AI Governance Institute
← News
Corporate Policy2026-07-08

Protiviti's AI Governance Guide Surfaces a Structural Gap: Most Enterprises Still Lack Formal Intake, Inventory, and Committee Controls

What happened

Protiviti released the AI Governance Guide: Risks, ROI & Enterprise Strategy, a structured reference document addressing the most common questions enterprise compliance and risk teams face when standing up or scaling an AI governance program. Published in December 2024, the guide covers four foundational areas: establishing executive leadership accountability for AI, forming an AI governance committee with defined decision rights, creating scalable intake and inventory processes for AI models, and embedding ethical standards into cross-functional collaboration. The document does not carry the force of regulation, but it reflects current practitioner consensus on the minimum structural controls that organizations should have in place. Protiviti positions the guide as applicable to US enterprises across sectors, particularly those that have deployed AI tools without yet formalizing oversight mechanisms.

Why it matters

  • ·Regulatory exposure: US federal and state regulators, including the FTC and emerging state-level frameworks in Colorado, Texas, and California, are increasingly scrutinizing whether organizations can demonstrate structured AI oversight, making the absence of a formal governance committee or model inventory a documented liability.
  • ·Operational impact: Without a scalable AI intake and model inventory process, compliance teams cannot answer basic audit questions about which AI systems are in use, who approved them, or what risks they carry, creating material gaps in any compliance program.
  • ·Organizational risk: Diffuse executive accountability for AI outcomes, where no named leader or committee owns AI governance, leaves organizations unable to escalate incidents, enforce policy, or demonstrate board-level oversight to auditors, investors, or regulators.

Governance controls affected

BRD-002AI Governance Committee Charter and Decision RightsBRD-006AI Risk Tolerance and Appetite DocumentationBRD-010AI Governance Committee Operating Cadence and Membership LifecycleHOC-001AI System Risk ClassificationHOC-007Board AI Risk Reporting and Escalation ThresholdsMGV-002AI System Intake and Approval Workflow

What to do now

  • ☐Audit whether your organization has a formally chartered AI governance committee with documented decision rights, membership, and escalation paths, and close any gaps against the committee structure Protiviti recommends.
  • ☐Review your current AI model intake process to confirm it captures all deployed models, including third-party and shadow AI tools, and assigns a risk classification to each at the point of intake.
  • ☐Confirm that a named executive or senior leadership function holds documented accountability for AI governance outcomes, separate from IT or legal ownership alone.
  • ☐Map your existing AI inventory against your ethics and acceptable use policies to identify models or use cases that have never been formally reviewed against those standards.
  • ☐Use the guide's committee and intake framework as a baseline for a maturity gap assessment, then prioritize the three or four structural controls most likely to be requested by regulators or auditors in the next 12 months.

What to watch next

Compliance teams should monitor how state-level AI governance requirements in Colorado, Texas, and California begin to prescribe specific committee structures, inventory obligations, or executive accountability standards, since voluntary frameworks like this one often anticipate what becomes mandatory. The FTC's continued AI enforcement activity and the SEC's evolving expectations for AI risk disclosure to investors are also likely to create pressure for the exact structural controls Protiviti describes. Practitioners building governance programs should track whether ISO 42001 certification begins to emerge as a de facto audit benchmark that regulators or procurement counterparties reference, which would raise the stakes for organizations that have not yet formalized their committee and intake controls.

Stay ahead of stories like this

Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Enforcement2026-09-22

NY Comptroller Audit Finds SUNY Lacked AI Definition, Inventory, or Approval Workflows

New York State Comptroller Thomas DiNapoli released an audit finding that SUNY Administration had no effective AI governance framework, no standard definition of AI, and no documented policies or approval workflows for AI development and use. The audit identified specific weaknesses in inventory management, policy controls, and internal accountability. The findings create a public-sector governance benchmark that compliance teams in both government and regulated industries should treat as a checklist.

Research2026-09-15

McKinsey's Banking AI Risk Blueprint Sets a Model Governance Benchmark

McKinsey has published a practitioner operating model for AI model risk management in banking. The guide covers risk appetite, use-case taxonomy, model tiering, approval thresholds, independent validation, and portfolio monitoring. Compliance teams at banks and financial institutions can use it to benchmark and extend existing model risk programs to cover AI.

Research2026-09-15

IBM Study: AI Models Miss Physical Harm Risk When Flying Drones

IBM has summarized new research showing that AI models can generate code to operate a simulated drone while failing to account for crash risk or harm to people. The study identifies a structural gap between software-benchmark performance and physical-world safety. The findings carry direct implications for deployment approval and safety evaluation programs for any AI system that interacts with the physical environment.