In a few years, AI has moved from data-science experiments to everyday business tools. Employees use AI assistants, developers ship AI features and vendors embed AI in the software you already buy. Governance has struggled to keep up, and stakeholders have noticed.
Boards want to know where AI is used and what could go wrong. Enterprise customers add AI questions to their security questionnaires. And regulation is arriving: the EU AI Act, which entered into force in August 2024, phases in obligations for providers and deployers of AI systems, and its reach extends beyond the EU's borders.
Two frameworks offer a practical foundation: ISO/IEC 42001, the international standard for AI management systems, and the NIST AI Risk Management Framework (AI RMF).
Two complementary frameworks
ISO/IEC 42001, published in December 2023, specifies requirements for an AI management system. It follows the same high-level structure as ISO/IEC 27001 (context, leadership, planning, support, operation, performance evaluation and improvement) and it is certifiable.
The NIST AI RMF, released in January 2023, is voluntary and organised around four functions: Govern, Map, Measure and Manage. It is particularly useful for structuring how the risks of individual AI systems are identified and assessed. A companion Generative AI Profile (NIST AI 600-1) addresses risks specific to generative models.
In practice, ISO/IEC 42001 provides the management system, and the NIST AI RMF provides a detailed playbook for the risk activities within it.
Five steps to a working programme
1. Build an AI inventory
You cannot govern what you cannot see. Catalogue the AI systems you build, the AI features in the software you buy and the AI tools employees use. For each, record the owner, the purpose, the data involved and who is affected by its outputs.
2. Classify by risk
Not every use case needs the same scrutiny. Define risk tiers based on the impact on people, the sensitivity of the data, the degree of autonomy and the regulatory classification, including whether a system could qualify as high-risk under the EU AI Act.
3. Define roles and policies
Assign accountability: who approves new AI use cases, who owns model risk, who monitors systems in production. Publish an acceptable-use policy for AI tools and development standards for AI systems, including security requirements.
4. Assess and treat risks
For higher-risk systems, run structured assessments covering security, privacy, fairness, transparency and reliability. Security deserves special attention: threats such as prompt injection, data poisoning and model theft require technical testing, not just questionnaires.
5. Monitor and improve
AI systems drift, models are updated and new use cases appear. Set metrics, review incidents, re-assess systems after significant changes and report regularly to leadership.
Start small, but start
An effective AI governance programme does not need to be bureaucratic. Many organisations begin with an inventory, an acceptable-use policy and a lightweight risk assessment for new use cases, then mature towards ISO/IEC 42001 alignment or certification.
If you already operate an ISO/IEC 27001 information security management system, you have a head start: much of the structure can be extended rather than rebuilt. Our AI governance service helps you get there pragmatically.