AI governance

AI governance is how an organisation keeps its use of AI under control: which AI tools staff may use and for what, what data may go into them, who checks the output and who is responsible when something goes wrong. In the EU the AI Act adds legal duties that depend on how risky a use is. Software that screens job applicants, for example, falls under strict rules.

What does it look like in practice?

The US standards institute NIST published its AI Risk Management Framework in January 2023, for voluntary use. It divides the work into four functions: govern, map, measure and manage. Under govern it lists, among other things, understanding the legal requirements, keeping an inventory of AI systems and documenting who is responsible for what; under manage, a process for reporting and handling incidents. ISO/IEC 42001 (December 2023) is the international standard with requirements for an AI management system, for organisations that provide or use AI.

What does the EU AI Act require?

The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. The European Commission describes four risk levels:

• Unacceptable risk: banned, such as social scoring or emotion recognition at work. These bans apply since 2 February 2025; a ninth ban, on AI that generates non-consensual sexual content or child sexual abuse material, follows on 2 December 2026.
• High risk, such as CV screening in recruitment or credit scoring of individuals: strict duties for the maker and for the business that uses the system, which must follow the instructions for use and let competent people oversee it.
• Transparency risk: people must be told when they talk to a chatbot, unless that is obvious, and AI-generated content must be recognisable. These rules apply since 2 August 2026.
• Minimal risk, such as spam filters: no specific rules. According to the Commission, most AI in use in the EU falls here.

Since 2 February 2025 every business that uses AI in its work also has a duty on AI literacy. The original text asked it to ensure, to its best extent, a sufficient level of AI knowledge among its staff. Fines for banned practices go up to €35 million or 7% of worldwide annual turnover; for SMEs the lower amount counts.

The AI Omnibus (Regulation (EU) 2026/1744), in force since 27 July 2026, moved the high-risk rules to 2 December 2027, and to 2 August 2028 for AI in products such as lifts or toys. It also softened the literacy duty: businesses must take measures that support their staff's AI literacy, without having to guarantee a level.

Example

Suppose a web shop with twelve employees answers customer questions with a chatbot and lets an AI tool pre-sort job applications. Its governance fits on one page: both tools listed, a rule on which customer data may go into them, a named owner, and a staff member who reads a sample of chatbot conversations every week. The chatbot has to make clear that it is an AI system. The application tool counts as high-risk; for such systems, duties for the user apply from 2 December 2027, such as following the instructions for use and having a competent person oversee it (human-in-the-loop).

And outside the EU?

In the United States, Executive Order 14110 on safe, secure and trustworthy AI (30 October 2023) was revoked on 20 January 2025. The NIST framework remains available as voluntary guidance.