What should an AI governance framework include?

A working AI governance framework has parts that keep running after the launch meeting, and each part produces evidence someone can check. The three references people search for, the NIST AI Risk Management Framework, ISO/IEC 42001, and the EU AI Act, describe those parts in their own vocabulary. This page maps each part to all three.

What are the parts of an AI governance framework?

• Inventory. Every AI system the company builds, buys, or lets staff use, including AI features inside existing software.
• Ownership. One accountable executive for AI risk overall, and a named owner for each system with the authority to pause it.
• Risk tiers. A short scale that decides how much control each system gets. Customer-facing decisions and personal data sit at the top.
• Policy. The written rules staff follow: approved tools, data that stays out, and who approves a new use. An acceptable use policy is the usual first document.
• Controls that run. Settings and software that apply the policy on every request, such as single sign-on to approved tools, blocked uploads, and redaction of identifiers before a prompt leaves the company.
• Monitoring. Someone watches what the systems actually do in production, on a schedule, with a threshold that triggers action.
• Incident handling. A written path for a leak, a wrong answer that reached a customer, or an agent that acted outside its limits: who is told, who can switch it off, and who informs the vendor.
• Records. Logs and documents that show what was asked, what the system did, and who approved it, kept long enough to answer an auditor or a regulator. Use AI governance auditing when the company needs a formal gap assessment and evidence review.
• Review. A dated, recurring look at the whole framework, with findings that change the inventory, the tiers, or the controls.

What is the NIST AI Risk Management Framework?

NIST AI RMF 1.0, published in January 2023, is voluntary and written for organizations of any size and sector. It sorts the work into four functions. Govern sets policy, roles, and accountability across the other three. Map sets the context and impacts of each system. Measure tests and tracks risk. Manage responds to risk, including monitoring, incident response, and recovery after deployment. NIST added the Generative AI Profile (NIST AI 600-1) in July 2024. It names twelve risks unique to or worsened by generative AI, from confabulation to data privacy and information security, and lists suggested actions against the same functions, starting with adding generative AI systems to the organizational inventory.

What is ISO 42001, and can a company be certified?

ISO/IEC 42001:2023, published in December 2023, is the international standard for an AI management system. ISO describes it as requirements for establishing, implementing, maintaining, and continually improving that system, for organizations that develop, provide, or use AI. Its clauses run through context, leadership, planning, support, operation, performance evaluation, and improvement, with AI-specific requirements such as an AI policy, an AI risk assessment, and an AI system impact assessment. Certification is voluntary and comes from independent certification bodies, which national accreditation bodies accredit.

What does the EU AI Act require, and when does it apply?

The EU AI Act (Regulation (EU) 2024/1689) applies to providers that place AI on the EU market and to deployers in the EU. It also reaches a company outside the EU when the output of its AI system is used in the EU. Its duties scale with risk, from banned practices to high-risk systems to transparency for chatbots and generated content. In July 2026 the Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the high-risk dates later and reworded the AI literacy duty in Article 4 so that providers and deployers take measures to support their staff's AI literacy.

How do the parts map to NIST AI RMF, ISO 42001, and the EU AI Act?

NIST subcategories, the ISO clauses NIST's crosswalk assigns to them, and the matching EU AI Act articles. Most EU articles here bind high-risk systems; Articles 4 and 5 bind everyone.

How does a 50 to 500 person company start in 90 days?

This plan fits a company with a CFO or COO who owns risk, an IT lead, outside counsel, and staff already using AI.

• Days 1 to 30: inventory, owners, and policy. List every AI tool, copilot, and AI feature in use from team surveys, sign-in logs, and expenses. Name one executive accountable for AI risk and an owner for each system. Publish a one-page acceptable use policy naming approved tools and the data that stays out.
• Days 31 to 60: tiers and controls. Put every system on a three-level scale, and check each top-tier system against EU AI Act Annex III if any of its output reaches the EU. For the top tier, switch on the controls that enforce the policy: approved accounts only, logging on, redaction of identifiers, and a named person who can switch the system off.
• Days 61 to 90: monitoring, incidents, records, and review. Set a monthly check of what each top-tier system did. Write a one-page incident path. Set log retention, with six months as the floor for any EU high-risk deployment. Hold the first review and decide whether ISO/IEC 42001 certification is a goal for next year.

How do you know the framework is real?

Test each part for evidence. A control that runs leaves a log; a policy on its own leaves a signature. AI governance versus theater and enforced or written down give the questions to ask, and complying with several regimes shows one set of controls and records serving several regulators.