AI governance, policy and risk: frameworks, templates and tools
AI governance is the set of policies, roles and controls an organisation uses to make sure AI is used safely, legally and as intended. It covers which tools are approved, how data is protected, how risks are assessed and who is accountable. This section explains the main frameworks, including the NIST AI Risk Management Framework, and gives practical templates and checklists.
Employees often adopt AI tools faster than organisations can write rules for them. Without governance, sensitive data ends up in consumer apps, nobody knows which tools are in use, and decisions influenced by AI cannot be explained or audited. Governance does not have to slow adoption; done well, it gives people a clear, approved way to use AI.
A practical programme has a few parts: an inventory of AI tools and use cases, an acceptable use policy, a risk assessment for higher-stakes uses, vendor review and monitoring. Public frameworks help structure the work. The NIST AI Risk Management Framework 1.0, published in January 2023, organises it into four functions: govern, map, measure and manage. ISO/IEC 42001 sets requirements for an AI management system.
Regulation adds hard requirements in some markets, such as the EU AI Act, adopted as Regulation (EU) 2024/1689, and data protection laws apply to AI wherever personal data is involved. This section is educational and is not legal advice; check your obligations with counsel in your jurisdiction.
What you will learn
- What AI governance covers and who owns it in an organisation
- How the NIST AI Risk Management Framework and ISO/IEC 42001 structure the work
- How to write an AI acceptable use policy people will follow
- How to find and manage shadow AI
- How to evaluate AI governance and security tools
Beginner lessons
What is an AI hallucination?
An AI hallucination is when an AI model produces information that sounds confident and plausible but is false, made up or not supported by…
What is agentic AI?
Agentic AI refers to AI systems designed to act with a degree of independence: given a goal, they plan the steps, use tools to carry them…
Is AI safe to use?
AI is generally safe for everyday tasks if you treat it as a capable but fallible assistant. The main risks are confident wrong answers…
Key terms
- AI governance
AI governance is the framework of policies, processes, roles and controls an organisation uses to ensure its development and use of AI is safe…
- AI acceptable use policy
An AI acceptable use policy is a document that tells employees how they may and may not use AI tools at work: which tools are approved, what data…
- Shadow AI
Shadow AI is the use of AI tools, models or features at work without the knowledge, approval or oversight of an organisation's IT, security or…
- Hallucination
In AI, a hallucination is output that sounds plausible but is false, unsupported by the model's sources or entirely made up, such as an invented…
- AI agent
An AI agent is software that uses an AI model to pursue a goal over multiple steps with some autonomy. It decides what to do next, calls tools such…
- Foundation model
A foundation model is a large AI model trained on broad data at scale that can be adapted to many different tasks, such as writing, coding, image…
Explore Mindber
Further reading
- Claude Fable 5 Suspended by US Government Order
The US government ordered Anthropic to disable Claude Fable 5 and Mythos 5 on June 12, 2026 — three days after launch. Why, when it returns, what to use.
- PDPA & PDPC AI Agent Procurement Guide (2026)
PDPA and PDPC AI agent procurement guide for MY/SG teams: data residency, DPA clauses, vendor due diligence, breach notices, and rollout paths.
Frequently asked questions
What is the difference between AI governance and AI ethics?
AI ethics describes the principles an organisation wants AI to respect, such as fairness, transparency and accountability. AI governance is how those principles are put into practice: policies, approval processes, risk assessments, assigned responsibilities and monitoring. Ethics sets the direction; governance makes it enforceable and auditable.
What is the NIST AI Risk Management Framework?
It is a voluntary framework from the US National Institute of Standards and Technology for managing risks from AI systems. Version 1.0 was published in January 2023. It organises the work into four functions, govern, map, measure and manage, and NIST has published companion material, including a profile for generative AI. Because it is not tied to any law, organisations outside the United States can use it too.
Does my company need an AI acceptable use policy?
If employees use AI tools for work, yes. Without one, people guess what is allowed, and confidential data can end up in unapproved tools. A short policy should list approved tools, data that must never be entered, requirements to review AI output, disclosure rules and who to ask. Review it regularly as tools and regulations change.
What is shadow AI and why does it matter?
Shadow AI is the use of AI tools at work without the knowledge or approval of IT or security teams, such as pasting customer data into a personal chatbot account. It matters because the organisation cannot control where data goes, whether vendors train on it, or whether outputs meet legal and quality standards. Providing approved tools gives people a safe alternative.
Last updated