How to run AI governance at scale
Find answers to the AI governance questions your team faces. These guides give compliance officers, lawyers, GRC teams, and risk managers the steps to put each control in place.
Compare AI governance tools by control domain when you need software. Use the AI governance maturity model to assess your program.
Get the free AI Governance Control Tracker
Get the free Excel tracker for all 132 governance controls. Score maturity, assign owners, and set deadlines, with EU AI Act, NIST and ISO 42001 coverage on a dashboard.
- 132 controls in Excel
- Score maturity and assign owners
- Track deadlines and regulation coverage
Includes AI Governance Weekly every Thursday. Unsubscribe anytime.
How do we inventory and classify AI systems by risk level?
Catalog your AI tools, including shadow AI. Assess each system’s data sensitivity, decision impact, and regulatory exposure.
Who owns AI governance within the organization?
Assign AI governance responsibilities across Legal, IT, Risk, and any dedicated AI function. Document who approves decisions and handles escalations.
What are our obligations under emerging AI regulations?
Map AI compliance requirements across EU rules, US executive orders, SEC guidance, and sector regulations.
How do we maintain data privacy compliance when using AI?
Review training data sources, data minimization, cross-border transfers, and applicable explanation duties under GDPR and the California Consumer Privacy Act (CCPA).
Do we have a complete AI inventory?
Maintain a registry of AI tools, including shadow AI found through procurement reviews, network checks, and employee surveys.
How do we govern AI agents that take autonomous actions?
Govern agents that browse websites, execute code, send messages, and use external services. Set controls for their autonomous actions.
What does audit-ready AI documentation look like in practice?
Keep evidence of responsible AI development, deployment, and monitoring. Prepare for regulatory scrutiny, board questions, and litigation throughout the lifecycle.
How do we perform an AI risk assessment?
Assess data sensitivity, decision impact, and regulatory exposure before deployment. Match controls to each system’s risk level.
How do we build an AI governance program from scratch?
Start an AI governance program with a system inventory. Follow the steps through to ongoing operations.
What do we do when an AI system causes harm or fails?
Respond to AI failures through detection, containment, investigation, and regulatory notification. Use findings to prevent recurrence.
How do we prepare for AI regulation over the next 12 months?
Identify regulations becoming enforceable in your jurisdictions over the next year. Assess gaps and fund a remediation plan.
How do we report AI risk to the board and audit committee?
Choose what AI risks to report to the board and how often. Set thresholds for urgent notification between scheduled reports.