How to run AI governance at scale
A practical guide for compliance officers, general counsel, GRC teams, and risk managers navigating the operational realities of enterprise AI governance. Questions every compliance team needs to answer.
Not sure where to start? Answer 3 questions and get a tailored compliance action plan.
What applies to me? →How do we inventory and classify AI systems by risk level?
A framework for cataloging all AI tools in use, including shadow AI, and assessing risk based on data sensitivity, decision impact, and regulatory exposure.
Who owns AI governance within the organization?
Defining accountability for AI governance, whether in Legal, IT, Risk, or a dedicated AI ethics function, and establishing clear escalation paths.
What are our obligations under emerging AI regulations?
Tracking the EU AI Act, U.S. executive orders, SEC guidance, and sector-specific rules to understand what AI compliance actually requires.
What does meaningful human oversight look like for high-risk AI decisions?
Defining what "in the loop" means in practice, what level of review satisfies regulatory standards, and how to document it.
How should employees be trained on acceptable AI use?
Covering what tools are approved, what data can be input, and how to handle AI-assisted work product in regulated industries.
How do we document AI decision-making for auditability?
Meeting regulatory and litigation demands for explainability through logging, version control, and model cards.
How do we ensure human-in-the-loop review is actually effective?
Moving beyond checkbox approval to build oversight protocols that counter automation bias and give reviewers genuine authority to override AI decisions.
What is our explainability standard for AI decisions?
Defining how much transparency is required at different risk levels, and building the technical and procedural infrastructure to deliver it.
Do we have a complete AI inventory?
Building and maintaining a centralized registry of every AI tool in use, including shadow AI discovered through procurement, network, and employee channels.
How does the EU AI Act affect our global operations?
Understanding the Brussels Effect on non-EU organizations, and evaluating whether to adopt the EU risk-based framework as a global internal standard.
How do we apply a three lines of defense model to AI risk?
The three lines of defense model translates directly to AI governance, with first-line business ownership, second-line risk oversight, and third-line independent assurance each requiring AI-specific adaptations.
How do we comply with the EU AI Act?
A step-by-step compliance guide covering risk tier classification, high-risk system obligations, GPAI model requirements, and the phased enforcement timeline.
What does AI governance look like for a company with under 50 employees?
A lean governance framework for startups that covers the essentials without the overhead — focused on what actually protects you at an early stage.
How do we perform an AI risk assessment?
A practical methodology for assessing AI system risk before deployment, covering data sensitivity, decision impact, regulatory exposure, and the controls each risk level requires.
What AI regulations apply to a US-based SaaS company?
Mapping the federal, state, and international AI regulatory requirements that apply to US SaaS companies offering AI features, based on use case and customer location.
How do we build an AI governance program from scratch?
A sequenced guide to standing up an AI governance program — from initial inventory through ongoing operations — for organizations that are starting with nothing.
How do we audit an AI system for compliance?
A methodology for conducting compliance audits of individual AI systems — what to review, what evidence to collect, and how to write findings that actually drive remediation.
How do we report AI risk to the board and audit committee?
A structured approach to surfacing material AI risk at the board level — defining what to report, how often, and what escalation thresholds trigger immediate notification outside the normal cycle.
How do we build and maintain a multi-framework AI risk register?
A practical approach to consolidating AI risks from multiple regulatory frameworks (EU AI Act, NIST AI RMF, GDPR, ISO 42001, sector-specific) into a single, actionable risk register — without duplicating effort or missing framework-specific requirements.
How do we engage regulators and standards bodies proactively on AI governance?
A framework for organizations that want to move beyond reactive compliance — engaging regulators through comment processes, standards participation, and direct dialogue to shape governance requirements and demonstrate good-faith leadership.
How do we build director-level AI literacy for effective board oversight?
A practical program for developing the baseline AI knowledge board directors need to ask the right questions, evaluate management's risk assessments, and fulfill fiduciary oversight obligations — without requiring technical expertise.
How do we comply with China's AI regulations?
A compliance guide for organizations deploying AI systems accessible to users in China — covering the four-layer regulatory stack administered by the CAC, security assessment obligations, content labeling requirements, and the practical differences between China's framework and Western AI governance regimes.
New guidance, every week
We publish practical guidance as governance questions come up in the field — plus everything else changing in AI regulation. Every Thursday.