# What is AI Governance?

Also called AI Risk Management, Responsible AI Governance.

AI governance is the set of policies, roles, processes, and records an organization uses to decide which AI systems it builds or buys, under what conditions they operate, who is accountable for them, and how they are monitored after deployment. It converts abstract principles into decisions that can be evidenced.

Governance is distinguishable from ethics statements by its artifacts. A principle such as fairness produces nothing on its own. A governance program produces an inventory of deployed systems, a documented risk classification for each, named owners, an approval record for going live, monitoring in production, an incident procedure, and a review cadence. Auditors and regulators look for those artifacts rather than the statement.

Several published frameworks provide structure. The United States National Institute of Standards and Technology's AI Risk Management Framework, released in 2023, is voluntary and organizes work around governing, mapping, measuring, and managing risk. ISO/IEC 42001, published in 2023, specifies a certifiable management system for AI. The European Union's AI Act is binding law with obligations tied to risk classification. Organizations commonly map one internal program to several of these.

A recurring gap is the systems nobody registered. Teams adopt assistants, coding tools, and embedded vendor features without going through any process, so the inventory understates reality and the risk picture is wrong. Discovery is therefore a governance function in its own right, not a one-time onboarding step, and it usually surfaces more systems than expected.

Governance carries a real cost and can be miscalibrated in either direction. Applied uniformly, heavy process on low-risk internal tooling slows work without reducing meaningful risk, and teams route around it. Proportionality, where scrutiny scales with consequence, keeps the controls where the exposure is and keeps the process credible with the people who have to follow it.

## Key points

- Turns principles into decisions with evidence, not statements
- Core artifacts: inventory, risk class, owner, approval, monitoring
- NIST AI RMF is voluntary, ISO/IEC 42001 certifiable, EU AI Act binding
- Unregistered systems are the most common blind spot
- Scale scrutiny to consequence or teams route around it

## In practice

An organization keeps a register listing every AI system in use, each with a risk tier, a named business owner, the data categories it touches, its evaluation results, and its review date. A customer-facing assistant is tiered high and requires evaluation results and an approval before each release. An internal meeting summarizer is tiered low and requires only registration and an annual review.

## Related terms

- [EU AI Act](/en/glossary/eu-ai-act)
- [Audit Trail](/en/glossary/audit-trail)
- [Model Evaluation](/en/glossary/model-evaluation)
- [Human in the Loop](/en/glossary/human-in-the-loop)
- [Explainability](/en/glossary/explainability)

[Back to the AI Glossary](/en/glossary)