What Is AI Governance?

Introduction

AI governance is the set of decisions, controls and evidence that establish who is accountable for an AI system’s behaviour. It answers three questions about a specific system: who authorised it, what it is permitted to do, and how anyone would know if that stopped being true.

That definition is deliberately narrow. It excludes much of what is published under the governance label — value statements, principles documents, internal ethics charters — not because those are worthless, but because they are not governance until they attach to a decision that can be refused.

Why the distinction matters

Organisations routinely believe they have AI governance because they have an AI policy. The two are not the same thing. A policy describes intent. Governance is the machinery that makes intent binding: an approval that can be withheld, a boundary the system cannot exceed, a record that survives staff turnover.

The practical test is simple. Pick a deployed AI system and ask who could stop it, on what grounds, and how long that would take. If there is no answer, the organisation has documentation rather than governance.

Governance, safety, ethics and compliance

These four terms are used interchangeably and mean different things.

• Safety concerns the behaviour of the system itself — whether it produces harmful output, fails predictably, or can be induced to act outside its intended function.
• Ethics concerns whether the system should exist in its intended form, and who bears its costs.
• Compliance concerns whether the system satisfies an external obligation that a regulator or auditor can test.
• Governance is the accountability structure that decides all three: who makes the call, on what evidence, and who answers for the outcome.

An organisation can be compliant and ungoverned — meeting every documented obligation while nobody internally owns the system. It can also be well governed and non-compliant, if it has made a deliberate, recorded decision to accept a regulatory gap. Collapsing the terms hides exactly the decisions that matter.

The two reference points

Most serious governance work currently anchors to a voluntary framework, a binding regulation, or both.

The NIST AI Risk Management Framework is the most widely referenced voluntary framework. NIST released it on 26 January 2023 and organises it around four core functions — Govern, Map, Measure and Manage — intended for voluntary use in incorporating trustworthiness considerations into the design, development, use and evaluation of AI products, services and systems.¹

The EU Artificial Intelligence Act is the binding counterpart for organisations in scope. It was adopted as Regulation (EU) 2024/1689 on 13 June 2024 and lays down harmonised rules on artificial intelligence across the Union.²

The two are complementary rather than alternative. A framework gives you a way to organise the work; a regulation tells you which parts are not optional. Adopting a framework does not by itself demonstrate regulatory conformity, and regulatory conformity does not by itself produce a well-run programme.

What a governance control actually looks like

The gap between policy and governance closes when a statement acquires a subject, a trigger and a record. Compare:

All AI systems must be used responsibly.

against:

No system may send customer-facing messages without a named owner, a logged approval, and a retained sample of its output reviewed monthly.

The second can be audited, delegated, and failed. That is the whole difference.

Limitations of this framing

This definition treats governance as an accountability problem, which is the most useful frame for organisations deploying systems they did not build. It is less useful for questions of model development — training data provenance, evaluation methodology, release decisions — where the governing decisions sit with the model developer rather than the deploying organisation. Those are governance questions too, but they involve different actors and different evidence.

It is also a framing, not a standard. Neither source cited here defines governance in exactly these terms; both are cited only for the specific factual claims attributed to them.

Practical implications

For a team starting from nothing, the first useful artefact is not a policy. It is an inventory: which AI systems exist, who owns each one, what data each touches, and what would happen if each were switched off. Governance frameworks assume that inventory exists. Most organisations discover that theirs does not.