AI governance

In practice, AI governance usually includes an inventory of AI systems and use cases, an acceptable use policy, risk assessments scaled to the stakes of each use, vendor due diligence, human oversight for consequential decisions, incident handling and regular review. Frameworks provide structure: the NIST AI Risk Management Framework 1.0, published in January 2023, organises the work into govern, map, measure and manage, and ISO/IEC 42001 specifies requirements for an AI management system.

Why it matters: regulation such as the EU AI Act (Regulation (EU) 2024/1689) sets obligations that depend on how AI is used, and customers may ask suppliers to show how they govern AI. For buyers, governance shapes which tools can be approved, which contract terms are required and what evidence vendors must provide, such as security certifications, data-processing terms and model documentation.

Example: before approving an AI note-taking tool, a governance group checks where recordings are stored, whether they are used for training, who can access them and how participants are notified.

Limits: governance documents only work if people can follow them. Overly restrictive rules can push employees toward unapproved tools (shadow AI), so effective programmes pair rules with approved options and training.