What is AI governance?

The parts of an AI governance programme

Most programmes are built from the same parts, whichever standard they follow.

• Accountability. Who approves new AI uses, who owns each system, and how top management oversees it.
• Policy. An AI policy that says what is allowed, what needs approval and what is not done.
• Inventory. Every AI system in use, with its purpose, data, owner and risk class.
• Assessment. Risk assessments for the organisation and impact assessments for the people affected.
• Controls. Data quality, human oversight, transparency to users, security and monitoring after release.
• Records. Evidence that the above happened, kept for audit and for regulators.

Standards and laws

ISO 42001, published in December 2023, specifies an AI management system and can be certified by an accredited body. Its structure matches ISO 27001, so an organisation with an ISMS can reuse much of the management-system work.

The EU AI Act sorts AI systems into prohibited, high-risk, limited-risk and minimal-risk uses, and puts most of its duties on providers and deployers of high-risk systems. The NIST AI Risk Management Framework gives a voluntary structure in four functions, Govern, Map, Measure and Manage, and is often used to organise a programme before choosing a certification.

AI governance and the rest of GRC

AI governance works best inside the existing GRC programme rather than beside it. AI risks belong on the same risk register as security and privacy risks, a DPIA often covers the same processing as an AI impact assessment, and customers ask about AI in the same security questionnaires.

That is how Certifyi is arranged. The AI governance module, built around ISO 42001 with an AI system register, an EU AI Act risk class for each system and AI impact assessments, sits in the same workspace as your other frameworks rather than in a tool of its own.

Related terms

AI GRC

Governance, risk and compliance for AI systems, against standards such as ISO 42001 and laws such as the EU AI Act, and the use of AI inside GRC work to draft, map and review, with a person accountable.

AI system inventory

A register of every AI model, agent and third-party AI service an organisation builds or uses, with its purpose, data, owner and risk class. ISO 42001 and the EU AI Act both start from it.

AI impact assessment

An assessment, for each AI system, of who is affected, what could go wrong, how likely and how severe it is, and what is done about it. ISO 42001 requires one, and the EU AI Act requires its own forms for high-risk systems.

Data Protection Impact Assessment (DPIA)

A GDPR-required assessment of processing likely to result in a high risk to individuals, recording the risks and the measures that reduce them before the processing starts.