How to run AI governance at scale
Find answers to the AI governance questions your team faces. These guides give compliance officers, lawyers, GRC teams, and risk managers the steps to put each control in place.
Compare AI governance tools by control domain when you need software. Use the AI governance maturity model to assess your program.
Get the free AI Governance Control Tracker
Get the free Excel tracker for all 136 governance controls. Score maturity, assign owners, and set deadlines, with EU AI Act, NIST and ISO 42001 coverage on a dashboard.
- 136 controls in Excel
- Score maturity and assign owners
- Track deadlines and regulation coverage
Includes AI Governance Weekly every Thursday. Unsubscribe anytime.
What does meaningful human oversight look like for high-risk AI decisions?
Define human review responsibilities and the level of oversight required. Keep records showing how reviewers meet those requirements.
How does the EU AI Act affect our global operations?
Assess how EU requirements affect organizations outside Europe. Decide whether to use its risk-based approach as a global internal standard.
What is our process for model drift monitoring?
Assign owners and review schedules for deployed models. Monitor performance degradation, changes in behavior, and emerging bias.
How do we govern AI agents that take autonomous actions?
Govern agents that browse websites, execute code, send messages, and use external services. Set controls for their autonomous actions.
How do we apply a three lines of defense model to AI risk?
Adapt the three lines of defense to AI. Assign business ownership, risk oversight, and independent assurance responsibilities.
How do we comply with the EU AI Act?
Work through EU AI Act classification, high-risk obligations, GPAI requirements, and phased enforcement dates.
How do we build an AI governance program from scratch?
Start an AI governance program with a system inventory. Follow the steps through to ongoing operations.
What do we do when an AI system causes harm or fails?
Respond to AI failures through detection, containment, investigation, and regulatory notification. Use findings to prevent recurrence.
How do we prepare for AI regulation over the next 12 months?
Identify regulations becoming enforceable in your jurisdictions over the next year. Assess gaps and fund a remediation plan.
How do we report AI risk to the board and audit committee?
Choose what AI risks to report to the board and how often. Set thresholds for urgent notification between scheduled reports.
How do we map AI compliance obligations across multiple jurisdictions?
Map overlapping AI obligations across jurisdictions and resolve conflicts. Build a coordinated program around the strictest applicable requirements.
How do we govern AI models from preview release through retirement?
Govern models from preview evaluation through production approval and retirement. Define reassessment triggers throughout their working life.
How do we build and maintain a multi-framework AI risk register?
Combine AI risks from the EU AI Act, NIST AI RMF, GDPR, ISO 42001, and sector rules. Retain framework-specific requirements.
How do we engage regulators and standards bodies proactively on AI governance?
Engage regulators through consultations, standards work, and direct dialogue. Use those channels to contribute to emerging AI governance requirements.
How do we comply with China's AI regulations?
Review requirements for AI services accessible in China. Cover CAC regulation, security assessments, content labels, and differences from Western approaches.