What AI governance is
Every organisation using AI needs to know what AI it has, who's responsible, and how risks are managed. That's AI governance.
Learning objectives
- Define AI governance and the questions it answers
- Explain why AI governance is urgent now
- Compare centralised, federated and decentralised operating models
- Describe key governance roles
- Apply the three lines model to AI
1.1 What AI governance is
AI governance is the system of structures, policies, processes and controls an organisation uses to make sure its AI is developed, procured and used in line with its values, its risk appetite and the law. IBM puts it simply: the processes, standards and guardrails that help ensure AI systems are safe and ethical.
Governance answers practical questions:
- What AI are we using, and where? (inventory)
- Which uses are acceptable, and which are not? (policy and risk appetite)
- Who decides, and who is accountable? (roles and decision rights)
- How do we assess and manage risks before and after launch? (risk management)
- How do we show we're compliant? (documentation, assurance and audit)
1.2 Why now
- AI is everywhere: it arrives through new features in existing software, staff using generative AI tools, and vendors — not just in-house data science projects.
- Regulation is arriving: the EU AI Act's obligations are phasing in through 2028; regulators worldwide are applying existing laws to AI.
- Customers and partners ask: procurement questionnaires increasingly ask about AI governance, and certifications such as ISO/IEC 42001 are becoming a differentiator.
- Risk is real: data leakage, discrimination, inaccurate outputs, IP infringement, security vulnerabilities and reputational damage.
1.3 Governance enables, not just restricts
Good governance makes it easier to use AI: clear rules mean teams know what's allowed, low-risk uses go through quickly, and leaders can approve ambitious projects with confidence. The aim is proportionate governance — light-touch for low-risk uses, rigorous for high-risk ones.
1.4 Operating models
| Model | How it works | Suits |
|---|---|---|
| Centralised | A central AI governance team reviews and approves all AI uses | Smaller organisations, early stages, highly regulated sectors |
| Federated (hub and spoke) | A central hub sets standards and handles high-risk cases; business units have trained "spokes" who handle routine reviews | Larger, diverse organisations — the most common mature model |
| Decentralised | Each business unit governs its own AI against shared principles | Rare; risks inconsistency |
1.5 Key roles
| Role | Responsibilities |
|---|---|
| Board / executive sponsor | Sets AI strategy and risk appetite; receives reporting; ultimately accountable |
| AI governance committee or council | Cross-functional body (legal, risk, privacy, security, technology, business, HR) that sets policy and reviews high-risk cases |
| Head of AI governance / responsible AI lead | Runs the programme day to day |
| AI system owner | Accountable for a specific system throughout its life |
| Builders and buyers | Follow lifecycle requirements; document and test |
| Internal audit | Independent assurance that governance works |
1.6 The three lines model
Many organisations map AI governance onto the Institute of Internal Auditors' three lines model:
- First line: teams that build, buy and use AI own and manage its risks.
- Second line: risk, compliance, privacy and security functions set frameworks, advise and challenge.
- Third line: internal audit provides independent assurance to the board.
Key takeaways
- Governance covers inventory, policy, roles, risk management and assurance.
- AI arrives through vendors and features, not just in-house projects.
- Good governance is proportionate — and speeds up safe adoption.
- Federated hub-and-spoke models are common in larger organisations.
- First line owns risk; second line advises and challenges; third line assures.