Keyrus 2026 Guide Sets a Baseline Operating Model for AI Governance Programs

What happened

Why it matters

• ·An AI inventory is increasingly a regulatory prerequisite, not a best practice. Regulators under the EU AI Act, several US state laws, and ISO/IEC 42001:2023 expect organizations to demonstrate they know what AI systems they operate and at what risk level, making a complete inventory the first control auditors will probe.
• ·Third-party and vendor-supplied model risk remains one of the least-governed areas in enterprise AI programs. The Keyrus guide calls for structured vendor oversight as a core program element, a gap also identified in incidents such as the KPMG model risk framing, where vendor models sitting inside existing workflows often escape the scrutiny applied to internally developed systems.
• ·Cross-functional governance structures are becoming an audit expectation, not an organizational preference. Without a defined committee with documented decision rights and membership, compliance teams cannot demonstrate consistent accountability when an AI incident occurs or a regulator requests evidence of oversight.

Governance controls affected

What to do now

• ☐Conduct a gap assessment against the four pillars in the Keyrus guide: inventory completeness, risk prioritization methodology, governance team structure, and vendor model oversight coverage.
• ☐Verify that your AI system inventory includes vendor-supplied and embedded models, not only internally developed systems, and confirm each entry has an assigned risk classification.
• ☐Review your cross-functional governance committee charter against the guide's cross-functional ownership model to confirm it defines decision rights, escalation paths, and accountability for AI incidents.
• ☐Map your current runtime monitoring controls to the guide's continuous feedback loop requirement and identify systems that have no post-deployment performance or drift monitoring in place.
• ☐Update third-party AI risk assessments to require vendor disclosure of model updates, safety commitments, and incident notification timelines as a contract condition.

What to watch next

Compliance teams should monitor whether upcoming enforcement actions under the EU AI Act begin to cite incomplete inventories or absent cross-functional governance bodies as deficiencies, as this would convert the Keyrus guide's recommendations into de facto regulatory expectations. Certification activity under ISO/IEC 42001:2023 is also worth tracking, since auditors are beginning to develop consistent interpretations of what a conforming governance operating model looks like in practice. As more practitioner frameworks converge on the same baseline elements, organizations that cannot document a structured program will face growing pressure from both regulators and counterparties in procurement and audit contexts.