AI Governance Institute
← News
Research2026-08-17

Keyrus 2026 Guide Sets a Baseline Operating Model for AI Governance Programs

What happened

Keyrus published AI in 2026: How to Build Trustworthy, Safe and Governed AI Systems, a practitioner guide designed to help enterprise compliance and risk teams build or mature their AI governance programs. The guide identifies four structural pillars: an AI system inventory, a risk prioritization framework, cross-functional governance ownership, and third-party oversight for vendor-supplied models. It recommends pairing governance workflows with runtime monitoring, documentation standards, and continuous feedback loops. The guidance is global in scope and is not tied to a specific regulatory jurisdiction, though its operating model maps closely to requirements emerging under frameworks such as ISO/IEC 42001:2023 and the EU AI Act. The guide arrives as a growing body of practitioner research, including the KPMG-UTS case study, is converging on the same foundational gaps in enterprise AI governance.

Why it matters

  • ·An AI inventory is increasingly a regulatory prerequisite, not a best practice. Regulators under the EU AI Act, several US state laws, and ISO/IEC 42001:2023 expect organizations to demonstrate they know what AI systems they operate and at what risk level, making a complete inventory the first control auditors will probe.
  • ·Third-party and vendor-supplied model risk remains one of the least-governed areas in enterprise AI programs. The Keyrus guide calls for structured vendor oversight as a core program element, a gap also identified in incidents such as the KPMG model risk framing, where vendor models sitting inside existing workflows often escape the scrutiny applied to internally developed systems.
  • ·Cross-functional governance structures are becoming an audit expectation, not an organizational preference. Without a defined committee with documented decision rights and membership, compliance teams cannot demonstrate consistent accountability when an AI incident occurs or a regulator requests evidence of oversight.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

BRD-002AI Governance Committee Charter and Decision RightsHOC-001AI System Risk ClassificationMGV-004Continuous AI Assurance Function DesignMON-001AI Performance BaselineMON-005Continuous Model EvaluationPRC-001AI Vendor Due Diligence

What to do now

  • ☐Conduct a gap assessment against the four pillars in the Keyrus guide: inventory completeness, risk prioritization methodology, governance team structure, and vendor model oversight coverage.
  • ☐Verify that your AI system inventory includes vendor-supplied and embedded models, not only internally developed systems, and confirm each entry has an assigned risk classification.
  • ☐Review your cross-functional governance committee charter against the guide's cross-functional ownership model to confirm it defines decision rights, escalation paths, and accountability for AI incidents.
  • ☐Map your current runtime monitoring controls to the guide's continuous feedback loop requirement and identify systems that have no post-deployment performance or drift monitoring in place.
  • ☐Update third-party AI risk assessments to require vendor disclosure of model updates, safety commitments, and incident notification timelines as a contract condition.

What to watch next

Compliance teams should monitor whether upcoming enforcement actions under the EU AI Act begin to cite incomplete inventories or absent cross-functional governance bodies as deficiencies, as this would convert the Keyrus guide's recommendations into de facto regulatory expectations. Certification activity under ISO/IEC 42001:2023 is also worth tracking, since auditors are beginning to develop consistent interpretations of what a conforming governance operating model looks like in practice. As more practitioner frameworks converge on the same baseline elements, organizations that cannot document a structured program will face growing pressure from both regulators and counterparties in procurement and audit contexts.

Related Coverage

Research2026-10-30

75% of IT Leaders Say Compliance Constrains AI Scale, Cloudera Survey Finds

A Cloudera survey of enterprise IT leaders found that 75% view governance and compliance as a constraint on scaling AI, while 55% reported governance costs grew faster than expected. The findings expose a structural gap between how fast AI is being deployed and how well organizations have planned the programs that govern it. The survey covered AI inventory, regulatory mapping, model risk controls, data sovereignty, and third-party oversight.

Corporate Policy2026-11-04

Google's AI Bundling Threat to Schools Exposes Coercive Adoption Risk

Google told K-12 schools they would lose Google Search access unless they opted in to AI features. This bundled essential service access with Gemini adoption. The plan drew antitrust criticism from lawmakers and former Federal Trade Commission Chair Lina Khan, who cited existing court findings of Google's monopoly liability. Following swift backlash, Google revised the plan so that Gemini, Gemini Notebook, and Search would each be off by default and independently switchable.

Research2026-11-03

1,000+ AI Rules, One Audit Gap: Runtime Evidence Is What Regulators Want

Openlayer's Country-by-Country AI Regulation Guide maps more than 1,000 AI policy initiatives across 72 countries. It finds that regulators worldwide are converging on the same core requirements: risk classification, human oversight, transparency, post-market monitoring, and version-linked documentation. The critical finding for compliance teams is that audit readiness now requires evidence that controls operated during live production use, not just that they were designed.