How to run AI governance at scale
Find answers to the AI governance questions your team faces. These guides give compliance officers, lawyers, GRC teams, and risk managers the steps to put each control in place.
Compare AI governance tools by control domain when you need software. Use the AI governance maturity model to assess your program.
Get the free AI Governance Control Tracker
Get the free Excel tracker for all 136 governance controls. Score maturity, assign owners, and set deadlines, with EU AI Act, NIST and ISO 42001 coverage on a dashboard.
- 136 controls in Excel
- Score maturity and assign owners
- Track deadlines and regulation coverage
Includes AI Governance Weekly every Thursday. Unsubscribe anytime.
What are our obligations under emerging AI regulations?
Map AI compliance requirements across EU rules, US executive orders, SEC guidance, and sector regulations.
How do we maintain data privacy compliance when using AI?
Review training data sources, data minimization, cross-border transfers, and applicable explanation duties under GDPR and the California Consumer Privacy Act (CCPA).
Is our training data compliant with global privacy laws?
Check rights to training data and identify personal information in datasets. Review GDPR and EU AI Act data obligations.
How do we handle intellectual property and copyright in AI?
Review ownership of AI-generated work, copyright exposure from training data, and contractual protections for AI-assisted outputs.
What does AI governance look like for a company with under 50 employees?
Build a startup governance program around essential protections. Keep the process manageable for an early-stage team.
What AI regulations apply to a US-based SaaS company?
Identify federal, state, and international AI requirements for a US SaaS business. Map obligations by use case and customer location.
How do we build an AI governance program from scratch?
Start an AI governance program with a system inventory. Follow the steps through to ongoing operations.
What AI documentation do we actually need?
Identify legally required AI documentation by risk tier. Distinguish those duties from useful voluntary records and unnecessary paperwork.
How do we intake and govern open-weight and self-hosted AI models?
Review open-weight models before downloading, fine-tuning, or self-hosting them. Set deployment and maintenance controls suited to those responsibilities.
How do we map AI compliance obligations across multiple jurisdictions?
Map overlapping AI obligations across jurisdictions and resolve conflicts. Build a coordinated program around the strictest applicable requirements.
How do we govern our AI supply chain and manage upstream model dependencies?
Review upstream AI dependencies, including foundation models, datasets, development tools, and compute infrastructure. Treat them as supply chain components.
How do we comply with China's AI regulations?
Review requirements for AI services accessible in China. Cover CAC regulation, security assessments, content labels, and differences from Western approaches.