How to run AI governance at scale
Find answers to the AI governance questions your team faces. These guides give compliance officers, lawyers, GRC teams, and risk managers the steps to put each control in place.
Compare AI governance tools by control domain when you need software. Use the AI governance maturity model to assess your program.
Get the free AI Governance Control Tracker
Get the free Excel tracker for all 136 governance controls. Score maturity, assign owners, and set deadlines, with EU AI Act, NIST and ISO 42001 coverage on a dashboard.
- 136 controls in Excel
- Score maturity and assign owners
- Track deadlines and regulation coverage
Includes AI Governance Weekly every Thursday. Unsubscribe anytime.
How do we ensure third-party AI vendors meet our standards?
Review AI vendors for model transparency, data handling, bias testing, and contractual liability for their outputs.
How do we handle AI-generated content and hallucinations?
Assign responsibility for inaccurate AI outputs used in contracts, reports, or customer communications. Set controls to prevent harm.
How should employees be trained on acceptable AI use?
Set rules for approved tools, permitted input data, and AI-assisted work in regulated industries.
How do we maintain data privacy compliance when using AI?
Review training data sources, data minimization, cross-border transfers, and applicable explanation duties under GDPR and the California Consumer Privacy Act (CCPA).
Is our training data compliant with global privacy laws?
Check rights to training data and identify personal information in datasets. Review GDPR and EU AI Act data obligations.
Is our AI red-teaming rigorous enough?
Set pass/fail criteria for testing high-risk AI before deployment. Cover toxicity, data leakage, jailbreaking, and misuse.
How do we govern AI agents that take autonomous actions?
Govern agents that browse websites, execute code, send messages, and use external services. Set controls for their autonomous actions.
How do we audit an AI system for compliance?
Audit an individual AI system for compliance. Review evidence and write findings that give owners specific remediation work.
How do we manage third-party AI vendors safely throughout the vendor lifecycle?
Manage AI vendors from due diligence through monitoring. Review data handling, contractual protections, and the response to model changes.
What do we do when an AI system causes harm or fails?
Respond to AI failures through detection, containment, investigation, and regulatory notification. Use findings to prevent recurrence.
How do we intake and govern open-weight and self-hosted AI models?
Review open-weight models before downloading, fine-tuning, or self-hosting them. Set deployment and maintenance controls suited to those responsibilities.
How do we govern our AI supply chain and manage upstream model dependencies?
Review upstream AI dependencies, including foundation models, datasets, development tools, and compute infrastructure. Treat them as supply chain components.
What AI agent security controls do we need as agent autonomy expands?
Review security before expanding agent autonomy. Cover multi-agent trust, agent identities, emergency-stop testing, and governance approval.