of up to €35 million or 7% of worldwide annual turnover, whichever is higher, for prohibited AI practices, and up to €15 million or 3% for breaches of the operator obligations Article 99(4) lists, including those of providers and deployers [6]. The Digital Omnibus on AI, in force since July 27, 2026, moved the high-risk obligations to December 2, 2027 for Annex III systems and August 2, 2028 for AI in regulated products, so programs have a fixed runway rather than a reprieve [7].

Security and data. In IBM’s 2025 breach study, 13% of organizations reported breaches of AI models or applications, and 97% of those had no AI access controls in place. Of the organizations that did have an AI governance policy, only 34% regularly audited for unsanctioned AI [13].

Scale. Gartner predicts that by 2030 AI regulation will extend to 75% of the world’s economies [12]. Treat its 3.4× figure with care: it shows that organizations using governance platforms report better results, not that the platform caused them.

AI governance vs responsible AI, model governance and data governance

These terms overlap. The table shows how we use them and where each is defined.

AI governance and its neighbors
TermWhat it coversMain reference
AI governanceThe whole system of decisions, rules, records, people and feedback for all AI an organization usesNIST AI RMF GOVERN; ISO/IEC 42001 [1][4]
Responsible AI governanceTurning principles such as fairness, transparency and accountability into enforceable rules and checksOECD AI Principles; NIST’s trustworthy AI characteristics [8][3]
AI model governanceInventory, validation, approval and monitoring of individual modelsIn US banking, SR 26-2 (April 2026) [16][17]
Data governance for AIProvenance, lawful use, quality and retention of the data that trains and feeds AIISO/IEC 42001 data controls B.7.2–B.7.6 [18]; see our data governance for AI guide
AI agent governancePermissions, oversight and logging for AI that takes actionsSee our AI agent governance guide
AI governance platformSoftware that runs the inventory, workflows and evidenceSee what an AI governance platform is

Responsible AI governance. Responsible AI is the goal; governance is how you prove you are pursuing it. The OECD’s five values-based principles are inclusive growth, sustainable development and well-being; human rights and democratic values, including fairness and privacy; transparency and explainability; robustness, security and safety; and accountability [8]. NIST lists the characteristics of trustworthy AI as valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed [3]. A responsible AI program writes those into policy, tests for them and records the results.

AI model governance. Model governance is the narrower, older discipline of controlling individual models. US bank supervisors replaced SR 11-7 with SR 26-2 on April 17, 2026 [16]. The new guidance keeps a model inventory and model validation, ties oversight to each model’s materiality, and puts generative and agentic AI outside its scope [17]. Banks still have to govern those systems, so they need AI governance that reaches beyond the model inventory. Our model risk management guide and SR 11-7 guide cover the banking rules in depth.

Which AI governance framework should you use?

Most programs draw on four sources. They do different jobs, so the answer is usually a combination.

The four main AI governance frameworks compared (as of November 2026)
NIST AI RMFISO/IEC 42001EU AI ActOECD AI Principles
What it isRisk management framework with four functions: GOVERN, MAP, MEASURE, MANAGE [1]Management system standard for AI [4]Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744 [7]OECD Council Recommendation on AI [10]
Legal forceVoluntary [3]Voluntary (our reading: binding only where a contract or regulator asks for it)Binding law for operators in scope; fines up to €35M or 7% [6]Not legally binding; a political commitment by adherents [10]
Who it’s forOrganizations of all sizes, public or private, in any sector [3]Any organization that develops, provides or uses AI [4]Providers and deployers of AI on the EU market [21][22]Governments; 47 adherents, including the EU [8]
What it asks forOutcomes such as an AI inventory, documented roles, impact mapping, monitoring and incident response [1]Policy, risk and impact assessment, controls, internal audit and continual improvement [5][18]Prohibitions; risk management, data governance, logging and oversight for high-risk AI; transparency duties [7][20][21][22]Five values-based principles and five recommendations for policymakers [8]
Certifiable?No; there is nothing to certify againstYes; organizations have been certified since 2024 [5][24]Conformity assessment for high-risk AI, not certification of your program [7]No
StatusVersion 1.0 from January 26, 2023; a revision is under way [2]First edition, 2023 [4]Phased; high-risk rules apply from Dec 2, 2027 and Aug 2, 2028 [7]Adopted 2019, updated May 2024 [8][9]
Best used forA shared risk vocabulary and a gap analysisAn auditable program and external assuranceLegal obligations in the EUPrinciples and board-level commitments
Supporting standards: ISO/IEC 42005:2025 gives guidance on AI system impact assessments [19], and NIST hosts a crosswalk from the AI RMF to ISO/IEC 42001 [18]. Our crosswalks map more pairs.

A practical way to combine them: adopt the OECD principles, or your own version of them, as the board-level commitment; use the NIST AI RMF to structure risk work and find gaps; build the program to ISO/IEC 42001 if customers or regulators will want independent assurance; and map each EU AI Act obligation onto that program if you sell or use AI in the EU. Our hubs on the NIST AI RMF, ISO/IEC 42001 and the EU AI Act go deeper, and NIST AI RMF vs ISO 42001 compares the two most often confused.

What does an AI governance program include?

Six components appear in every serious program. The table maps each one to the clauses that ask for it, so you can build once and show evidence to several frameworks.

The six components of an AI governance program, mapped to the frameworks
ComponentWhat it isNIST AI RMFISO/IEC 42001EU AI Act
AI inventoryA register of every AI system and use case, with owner, purpose, vendor, data and risk tierGOVERN 1.6 [1]Resource controls: resource documentation and data, tooling, system and human resources (B.4.2–B.4.6) [18]No inventory article, but deployer and incident duties assume you know what you run (our reading)
Risk tieringRules that sort use cases into tiers and set the depth of review for eachGOVERN 1.3 [1]Impact assessment (6.1.4) [18]Risk categories, with high-risk rules from Dec 2, 2027 [7]
Policies and standardsAI policy, acceptable use, and standards for testing, documentation and oversightGOVERN 1.2, 1.4 [1]AI policy (B.2.2–B.2.4) [18]Deployers must assign human oversight to people with the necessary competence, training and authority (Art. 26(2)) [22]
Impact assessmentsA documented look at who could be harmed and how, before launchMAP 1.1 [1]6.1.4, 8.4 and B.5.2–B.5.5; guidance in ISO/IEC 42005 [18][19]Fundamental rights impact assessment for some deployers (Art. 27) [20]
MonitoringTracking performance, drift, misuse and complaints in productionMANAGE 4.1 [1]AI system operation and monitoring (B.6.2.6) [18]Deployers keep logs at least six months (Art. 26(6)) [22]
Incident responseDetecting, escalating, fixing and reporting AI failuresGOVERN 4.3, MANAGE 4.3 [1]Nonconformity and corrective action (clause 10) [5]Providers report serious incidents within 15 days, 10 for a death, 2 for widespread infringements (Art. 73) [21]
ISO control numbers follow the NIST-hosted crosswalk, which uses Annex B (guidance) numbers that mirror the Annex A controls; check the published standard.
  • Start the inventory first. Everything else keys off it. Include third-party tools and AI features inside approved software; NIST asks for policies on third-party AI risk (GOVERN 6.1) [1], and our shadow AI guide covers discovery. Our free AI risk register is a starting template.
  • Keep risk tiers few. Three or four tiers with clear triggers (personal data, decisions about people, customer-facing output, autonomy) beat a 40-question score nobody trusts. Run high tiers through our EU AI Act risk classifier.
  • Write the policy last, not first. A policy written before you know what you run tends to be ignored. Our AI policy generator drafts one from your answers.
  • Reuse assessments. The EU AI Act lets a deployer cross-reference a GDPR data protection impact assessment in its fundamental rights impact assessment [20]. Our impact assessment template and FRIA generator follow that approach.
  • Rehearse incidents. Article 73’s clock starts when the provider becomes aware of the incident [21]. Our incident report builder sets out what the report needs.

Who owns AI governance? Committees and the chief AI officer

NIST asks that executive leadership take responsibility for decisions about AI risks and that roles and lines of communication be documented [1]. In practice ownership is spread across functions. In the IAPP’s 2024 survey, the team with primary responsibility for AI governance was privacy at 22% of organizations, legal and compliance at 22%, IT at 17% and data governance at 10% [11].

The chief AI officer. The role has spread fast. In IBM’s 2026 CEO study of 2,000 CEOs and equivalent senior leaders in 33 geographies, 76% of surveyed organizations had a chief AI officer, up from 26% in 2025 [14]. Gartner found that 91% of organizations with high AI maturity had appointed dedicated AI leaders [23]. In the US federal government the role is mandatory: OMB memo M-25-21 (April 3, 2025) gave agencies 60 days to name a chief AI officer and gave agencies covered by the Chief Financial Officers Act 90 days to convene an AI governance board [15].

A typical split of responsibilities (our suggestion; adapt to your size)
RoleTypical responsibilities
Board or risk committeeSets risk appetite for AI; receives regular reporting on high-risk systems and incidents
Executive sponsor or chief AI officerOwns the program; takes responsibility for AI risk decisions, as NIST GOVERN 2.3 expects [1]
AI governance committeeCross-functional group (legal, privacy, security, risk, data, business) that approves high-tier use cases and exceptions
Legal, privacy and complianceTracks applicable laws (GOVERN 1.1) [1]; runs impact assessments
SecurityAI threat modeling, access control, red teaming and AI incident handling
System ownersKeep inventory entries, documentation and monitoring current for their systems
Internal auditTests that the program works as written; required by ISO/IEC 42001 [5]

The AI governance committee. Give it a charter, a short list of decisions only it can make (approving high-tier use cases, granting exceptions, accepting residual risk), a fixed cadence, and a written record. Committees that review every use case become bottlenecks; tiering keeps low-risk requests away from them.

What does enterprise AI governance look like?

Enterprise AI governance is the same six components run across many business units, vendors and regions. Three design choices decide whether it works at scale:

  • Central standards, local owners. A central team sets policy, tiers and templates; business units own their inventory entries and assessments. Gartner found that almost 60% of high-maturity organizations centralize AI strategy, governance, data and infrastructure [23].
  • One intake route. Every new AI use case, purchase or vendor AI feature enters through the same request, which creates the inventory entry and triggers the right tier of review.
  • Tooling that integrates. Gartner expects large enterprises to run an average of 10 governance, risk and compliance tools by 2028, up from 8 in 2025 [12], so AI governance software has to connect to the GRC, procurement and security tools already in place. Our guide to AI governance platforms explains what they do, and our ranking compares them.

Two areas need their own rules at enterprise scale: AI agents that act on systems, covered in our AI agent governance guide, and AI that employees use without approval, covered in our shadow AI guide.

How do you build an AI governance program?

  1. 01

    Set scope and appetite

    Decide which AI is in scope (built, bought, embedded, agents), which laws apply (GOVERN 1.1) and how much AI risk leadership will accept [1].

  2. 02

    Name the owners

    Appoint an executive sponsor, charter a committee and document roles and escalation lines (GOVERN 2.1) [1].

  3. 03

    Build the inventory

    Collect every AI system and use case with owner, purpose, vendor, data and users (GOVERN 1.6) [1]. Start from procurement, SSO and expense data, then survey teams.

  4. 04

    Tier the risk

    Sort the inventory into tiers and set the review each tier needs (GOVERN 1.3) [1]. Flag anything that may be high-risk under the EU AI Act [7].

  5. 05

    Write policy and standards

    Publish the AI policy, acceptable use rules and minimum standards for testing, documentation and human oversight [18].

  6. 06

    Assess before launch

    Run impact assessments for high tiers before deployment (MAP 1.1) and record the go or no-go decision (MANAGE 1.1) [1][19].

  7. 07

    Monitor and respond

    Put monitoring plans in place for deployed systems and an incident process that meets any reporting deadlines (MANAGE 4.1, 4.3) [1][21].

  8. 08

    Review and improve

    Review the program on a fixed cycle (GOVERN 1.5) and fix what audits find [1][5]. Score yourself with our AI readiness assessment and see the AI governance maturity model for what the next level looks like.

AI governance best practices

  1. Govern use cases, not just models. The same model can be low risk in one use and high risk in another, so tier the use case, not the model.
  2. Include what you buy. Third-party and embedded AI need the same inventory entry and tiering as AI you build (GOVERN 6.1) [1].
  3. Make the review proportional. Match effort to risk tier (GOVERN 1.3) so low-risk requests move in days [1].
  4. Decide in writing. Record who approved each high-tier system, on what evidence, with what conditions (GOVERN 2.3) [1].
  5. Plan the exit. Have a way to switch off or retire a system that misbehaves (GOVERN 1.7, MANAGE 2.4) [1].
  6. Keep evidence as you go. Monitoring logs, test results and assessments are what auditors and regulators ask for; EU deployers of high-risk AI must keep logs for at least six months [22].
  7. Review on a schedule. Re-run the inventory and re-tier systems at least yearly, and after any major model, vendor or legal change (GOVERN 1.5) [1].

Related guides and tools

Advertise on this page

Frequently asked questions

+What is AI governance in simple terms?

AI governance is the rules, roles and records an organization uses to decide which AI it uses, how, and who is accountable for it. NIST describes it as the culture, policies and accountability structures that the rest of AI risk management depends on [1].

+What are the main AI governance frameworks?

The four most used are the NIST AI Risk Management Framework (voluntary, US) [2], ISO/IEC 42001 (an international management system standard) [4], the EU AI Act (binding law) [7] and the OECD AI Principles (non-binding principles with 47 adherents) [8][10]. Most programs combine them.

+Is AI governance required by law?

In some places and for some uses. The EU AI Act imposes binding duties, with high-risk obligations applying from December 2, 2027 and August 2, 2028 [7], and US federal agencies must have chief AI officers under OMB memo M-25-21 [15]. Elsewhere, frameworks like the NIST AI RMF are voluntary [3], though customers and sector regulators often expect them.

+What is the difference between AI governance and responsible AI?

Responsible AI is the goal: AI that is fair, transparent, safe and accountable, as set out in principles like the OECD’s [8] and NIST’s trustworthy AI characteristics [3]. AI governance is the machinery that turns those goals into policies, reviews and evidence.

+What is AI model governance?

AI model governance is the control of individual models: keeping an inventory, validating models before use, approving them and monitoring them. In US banking the reference is SR 26-2, which replaced SR 11-7 on April 17, 2026 and leaves generative and agentic AI outside its scope [16][17].

+Who is responsible for AI governance in an organization?

Ownership varies. In the IAPP’s 2024 survey, privacy and legal and compliance teams each held primary responsibility at 22% of organizations, and IT at 17% [11]. NIST expects executive leadership to take responsibility for AI risk decisions [1], and 76% of organizations in IBM’s 2026 CEO study had a chief AI officer [14].

+What does an AI governance committee do?

It is a cross-functional group that approves high-risk AI use cases, grants exceptions and accepts residual risk on the organization’s behalf. The largest US federal agencies, those under the Chief Financial Officers Act, had to convene an AI governance board within 90 days under OMB memo M-25-21 [15]; in companies the committee’s charter and membership are set internally.

+Is the NIST AI RMF mandatory?

No. NIST says the AI RMF is intended for voluntary use and is meant to scale to organizations of all sizes in any sector [2][3]. It is often used as the reference framework for US programs and is being revised [2].

+What tools are used for AI governance?

AI governance platforms keep the inventory, run intake and assessment workflows and collect evidence; Gartner forecasts $492 million in spending on them in 2026 [12]. See our explainer and ranking.

Sources

  1. [1]NIST, AI RMF Core (GOVERN, MAP, MEASURE, MANAGE).
  2. [2]NIST, AI Risk Management Framework (2026-08-13).
  3. [3]NIST, AI Risk Management Framework FAQs.
  4. [4]ISO, ISO/IEC 42001:2023 — Artificial intelligence — Management system (2023-12).
  5. [5]GLOCERT International, What is ISO/IEC 42001? (structure, clause 10 and Plan-Do-Check-Act).
  6. [6]European Commission (AI Act Service Desk), Article 99: Penalties (consolidated text as at 27 July 2026).
  7. [7]White & Case, EU AI Omnibus enters into force, amending the AI Act (2026-08-04).
  8. [8]OECD.AI, OECD AI Principles overview.
  9. [9]OECD, OECD updates AI Principles to stay abreast of rapid technological developments (2024-05).
  10. [10]White & Case (via JD Supra), AI Watch: Global regulatory tracker — OECD (2025-05-08).
  11. [11]IAPP, AI Governance Profession Report 2025 (2025-04-16).
  12. [12]Gartner, Gartner: Global AI regulations fuel billion-dollar market for AI governance platforms (2026-02-17).
  13. [13]IBM, IBM Report: 13% of organizations reported breaches of AI models or applications, 97% of which reported lacking proper AI access controls (2025-07-30).
  14. [14]IBM, IBM Study: CEOs are reshaping C-suite roles for the AI era (2026-05-04).
  15. [15]Office of Management and Budget, M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust (PDF) (2025-04-03).
  16. [16]Federal Reserve Board, SR 26-2: Revised Guidance on Model Risk Management (2026-04-17).
  17. [17]Federal Reserve Board, OCC and FDIC, SR 26-2 letter and attached Revised Guidance on Model Risk Management (PDF) (2026-04-17).
  18. [18]Microsoft, hosted by NIST AI Resource Center, NIST AI RMF to ISO/IEC FDIS 42001 AI Management System Crosswalk.
  19. [19]ISO, ISO/IEC 42005:2025 — AI system impact assessment (2025-05-28).
  20. [20]European Commission (AI Act Service Desk), Article 27: Fundamental rights impact assessment for high-risk AI systems.
  21. [21]European Commission (AI Act Service Desk), Article 73: Reporting of serious incidents.
  22. [22]European Commission (AI Act Service Desk), Article 26: Obligations of deployers of high-risk AI systems.
  23. [23]Gartner, Gartner survey finds 45% of organizations with high AI maturity keep AI projects operational for at least three years (2025-06-30).
  24. [24]Techpartner News, KPMG Australia becomes world’s first to achieve ISO AI certification (ISO/IEC 42001, certified by BSI Australia) (2024-10-21).

How we keep this page current

Every claim links to its source. We re-check this page at least every 90 days, and sooner when a standard, law or vendor changes; vendor names, acquisitions and shutdowns update automatically from our directory. Vendors cannot pay to be included or ranked.