Reference Materials

AI governance

The AI governance reference: the frameworks that set the requirements, the concepts they assume, and the practical questions that arise when running a program.

AI governance is the set of decisions, controls and evidence that lets an organization say what its AI systems do, who is accountable for them, and how that is proven. This section covers the frameworks that set the requirements, the concepts those frameworks assume, and the practical questions that arise when either is put into operation.

Where a compliance deadline applies, the framework that sets it is the usual starting point. Where the scope of a program is still undecided, the concepts are.

What changed in 2026 (status as of October 2026)

EU AI Act timeline reset. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It deferred the high-risk obligations and softened the AI literacy duty in Article 4. It did not delay Article 50 transparency.
Canada published a strategy, not a statute. AI for All, launched on 4 June 2026, promises privacy, online safety and AI transparency measures. Two related bills followed: Bill C-34, the Safe Social Media Act (10 June 2026), which includes duties for AI chatbots, and Bill C-36, the Protecting Privacy and Consumer Data Act (15 June 2026), which would replace PIPEDA. As of October 2026, neither is law.
US state law is under pressure. Executive Order 14365 (11 December 2025) directed federal action against state AI laws, and the DOJ AI Litigation Task Force was formalized on 9 January 2026. In Colorado, a federal magistrate judge's order of 27 April 2026 in xAI v. Weiser barred enforcement of the 2024 AI Act (SB 24-205) pending a preliminary-injunction ruling. The state then repealed that Act before it took effect and re-enacted a narrower automated decision-making law, SB 26-189, signed 14 May 2026 and operative 1 January 2027.
Content labelling is live. California's AI Transparency Act became operative on 2 August 2026, the same day as EU Article 50. See AI transparency.

The frameworks that set the requirements

Five reference frameworks govern most AI work. They overlap, and only one of them can be certified.

EU AI Act — binding law. Prohibited practices and AI literacy have applied since 2 February 2025, general-purpose AI model obligations since 2 August 2025 (enforceable by the Commission since 2 August 2026), and Article 50 transparency duties since 2 August 2026. High-risk obligations apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
NIST AI RMF — voluntary. Organizes AI risk into Govern, Map, Measure and Manage. As of October 2026, the current version is still 1.0 (January 2023), with a Generative AI Profile (NIST AI 600-1) and a draft Cyber AI Profile alongside it. Implementation detail is in the NIST AI RMF implementation guide.
ISO/IEC 42001 — the only one of the five that supports third-party certification. ISO/IEC 42006:2025 now sets the rules for the bodies that certify it, and ISO/IEC 42005:2025 covers AI system impact assessment.
OWASP Top 10 for LLMs — the failure modes that break AI in production. As of October 2026, the 2025 edition is current, and a separate Top 10 for Agentic Applications (2026) covers agents that call tools and act on their own.
MITRE ATLAS — how AI systems are attacked in the real world.

A side-by-side comparison of all five is on the AI security frameworks compared page. For help picking one, see choosing an AI security framework.

Core concepts

Foundations

What is AI governance? — the structure, roles and evidence a program needs.
What is an AI strategy? — where AI will create value, where it will not be used, and how both are measured.
What is AI accountability? — who answers for each system, and what happens when it causes harm.
What is AI safety? — alignment, robustness and the failures that need no attacker.

Policy and oversight

What is an AI acceptable use policy? — which tools staff may use, with what data, and who approves exceptions.
AI oversight at board level — what directors should ask for and receive.
Human-in-the-loop — why oversight needs authority, information, time, competence and safety to dissent.

Transparency and explainability

What is AI transparency? — disclosure duties under EU AI Act Article 50, California SB 942 and Canadian rules.
What is explainable AI (XAI)? — SHAP, LIME, counterfactuals and the legal right to an explanation.

Audit and assurance

What is an AI audit? — scope, evidence and what a third party will test.
What IT auditors should know about AI audit — what changes, and which existing controls still apply.
AI in risk, audit and compliance — how AI changes the assurance functions themselves.

Privacy, sector and legal

What is AI privacy? — personal data in training and inference, memorization, anonymization and consent.
AI risk in financial services — model risk and operational resilience rules applied to AI.
AI lawsuits explained — who is being sued over AI, and what courts have ruled.

Putting a program in place

Implementation means turning the frameworks into a register of AI systems, named owners, documented risk assessments and evidence an auditor will accept.

Sources and references

Frequently asked questions

Where should I start with AI governance?

Start with an inventory of the AI systems already in use, including AI features embedded in SaaS tools, and a named owner for each. Where a compliance deadline applies, start from the framework that sets it, usually the EU AI Act. For a program built from scratch, the NIST AI RMF provides structure and ISO/IEC 42001 provides a route to certification.

Which AI governance framework should I use?

Most organizations use more than one. The EU AI Act is binding law where it applies. The NIST AI RMF is a voluntary structure for managing AI risk. ISO/IEC 42001 is the only one a third party can certify an organization against. OWASP and MITRE ATLAS cover how AI systems fail and are attacked, which feeds the security controls the others require.

Has the EU AI Act high-risk deadline moved?

Yes. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, deferred obligations for Annex III high-risk systems to 2 December 2027 and for high-risk AI embedded in products covered by Annex I to 2 August 2028. Prohibitions, general-purpose AI model obligations and Article 50 transparency duties were not deferred and already apply.

Does Canada have an AI law?

Not a general federal one. The Artificial Intelligence and Data Act died with Bill C-27 in January 2025. Canada's national AI strategy, *AI for All*, launched on 4 June 2026, commits to new privacy, online safety and AI transparency measures. As of October 2026, two related bills tabled in June 2026 are not yet law: Bill C-36, the Protecting Privacy and Consumer Data Act, which would replace PIPEDA, and Bill C-34, the Safe Social Media Act, which includes duties for AI chatbots. Existing law still applies, including PIPEDA, Quebec's Law 25, OSFI Guideline E-23 for federally regulated financial institutions and the federal Directive on Automated Decision-Making.