What Is AI Governance? A Plain Answer for Leaders

AI governance is the set of rules, decisions and controls that determine which AI systems an organisation uses, what those systems are allowed to do, and who can change or stop them. You have it when someone can point at any AI system in the company and name its owner, say what could go wrong with it, and show how it would be paused.

Most organisations aren’t there yet. In ISACA’s 2026 AI Pulse Poll of more than 3,400 digital trust professionals, 38 percent said their organisation had a formal, comprehensive AI policy and another 30 percent had a limited one. Only 12 percent had a documented process for shutting down or overriding an AI system that is also tested regularly. So roughly two in three have written something down, and about one in eight could prove they can act on it.

That gap is the whole subject. Governance is the distance between the policy and the stop button, and how quickly you can close it.

What does AI governance actually include?

I find it easiest to explain as three working parts.

Policy says what the organisation allows: which uses are fine, which need review, which are off the table, and what people must be told when AI is involved.

Process turns the policy into decisions. Someone keeps a list of the AI systems in use. Someone assesses what each one could get wrong. Someone approves it before launch and reviews it after.

Control is the part that bites. A deployment gate that will not pass a system without its review. Monitoring that notices when outputs drift. A named person with the authority, and the tested means, to pause the system.

Standards bodies describe the same thing in their own words. NIST’s AI Risk Management Framework 1.0 (2023) has four functions: govern, map, measure and manage. The framework says the govern function “cultivates and implements a culture of risk management within organizations”, and calls it “a cross-cutting function that is infused throughout AI risk management and enables the other functions.” In plain terms, governance is what makes the other three happen. NIST says version 1.0 is now being revised.

ISO/IEC 42001, published in December 2023, approaches it as a management system. Its requirements cover “establishing, implementing, maintaining, and continually improving” an AI management system, and ISO says it is designed for organisations that provide AI products or use them. That second half matters, because buying AI does not exempt you.

What AI governance is not

It is not only compliance. Law sets a floor. Under the EU AI Act (Regulation (EU) 2024/1689), providers and deployers have had an AI literacy duty since 2 February 2025. As amended by the Digital Omnibus, it requires them to take measures to support the AI literacy of their staff. For high-risk uses listed in Annex III, such as hiring and credit, deployers must from 2 December 2027 give human oversight to people with “the necessary competence, training and authority”, monitor the system, and keep the logs under their control for at least six months, unless other EU or national law says otherwise. Those are governance duties. A company that does only what the law requires, only where it applies, is still ungoverned everywhere else.

An ethics committee alone does not count. A committee can be part of governance. A committee that cannot block a launch, or has never changed one, is a meeting.

A document is not governance either. A policy that nobody has to pass through before shipping a system describes good intentions. The ISACA numbers show the distance between having a policy and acting on it.

Who owns AI governance?

In my experience it takes three levels of ownership, and each one fails in its own way when it is missing.

The board decides how much AI risk the organisation will accept. It doesn’t approve individual systems, but it should know how many there are, which of them touch customers or employees, and whether anyone has tested the stop button.

An executive owner runs the programme: keeps the policy current, chairs the reviews, and reports to the board. In a smaller company this is often the COO or the CTO. What matters is one name, with a budget behind it.

A system owner for every AI system in use, meaning the person who can pause it. EU law sets the same bar for high-risk systems, where deployers must assign human oversight to people with “the necessary competence, training and authority.” Authority is the word to watch. If the owner needs three sign-offs to switch the system off, the system has no owner.

The chart below is an illustration, not a real company. Accountability for each system should run from the system to its owner inside the business, then to the executive owner and the board. The staff assistant has no named owner, so its accountability drains away before anyone above can pick it up.

When I look at governance that failed, one of these levels is usually empty. The board never asked. The executive owner turned out to be a committee. Or the system owner was whoever bought the licence.

What does AI governance look like for one system?

Here is an illustration. A company buys a CV screening tool that ranks job applicants. Its vendor built the model, but the company owns every decision that model shapes.

Start with policy. Hiring sits on the review list. Recruitment and selection are listed in Annex III of the Act, and a tool that ranks applicants shapes who gets an interview, so it is likely to count as high-risk. Article 6(3) exempts only listed systems that do not materially influence the outcome, such as one that performs a narrow procedural task. The policy also says candidates are told when AI helps screen them.

Then process. The tool goes on the inventory with a named owner, say the head of talent acquisition. Someone asks what it could get wrong, such as marking down candidates with career breaks or misreading CVs in an unusual format. The vendor is asked for its own test results, and the team runs a sample of past applications through the tool before it goes live.

Then control. Recruiters can see why a candidate ranked low and can override the ranking. Someone checks pass rates by group every month. The company keeps the logs it controls for at least six months, which EU law will require of deployers of systems like this from 2 December 2027. And the head of talent acquisition knows how to switch the ranking off and fall back to manual screening, and has done it once in a drill.

None of that is exotic: a few documents, a monthly check and one rehearsal, and the rehearsal is the step the ISACA figures suggest most organisations have not taken.

Where did AI governance come from?

The idea is older than the current wave of AI. In April 2011 US bank supervisors issued SR 11-7, guidance on managing model risk, and it stayed in force until 17 April 2026, when SR 26-2 from the Federal Reserve, the OCC and the FDIC replaced it. In May 2019 the OECD adopted its AI Principles, updated in May 2024, which today have 47 adherents. NIST’s framework followed in 2023, ISO/IEC 42001 at the end of that year, and the EU AI Act in 2024, with its timetable amended by the Digital Omnibus, Regulation (EU) 2026/1744, in July 2026.

One direction runs through all of it: what started as model validation in finance became a general expectation that any organisation using AI can show who decides, on what evidence, and how it stops.

Do we need AI governance if we only buy AI tools?

Yes. In my experience most companies deploy far more AI than they build: a vendor’s screening tool, a model inside a CRM, an assistant every employee can open. The EU’s literacy duty applies to deployers as well as providers, and so do the high-risk oversight duties above. The risk doesn’t depend on who wrote the model: if it makes a wrong call about a customer, the customer will hold you responsible.

How do you start?

Start small and get to the stop button fast. That is the idea behind Minimum Viable Governance, the framework I built for exactly this. Its first step is three questions a small team can answer in two weeks. What AI systems do we have? What could go wrong? Who decides? The answers become an inventory, a risk register and a named owner who can pause each system. The rest of the 90 days follows NIST’s four functions and ends with a deployment gate and the first system through it.

MVG is a starting point that does not make a company compliant with the EU AI Act, and high-stakes systems need more. After day 90 the same documents grow into the five layers of the Governance Playbook: policy, process, tooling, people and assurance. To see which laws apply where you operate, the Regulation Tracker lists each jurisdiction against its primary text.

The test I use for any governance programme is short. Pick one AI system. Can a named person pause it this week, and has anyone practised doing so? If the answer is yes, you have the core of AI governance. Everything else is making that true for every system you run.

Sources and changes

ISACA, “AI Use Accelerates, While Governance and ROI Lag, Says New ISACA Research”, press release, 5 May 2026, and “The AI Security Gap: Adoption Is Accelerating but Response Capability Is Lagging”, ISACA Now blog, 5 May 2026. NIST, AI RMF 1.0, Section 5, AI RMF Core, and AI Risk Management Framework overview. ISO, ISO/IEC 42001:2023. Regulation (EU) 2024/1689, Article 4, Article 6, Article 26 and Annex III (AI Act Service Desk, consolidated text), and Regulation (EU) 2026/1744, OJ 24 July 2026. Federal Reserve, OCC and FDIC, SR 26-2, 17 April 2026. OECD, AI Principles.

Published 25 October 2026. All sources read on 25 October 2026. Later the same day, three EU AI Act points were made more precise: the AI literacy duty now quotes Article 4 as amended by the Digital Omnibus, log retention covers logs under the deployer’s control, and the hiring example notes the Article 6(3) exception. Corrections: tell me.