How to run AI governance at scale
A practical guide for compliance officers, general counsel, GRC teams, and risk managers navigating the operational realities of enterprise AI governance. Questions every compliance team needs to answer.
Not sure where to start? Answer 3 questions and get a tailored compliance action plan.
What applies to me? →How do we inventory and classify AI systems by risk level?
A framework for cataloging all AI tools in use, including shadow AI, and assessing risk based on data sensitivity, decision impact, and regulatory exposure.
Who owns AI governance within the organization?
Defining accountability for AI governance, whether in Legal, IT, Risk, or a dedicated AI ethics function, and establishing clear escalation paths.
What are our obligations under emerging AI regulations?
Tracking the EU AI Act, U.S. executive orders, SEC guidance, and sector-specific rules to understand what AI compliance actually requires.
How do we maintain data privacy compliance when using AI?
Addressing training data sourcing, data minimization, cross-border transfers, and the right to explanation under GDPR and CCPA.
Do we have a complete AI inventory?
Building and maintaining a centralized registry of every AI tool in use, including shadow AI discovered through procurement, network, and employee channels.
How do we govern AI agents that take autonomous actions?
Agentic AI systems that can browse the web, execute code, send messages, and interact with external services require governance controls that traditional policy frameworks were never designed to handle.
What does audit-ready AI documentation look like in practice?
Organizations facing regulatory scrutiny, board inquiries, or litigation need to produce evidence that AI systems were built, deployed, and monitored responsibly. Audit readiness is not a documentation exercise. It is an evidence-management discipline built into the AI lifecycle.
How do we perform an AI risk assessment?
A practical methodology for assessing AI system risk before deployment, covering data sensitivity, decision impact, regulatory exposure, and the controls each risk level requires.
How do we build an AI governance program from scratch?
A sequenced guide to standing up an AI governance program — from initial inventory through ongoing operations — for organizations that are starting with nothing.
What do we do when an AI system causes harm or fails?
A structured incident response process for AI failures — from initial detection through containment, root cause investigation, regulatory notification, and prevention.
How do we prepare for AI regulation over the next 12 months?
A forward-looking compliance planning guide: identifying what regulations become enforceable in your jurisdictions over the next year, assessing your current gaps, and building a funded remediation roadmap.
How do we report AI risk to the board and audit committee?
A structured approach to surfacing material AI risk at the board level — defining what to report, how often, and what escalation thresholds trigger immediate notification outside the normal cycle.
New guidance, every week
We publish practical guidance as governance questions come up in the field — plus everything else changing in AI regulation. Every Thursday.