Running an AI governance programme
Bring it together into a working programme — one that keeps AI safe and compliant without slowing the organisation down.
Learning objectives
- Design an AI policy stack
- Embed governance gates in the AI lifecycle
- Plan monitoring and AI incident management
- Choose assurance activities and governance metrics
- Plan a 90-day governance launch
6.1 The policy stack
| Document | Purpose | Audience |
|---|---|---|
| AI policy | Principles, risk appetite, roles, governance process, prohibited uses | Whole organisation |
| Acceptable use policy for generative AI | Approved tools; what data may be used; disclosure; verification | All staff |
| AI development / procurement standard | Lifecycle requirements: assessments, testing, documentation, approval gates | Builders and buyers |
| Procedures and templates | Inventory form, impact assessment, model card, vendor questionnaire | Practitioners |
6.2 Lifecycle gates
Embed governance into the processes teams already use — product development, procurement, change management — with clear gates:
- Intake: register the use case; initial risk tiering.
- Design approval: impact assessments; data and fairness plans; oversight design.
- Pre-deployment: test results against acceptance criteria; documentation complete; go/no-go by the right authority for the tier.
- Post-deployment: monitoring, periodic review and re-assessment after significant changes.
- Retirement: decommissioning, data handling and record-keeping.
6.3 Monitoring
AI systems change — data drifts, vendors update models, users find new ways to use them. Monitor:
- Performance: accuracy, error rates, drift
- Fairness: outcomes by group
- Usage: is it used as intended? Are humans overriding it (too much or too little)?
- Incidents and complaints
- Vendor changes to underlying models
6.4 Incident management
Define what an AI incident is (e.g. harmful output, discriminatory outcome, data leak, security compromise, significant malfunction), how to report it, who triages it, and when to pause or roll back a system. Integrate with existing incident, privacy-breach and security processes. Under the EU AI Act, providers of high-risk systems must report serious incidents to authorities, and deployers must inform providers.
6.5 Assurance and audit
- Internal audit of the governance programme and of high-risk systems
- External assurance — ISO/IEC 42001 certification, independent algorithmic audits, conformity assessment for EU high-risk systems
- Management review — regular reporting to the executive and board
6.6 Metrics that matter
| Area | Example metrics |
|---|---|
| Coverage | % of known AI systems in the inventory with an owner and risk tier |
| Process | % of high-risk systems with completed assessments; average time through review |
| People | % of staff who completed AI literacy training |
| Outcomes | Incidents by severity; fairness gaps; complaints about AI decisions |
| Third parties | % of AI vendors with completed due diligence |
6.7 A 90-day starter roadmap
| Days | Actions |
|---|---|
| 0–30 | Executive sponsor; cross-functional working group; generative AI acceptable use policy and approved tools; start the inventory |
| 31–60 | Risk-tiering scheme; impact assessment template; vendor questionnaire; classify inventory; identify any prohibited or high-risk uses |
| 61–90 | AI policy approved; governance committee running; AI literacy training launched; gap analysis against EU AI Act and ISO/IEC 42001; roadmap for the next year |
6.8 Culture
Governance succeeds when people see it as helping them ship safely, not blocking them. Make the process fast for low-risk uses, explain the "why", celebrate teams that raise issues early, and make it safe for anyone to report concerns.
For your organisation (or one you know), score 1–5 on: inventory; policy; roles; risk tiering; impact assessment; vendor due diligence; testing and monitoring; incident management; training; assurance. Pick the three lowest scores and write one concrete action for each in the next 90 days.
Key takeaways
- Policy, acceptable use policy, lifecycle standard, procedures and templates.
- Gates at intake, design, pre-deployment, post-deployment and retirement.
- Monitor performance, fairness, usage, incidents and vendor changes.
- Define and rehearse AI incident response.
- Measure coverage, process, people, outcomes and third parties — and build a culture that helps teams ship safely.