What is AI governance?

AI governance is the set of policies, roles, controls and evidence that lets an organization say what its AI systems do, who is accountable for them, and how that is proven to auditors, regulators and the people affected. It is not an ethics statement and it is not the same thing as regulation. Law, standards and customer contracts set requirements. Governance is how the organization decides which AI it will use, puts a named owner on each system, controls the risk, and keeps the records that show it did so.

What AI governance covers

An AI governance program answers five questions for every AI system in the organization, whether it was built, bought or switched on inside an existing SaaS product:

• What is it and where is it? An inventory of AI systems and use cases, including AI features embedded in tools the organization already licenses, and AI agents.
• Who owns it? A named business owner who is accountable for outcomes, not just a technical contact.
• How risky is it? A classification that drives how much scrutiny the system gets, and an assessment of its impact on people, the organization and compliance.
• What controls apply? Data rules, testing, human oversight, security controls, transparency to affected people, vendor terms.
• Is it working? Monitoring, incident handling, periodic review and the records that prove each of the above.

Scope matters. Governance has to cover the whole lifecycle, from the decision to pursue a use case through procurement or development, deployment, monitoring and retirement. It also has to cover both directions of risk: what the AI might do to people (bias, privacy, safety), and what people or attackers might do to the AI (prompt injection, data poisoning, misuse). The second half is where governance meets AI security.

The definition used in most law and standards now converges on the OECD wording, which the EU AI Act adopts in Article 3(1): a machine-based system that infers from its inputs how to generate outputs such as predictions, content, recommendations or decisions. Ontario's public sector law uses almost the same words. That breadth is deliberate. A spreadsheet macro is out of scope; a vendor's "smart" scoring feature usually is not.

AI governance, responsible AI and AI ethics

The three terms are often used as synonyms. They are different layers.

• AI ethics is the set of values: fairness, autonomy, dignity, harm avoidance. It defines what good looks like.
• Responsible AI is the commitment to build and use AI in line with those values. It is usually expressed as a set of principles.
• AI governance is the machinery that makes the commitment verifiable: decision rights, owners, controls, records and independent assurance.

An organization can publish responsible AI principles and still have no governance. A practical test: for any AI system in production, a record should show who approved it, on what evidence, what it is allowed to do, and when it was last reviewed. Where no such record exists, the principles remain aspiration.

Why AI governance matters

Adoption has outrun control. Netskope's Cloud and Threat Report 2026 found SaaS generative AI users tripled and prompt volume grew sixfold in a year, while 47% of generative AI users still used personal, unmanaged accounts. The average organization recorded 223 incidents a month of users sending sensitive data to AI apps.

Ungoverned AI is now visible in breach data. In IBM's 2025 Cost of a Data Breach study, one in five organizations reported a breach due to shadow AI, organizations with high levels of shadow AI saw breach costs about US$670,000 higher, and 97% of organizations that had an AI-related breach lacked AI access controls. The 2026 edition found more than 20% of organizations reported a breach targeting AI models or applications, most often through compromised APIs, plug-ins or cloud misconfiguration around the model rather than the model itself.

Legal requirements now apply. As of October 2026, the EU AI Act applies in part, several US states regulate specific uses, and Canadian regulators, from OSFI to Ontario's public sector ministry, have set expectations. Each assumes the organization knows what AI it runs and who owns it.

Liability follows the organization, not the tool. In Moffatt v. Air Canada, 2024 BCCRT 149, British Columbia's Civil Resolution Tribunal held the airline responsible for wrong information its website chatbot gave a customer, rejecting the argument that the chatbot was responsible for its own statements. The tribunal applied ordinary negligent misrepresentation law; no AI statute was needed.

Governance speeds adoption. An approved path with pre-cleared tools, data rules and a fast review for low-risk uses removes the main reason staff go around controls.

What are the risks of unregulated AI?

"Unregulated" here means ungoverned inside the organization, whether or not a law applies. The risks fall into six groups:

• Discrimination. Models trained on historical data reproduce historical bias in hiring, lending, insurance and access to services. Disparate impact is unlawful under human rights and anti-discrimination law whether or not a human signed off. See bias in AI systems.
• Privacy and confidentiality. Personal information and trade secrets leave the organization through prompts, file uploads and connectors. Models can also infer sensitive attributes that were never collected. See AI privacy.
• Security. Prompt injection, data poisoning, model theft and insecure plug-ins are now routine attack paths. See AI attacks and the OWASP Top 10 for LLMs.
• Reliability. Fabricated citations, wrong figures and confident errors get relied on because the output reads well. KPMG and the University of Melbourne's 2025 global study found 66% of employees rely on AI output without evaluating its accuracy and 56% have made mistakes in their work because of AI.
• Loss of human control. Automated decisions nobody can explain or overturn, and AI agents acting with more access than intended. See human-in-the-loop.
• Societal effects. Misinformation, deepfake fraud and labour displacement. Organizations do not govern these alone, but their own systems can contribute to them. See AI identity fraud.

The full catalogue is on AI risks.

The principles of AI governance and best practices

Most frameworks converge on the same five principles. They only become governance when each is attached to a control and a record.

Transparency

People should know when they are dealing with AI and, where it matters, how it reached its output. In practice:

• Disclosure. Tell people when they interact with a chatbot or receive AI-generated content. EU AI Act Article 50 has made this a legal duty since 2 August 2026, including labelling deepfakes.
• Documentation. Keep model or system cards: purpose, data sources, known limitations, evaluation results.
• Notice of automated decisions. As of October 2026, Quebec's Law 25 requires it for decisions made exclusively by automated processing, Colorado SB 26-189 will from 1 January 2027, and Canada's Bill C-36 (not yet law) proposes it federally.

More on AI transparency and explainable AI.

Accountability

Every AI system needs a named owner who answers for its outcomes, and a decision record showing who approved it on what evidence.

• Named ownership. A business owner, not "IT" or "the vendor".
• Decision rights. Who can approve a low-risk use, who must approve a high-risk one, who can stop a system.
• Vendor accountability. Contracts that allocate responsibility for training data, incidents, model changes and audit rights.

Accountability cannot be delegated to the tool, as Moffatt v. Air Canada illustrates. More on AI accountability.

Privacy and security

• Data minimization at the prompt. Clear rules on what data classes may go into which tools, enforced with DLP where possible.
• Lawful basis and purpose. Using personal information to train or fine-tune a model is a new purpose under most privacy laws. Consent is one basis, not the only one, and the analysis differs between PIPEDA, Quebec's Law 25 and the GDPR.
• AI-specific security controls. Access control on models and connectors, input and output filtering, red-teaming against prompt injection, logging. The IBM data above shows access control is the most commonly missing one.
• Vendor terms. Whether the provider trains on customer inputs, how long it retains them, and where they are processed.

Fairness and non-discrimination

• Test before deployment. Measure outcomes across protected groups for any system that affects people's access to jobs, credit, housing, insurance or services.
• Monitor after deployment. Fairness drifts as populations and data change.
• Use sensitive data carefully for testing. The EU Omnibus added an Article 4a permitting limited processing of special-category data to detect and correct bias, under strict necessity and safeguards.

Human control and responsibility

Human oversight is widely claimed but often weak in practice. It works only when the reviewer has authority, information, time, competence and safety to disagree. For agents, human control also means hard limits on what the system can do without approval and a tested way to stop it. See human-in-the-loop.

Who owns AI governance: structure and roles

There is no single correct structure, but every working one has these elements:

• Board. Sets risk appetite for AI, approves the policy framework, receives regular reporting on exposure. See AI oversight at board level.
• Executive owner. One accountable executive, often a Chief AI Officer, CRO, CIO or General Counsel. US federal agencies have been required to designate Chief AI Officers since 2024, and OMB M-25-21 (April 2025) kept that requirement.
• AI governance committee. Cross-functional: legal, privacy, security, risk, HR, procurement, data, and the business. It approves high-risk use cases and exceptions, not every chatbot prompt.
• System owners. A named business owner per AI system, accountable for its use, its monitoring and its retirement.
• Second line. Risk and compliance set the standards, challenge the assessments and track issues.
• Third line. Internal audit tests whether the controls work. See AI audit and what IT auditors should know.

A RACI that maps these roles to each lifecycle stage (intake, assessment, approval, deployment, monitoring, retirement) prevents the most common failure: everyone assumes someone else approved it.

The evidence: what auditors and regulators ask for

When an auditor, regulator, customer or certification body asks about AI, they ask for records. A minimum evidence pack:

• AI inventory with owner, purpose, vendor, data classes, risk tier and status for each system and use case.
• Policy set. An AI policy, an AI acceptable use policy, and procurement and development standards.
• Risk and impact assessments for higher-risk systems. ISO/IEC 42005 gives a structure; the EU AI Act requires a fundamental rights impact assessment from certain deployers of high-risk systems.
• Approval records showing who approved each system, when, and against which criteria.
• Testing and evaluation results covering accuracy, bias, robustness and security, before and after deployment.
• Monitoring and incident logs, including override rates where humans review outputs.
• Training and AI literacy records for staff who use or oversee AI.
• Vendor due diligence and contract terms for third-party AI.
• Board and committee reporting showing oversight actually happened.

The AISGRC AI governance scorecard checks a program against this list in about ten minutes.

AI governance frameworks and laws (status as of October 2026)

EU AI Act (binding)

The EU AI Act is a risk-tiered regulation that applies to providers and deployers inside the EU and to those outside it whose AI is placed on the EU market or whose outputs are used in the EU. After the Digital Omnibus (Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026), the timeline is:

Date	What applies	Status (October 2026)
2 February 2025	Prohibited practices (Article 5); AI literacy (Article 4)	Applies
2 August 2025	General-purpose AI (GPAI) model obligations; governance; penalty regime	Applies
2 August 2026	Transparency duties (Article 50); Commission enforcement powers over GPAI providers	Applies
2 December 2026	New prohibition on AI that generates non-consensual intimate imagery or child sexual abuse material; end of the Article 50(2) marking grace period for generative systems already on the market before 2 August 2026	Upcoming
2 August 2027	GPAI models placed on the market before 2 August 2025 must comply	Upcoming
2 December 2027	High-risk obligations for Annex III systems (employment, credit, education, essential services, law enforcement and others)	Upcoming (deferred by the Omnibus)
2 August 2028	High-risk obligations for AI embedded in Annex I regulated products	Upcoming (deferred by the Omnibus)

Three Omnibus changes matter for governance programs. Article 4 was rewritten: providers and deployers must now "take measures to support the development of AI literacy" of their staff, and the text says this does not require guaranteeing any specific level of literacy in any individual (analysis). The duty is softer but still there. Some SME relief was extended to small mid-caps (fewer than 750 employees and under €150 million turnover). And providers relying on the Article 6(3) exemption must still register those Annex III systems, with less information. Fines reach €35 million or 7% of worldwide turnover for prohibited practices.

For GPAI, the Commission's General-Purpose AI Code of Practice (July 2025) gives providers a way to demonstrate compliance with Article 53 and, for models with systemic risk, Article 55. A separate Code of Practice on marking and labelling AI-generated content was finalized in June 2026 and the Commission published final Article 50 guidelines on 20 July 2026 (summary).

NIST AI RMF and the Generative AI Profile (voluntary)

The NIST AI Risk Management Framework (AI 100-1, January 2023) organizes AI risk into four functions: Govern, Map, Measure and Manage. The Generative AI Profile, NIST AI 600-1 (July 2024), adds twelve risks that generative AI creates or worsens, such as confabulation, information integrity and value-chain integration, with suggested actions for each. NIST is revising the RMF under the July 2025 AI Action Plan; as of late September 2026, no revised draft had been published. Related 2025–26 work includes the preliminary draft Cyber AI Profile, NIST IR 8596 (16 December 2025), which maps CSF 2.0 to AI; draft SP 800-53 control overlays for AI systems; and an AI Agent Standards Initiative launched in February 2026 by NIST's Center for AI Standards and Innovation. The implementation guide shows how to apply the RMF in practice.

ISO/IEC 42001 and its companions (certifiable)

ISO/IEC 42001:2023 is the AI management system standard. It is the only one of the major frameworks against which a third party can certify an organization. Two companions arrived in 2025:

• ISO/IEC 42005:2025 (May 2025) gives guidance on AI system impact assessment: what to assess, when, and how to document it.
• ISO/IEC 42006:2025 (July 2025) sets requirements for bodies that audit and certify 42001 management systems. Organizations are not certified against it, but it is the reason to check that a certifier is accredited against it.

ISO/IEC 23894:2023 gives AI-specific risk management guidance aligned to ISO 31000. The framework comparison covers how these fit with OWASP and MITRE ATLAS.

United States

As of October 2026, there is no federal AI statute. EO 14110 was revoked in January 2025, and federal policy since then has favoured acceleration and a single national standard. EO 14365, "Ensuring a National Policy Framework for Artificial Intelligence" (signed 11 December 2025), directed the Attorney General to establish an AI Litigation Task Force to challenge state AI laws, and tied some federal funding to states avoiding "onerous" AI laws. The Department of Justice formalized the task force on 9 January 2026. The White House followed with legislative recommendations for federal preemption in March 2026. As of late September 2026, a federal preemption bill had stalled and none had been enacted, so state laws remain enforceable:

• Colorado SB 26-189 (signed 14 May 2026; operative 1 January 2027) repealed and replaced the original Colorado AI Act (SB 24-205) before it took effect. Enforcement of SB 24-205 had already been barred by a magistrate judge's order of 27 April 2026 in xAI v. Weiser (D. Colo.), a challenge filed on 9 April 2026 in which the US Department of Justice intervened on 24 April, pending a ruling on a preliminary injunction. From 1 January 2027, deployers using automated decision-making technology that materially influences consequential decisions (employment, lending, housing, education, health care, insurance, government services) must give pre-use notice, explain adverse outcomes within 30 days, and offer correction and meaningful human review where commercially reasonable. The duty of care, mandatory impact assessments and risk management program requirements are gone. The Attorney General enforces, with a 60-day cure period.
• Texas TRAIGA (in effect since 1 January 2026) prohibits specific intentional harms such as manipulation toward self-harm, unlawful discrimination and certain sexual content. It gives the Attorney General exclusive enforcement with a 60-day cure and creates a 36-month regulatory sandbox. Substantial compliance with the NIST AI RMF or ISO/IEC 42001 supports an affirmative defence, which makes framework alignment worth documenting.
• California has SB 53 for frontier model developers (from 1 January 2026), CPPA regulations on automated decision-making technology and risk assessments (ADMT duties from 1 January 2027), and Civil Rights Council rules on automated decision systems in employment (from 1 October 2025).
• Employment-specific rules include Illinois's amendment to its Human Rights Act on AI in employment decisions (from 1 January 2026) and New York City's Local Law 144 bias audits for automated employment decision tools.

Canada

As of October 2026, Canada has no federal AI statute. The Artificial Intelligence and Data Act died with Bill C-27 when Parliament was prorogued in January 2025, and the government has said it will not revive it. Instead:

• Bill C-36, the Protecting Privacy and Consumer Data Act, tabled 15 June 2026, would replace Part 1 of PIPEDA, create a right to be informed of automated decision-making, and establish a new federal privacy regulator (ISED backgrounder). Commentators expect a long transition, with in-force dates possibly as late as 2030. Bill C-34, the Safe Social Media Act, tabled 10 June 2026, would impose duties on social media services and AI chatbots, particularly to protect children, including crisis-intervention duties and a ban on chatbots posing as humans. Both bills followed the federal "AI for All" national AI strategy announced on 4 June 2026 by Minister Evan Solomon. As of October 2026, neither bill is law.
• Federal institutions follow the Treasury Board Directive on Automated Decision-Making, whose fourth-review amendments took effect 24 June 2025. They extend scope to internal services, require the Algorithmic Impact Assessment and peer review results to be published before launch, and strengthen bias testing. Pre-existing systems had until 24 June 2026 to comply.
• Ontario's public sector is covered by the Enhancing Digital Security and Trust Act, 2024 (Bill 194), in force since 29 January 2025. It requires public sector entities using AI to inform the public, maintain an accountability framework, manage risk and provide human oversight, with detailed requirements set by regulation and directive.
• Financial institutions face OSFI Guideline E-23 on model risk management, which explicitly covers AI and machine learning models, from 1 May 2027. See AI risk in financial services.
• Quebec's Law 25 already requires notice when a decision is based exclusively on automated processing of personal information.

What are the challenges of implementing AI governance?

Lack of global consensus

There is no single global rulebook, and 2025–26 widened the gaps. The EU regulates by risk tier, the US federal government is pushing to preempt state rules, and Canada is legislating through privacy and online safety law rather than a standalone AI act. International instruments help at the edges: the Council of Europe Framework Convention on AI, which Canada has signed and the European Union ratified on 15 May 2026, had not been confirmed as in force when last checked (September 2026). The common approach is one internal control set mapped to several external regimes, rather than a separate program per jurisdiction. The definitions are close enough (most borrow from the OECD) that one inventory and one risk taxonomy can serve all of them.

Limited expertise and resources

Few organizations have people who understand machine learning, privacy law, security and audit at once, and small organizations rarely have a dedicated AI risk function. Three things help:

• Reuse what exists. Model risk management, privacy impact assessments, third-party risk and change management already cover much of the lifecycle. Extend them rather than building a parallel process.
• Tier the effort. Low-risk uses get a light-touch registration; only high-risk systems get full assessment.
• Invest in AI literacy by role. The EU duty is now framed as measures fitted to roles and context, which matches good practice.

Balancing innovation and regulation

Practical balance points:

• A fast lane for low-risk use cases with pre-approved tools and data classes.
• Sandboxes for experimentation on non-production data. Texas created a 36-month regulatory sandbox, and the EU AI Act requires national AI regulatory sandboxes.
• Proportionality written into the policy so assessment depth matches risk.
• Periodic recalibration as tools and law change. Twice in two years, the EU and Colorado materially changed rules organizations had already started implementing.

Agentic AI and shadow AI

Two 2025–26 shifts strain programs designed for chatbots. AI agents plan and act: they call tools, use credentials and change systems. The OWASP Top 10 for Agentic Applications (December 2025) and Singapore's Model AI Governance Framework for Agentic AI (January 2026) both centre on bounding what an agent can do, keeping humans meaningfully accountable and limiting blast radius. Shadow AI keeps growing as AI arrives inside browsers, office suites and personal accounts. Both call for the inventory to cover agents and connectors as well as models, for least-privilege access, and for an AI acceptable use policy that says what staff may delegate to an agent.

How to start: a 90-day AI governance baseline

1. Days 1–30: find and own. Build the AI inventory (survey, procurement records, SSO and network logs, SaaS feature reviews). Assign an owner to every entry. Publish an interim acceptable use policy and an approved tool list.
2. Days 31–60: classify and assess. Tier systems by risk. Map them to the EU AI Act categories and the US and Canadian rules that apply. Run impact assessments on the high-risk tier, using ISO/IEC 42005 or the NIST AI RMF Map and Measure functions.
3. Days 61–90: control and report. Set the governance committee's terms of reference and decision rights. Put monitoring on high-risk systems. Launch role-based AI literacy training. Deliver the first board report.

What is the future of AI governance?

Four trends are already visible:

• From principles to evidence. Certification against ISO/IEC 42001, accredited under 42006, and audit-ready records are becoming procurement requirements. Customers increasingly ask for the evidence pack, not the ethics statement.
• From models to agents. Governance is shifting from what a model says to what a system is allowed to do: permissions, tool access, approval thresholds and kill switches.
• Convergence with security and privacy. NIST's Cyber AI Profile and the IBM breach data both show AI risk merging into enterprise cyber and data risk. Separate AI committees will increasingly report through existing risk structures.
• Moving legal targets. Further EU guidance and harmonized standards are expected before December 2027, alongside continued US federal and state conflict and Canadian privacy and online safety bills working through Parliament. Programs built on one stable internal control set mapped to changing external rules absorb these changes more easily than programs built regulation by regulation.

Related references

• What is an AI acceptable use policy?
• What is AI accountability?
• What is AI transparency?
• What is explainable AI?
• What is an AI audit?
• AI oversight at board level
• EU AI Act · NIST AI RMF · ISO/IEC 42001

Sources and references

• Regulation (EU) 2024/1689 (Artificial Intelligence Act), EUR-Lex
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex
• European Commission, AI Act policy page
• Law & Technology, "AI literacy: the Digital Omnibus rewrites Article 4"
• Cloud Security Alliance, Article 50 watermarking grace period note
• Faegre Drinker, Commission final Article 50 guidelines and transparency Code of Practice (July 2026)
• NIST AI Risk Management Framework
• NIST AI 600-1, Generative AI Profile
• NIST IR 8596 (preliminary draft), Cyber AI Profile
• ISO/IEC 42005:2025 · ISO/IEC 42006:2025
• Colorado SB26-189 · Fisher Phillips, summary of SB 26-189
• Texas HB 149 (TRAIGA)
• California SB 53 · CPPA regulations
• Executive Order 14365, Federal Register
• White House, National Policy Framework for AI: Legislative Recommendations (March 2026)
• America's AI Action Plan (July 2025) · OMB M-25-21
• Bill C-36 (45-1), first reading · ISED backgrounder
• Canadian Heritage, Bill C-34 backgrounder
• Treasury Board Directive on Automated Decision-Making · 2025 amendments
• Ontario, Enhancing Digital Security and Trust Act
• OSFI Guideline E-23
• Council of Europe Framework Convention on AI · EU ratification (May 2026)
• Moffatt v. Air Canada, 2024 BCCRT 149
• IBM, 2025 Cost of a Data Breach press release · IBM, 2026 press release
• Netskope, Cloud and Threat Report 2026
• KPMG and University of Melbourne, Trust, attitudes and use of AI: a global study 2025
• OWASP Top 10 for Agentic Applications 2026
• Baker McKenzie, Singapore Model AI Governance Framework for Agentic AI