How to run AI governance at scale
Find answers to the AI governance questions your team faces. These guides give compliance officers, lawyers, GRC teams, and risk managers the steps to put each control in place.
Compare AI governance tools by control domain when you need software. Use the AI governance maturity model to assess your program.
Get the free AI Governance Control Tracker
Get the free Excel tracker for all 136 governance controls. Score maturity, assign owners, and set deadlines, with EU AI Act, NIST and ISO 42001 coverage on a dashboard.
- 136 controls in Excel
- Score maturity and assign owners
- Track deadlines and regulation coverage
Includes AI Governance Weekly every Thursday. Unsubscribe anytime.
How do we inventory and classify AI systems by risk level?
Catalog your AI tools, including shadow AI. Assess each system’s data sensitivity, decision impact, and regulatory exposure.
Who owns AI governance within the organization?
Assign AI governance responsibilities across Legal, IT, Risk, and any dedicated AI function. Document who approves decisions and handles escalations.
What are our obligations under emerging AI regulations?
Map AI compliance requirements across EU rules, US executive orders, SEC guidance, and sector regulations.
What does meaningful human oversight look like for high-risk AI decisions?
Define human review responsibilities and the level of oversight required. Keep records showing how reviewers meet those requirements.
How should employees be trained on acceptable AI use?
Set rules for approved tools, permitted input data, and AI-assisted work in regulated industries.
How do we document AI decision-making for auditability?
Use logs, version control, and model cards to explain AI decisions when regulators or litigants request evidence.
How do we ensure human-in-the-loop review is actually effective?
Design oversight that counters automation bias. Give reviewers authority and practical ways to override AI decisions.
What is our explainability standard for AI decisions?
Match transparency requirements to system risk. Build the technical tools and review procedures needed to meet them.
Do we have a complete AI inventory?
Maintain a registry of AI tools, including shadow AI found through procurement reviews, network checks, and employee surveys.
How does the EU AI Act affect our global operations?
Assess how EU requirements affect organizations outside Europe. Decide whether to use its risk-based approach as a global internal standard.
How do we apply a three lines of defense model to AI risk?
Adapt the three lines of defense to AI. Assign business ownership, risk oversight, and independent assurance responsibilities.
How do we comply with the EU AI Act?
Work through EU AI Act classification, high-risk obligations, GPAI requirements, and phased enforcement dates.
What does AI governance look like for a company with under 50 employees?
Build a startup governance program around essential protections. Keep the process manageable for an early-stage team.
How do we perform an AI risk assessment?
Assess data sensitivity, decision impact, and regulatory exposure before deployment. Match controls to each system’s risk level.
What AI regulations apply to a US-based SaaS company?
Identify federal, state, and international AI requirements for a US SaaS business. Map obligations by use case and customer location.
How do we build an AI governance program from scratch?
Start an AI governance program with a system inventory. Follow the steps through to ongoing operations.
How do we audit an AI system for compliance?
Audit an individual AI system for compliance. Review evidence and write findings that give owners specific remediation work.
How do we report AI risk to the board and audit committee?
Choose what AI risks to report to the board and how often. Set thresholds for urgent notification between scheduled reports.
How do we build and maintain a multi-framework AI risk register?
Combine AI risks from the EU AI Act, NIST AI RMF, GDPR, ISO 42001, and sector rules. Retain framework-specific requirements.
How do we engage regulators and standards bodies proactively on AI governance?
Engage regulators through consultations, standards work, and direct dialogue. Use those channels to contribute to emerging AI governance requirements.
How do we build director-level AI literacy for effective board oversight?
Give board directors enough AI knowledge to question management, assess risks, and carry out oversight without technical expertise.
How do we comply with China's AI regulations?
Review requirements for AI services accessible in China. Cover CAC regulation, security assessments, content labels, and differences from Western approaches.