AI Governance
The rules, processes, and institutions — inside companies and across governments — that decide how AI systems are built, deployed, audited, and held accountable.
AI governance is about who decides. It covers the internal policies a company applies when building AI, the standards bodies that define best practice, and the laws that set hard limits.
Layers of AI governance:
- Organisational: model inventories, risk assessments, approval gates before deployment, incident reporting, and documented red-teaming. Many labs publish safety frameworks and frontier policies describing when they will pause or restrict a model.
- Standards and certification: frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 give organisations a common vocabulary and auditable processes.
- National and international law: the EU AI Act is the most comprehensive; other jurisdictions have sectoral rules, while international efforts focus on coordination and testing.
Recurring tensions shape the field: voluntary commitments versus regulation; open weights versus controlled access; transparency versus trade secrets; and global companies facing a patchwork of national rules. A practical governance programme usually starts by inventorying AI systems, classifying them by risk, and assigning clear ownership for each — the same first steps auditors look for.