AI governance

Organizations set up AI governance because AI systems arrive from vendors, from internal teams and from features switched on inside tools already in use, and each one shapes decisions with the organization’s data. Governance is how the organization knows what it is running and can stand behind it.

Why does AI governance matter?

• Harm is hard to see. A model that scores loan applications or screens candidates can treat groups of people unfairly without anyone noticing.
• Regulation is arriving. Several jurisdictions now sort AI systems by risk and attach obligations to the higher tiers, such as documentation, human oversight and transparency to the people affected. The details vary by place and use.
• The systems multiply. Without an inventory, nobody can say how many AI systems the organization runs. Each ungoverned system is technical debt with a regulatory interest rate.

What does AI governance cover?

The diagram at the top of this page shows a governance framework as four layers, with the roles that own them beside it.

Principles and policy

The values the organization commits to, such as fairness, transparency, accountability, safety and privacy, and the policy that turns them into rules: what AI may be used for, what data it may use and which uses are not allowed. A governance board owns this layer.

Processes

The repeatable steps every AI system goes through. Intake registers a proposed use case. Risk assessment assigns a tier. Review gates the system before release. Monitoring watches it in production. Risk and compliance usually runs these, and the architecture review board takes the architectural part of the review.

Controls

What is actually applied to a system, in proportion to its tier. Data controls cover provenance, consent and retention. Model controls cover evaluation, versioning and drift. Access controls cover who can deploy a model and who or what can call it. Logging records prompts, outputs and the decisions a system made or influenced.

AI systems inventory

The list of every AI system in use, built or bought, with an owner, a risk tier, the data it uses, the decisions it affects and a review date. The inventory is the layer the others depend on: a control cannot be applied to a system nobody has listed.

What are AI risk tiers?

Tiers let the organization spend review effort where harm could be greatest.

Tier	Typical systems	What it requires
Minimal	Code assistant, spam filter, internal search	Inventory entry, standard access controls
Limited	Contract summarizer, marketing copy generation, internal chatbot	Plus data review, disclosure to users that AI is involved, output logging
High	Fraud scoring, credit or hiring decisions, customer-facing agents with authority to act	Plus formal evaluation, bias testing, human oversight, monitoring with thresholds, board sign-off

The tier is decided by impact on people, data sensitivity and autonomy. An agent that can take actions, as described in AI agent architecture, sits a tier above an equivalent system that only answers questions, because the blast radius of a wrong output is larger.

What is an AI systems inventory?

The inventory is the register at the bottom of the framework. Beyond name, owner and tier, the fields that matter:

• Purpose and users. What it does, who uses it and who is affected by it.
• Data and models. The data sources, the model or vendor, the version and whether data leaves the organization.
• Dependencies. The applications and services it is part of, which links the entry to the application portfolio, the CMDB and the subscriptions tracked in IT asset management.

What are review gates?

A review gate is a point where a system cannot proceed until a named role has checked it. The gates scale with tier.

1. Intake gate. Is the use permitted by policy, and what tier is it? Everything passes this one.
2. Design gate. For limited and high tiers: does the architecture meet the controls? Usually a session of the architecture review board with the data and security owners present.
3. Pre-release gate. For the high tier: evaluation results, bias testing, human oversight design and a rollback plan, signed off by the governance board.

How do you monitor AI systems?

• Drift. Input distributions and output quality compared with the evaluation baseline, with thresholds that trigger a review.
• Incidents. A route for staff and users to report a harmful or wrong output, tracked like any other incident.
• Usage. Who is calling the system, how often and for what, against the purpose it was approved for.

How does AI governance relate to enterprise architecture?

AI governance is a specialization of practices enterprise architecture already runs. The inventory is a view of the application portfolio and the design gate is an architecture review with extra questions. The target in a current vs future state comparison should show only AI systems that have cleared intake, and the IT roadmap should carry their review gates as milestones.

What are common AI governance mistakes?

• A committee with no inventory. Policy without a list of systems governs nothing.
• One process for every tier. A code assistant and a credit model need different scrutiny.
• Ignoring bought and embedded AI. Vendor features switched on in existing tools are often the majority of AI in use.

What tools help with AI governance?

• GRC and AI governance platforms. Purpose-built products hold the inventory, run the gates as workflows and collect evidence for audits.
• Documents and spreadsheets. A policy document, an inventory spreadsheet and a review checklist are how most organizations start, and they work until the inventory outgrows them.
• AI diagramming tools. Tools like Eraser draw the architecture a system under review sits in, so a design gate can see the data flows and the services an AI system can reach. See the architecture diagram generator.

For more on this kind of diagram, see architecture diagrams.

Frequently asked questions