AI Governance Framework
Definition
AI Governance Framework
An artificial intelligence (AI) governance framework is the structure of roles, policies, controls and approval points that determines how AI systems are authorised and overseen. It answers who decides, not what is right, and that boundary keeps it usable.
A framework is mechanical by design — deliberately so. It names the accountable owner for each system, the controls that must be evidenced, the approval gate each system must pass and the monitoring that continues after deployment.
Organisations rarely need to invent one. Published frameworks supply the structure — and the real work is adapting them to the organisation’s actual decision rights rather than drafting principles from nothing.
Regulation increasingly sets the floor. A framework designed only around internal policy will need rebuilding once statutory obligations attach to systems the organisation already runs.
Building to the stricter standard is usually cheaper. Retrofitting evidence onto a deployed system means reconstructing decisions nobody documented, sometimes years after the people involved have moved on.
Key takeaways
- The framework defines accountability and approval, not organisational values.
- Published frameworks supply the structure; adaptation is the real work.
- Regulatory obligations set a floor that internal policy has to clear.
- Post-deployment monitoring belongs in the framework, not in delivery alone.
How it works
Each AI system is registered, assigned an accountable owner, classified by risk, and put through an approval path proportionate to that classification. Monitoring obligations then continue for as long as the system operates.
Classification drives everything downstream. A low-impact internal tool and a system making decisions about people should not carry the same evidence burden — and a framework that treats them alike will simply be circumvented.
The most widely adopted reference is voluntary. The NIST AI Risk Management Framework was released on 26 January 2023, is intended for voluntary use, and operationalises its approach through four functions: Govern, Map, Measure and Manage.
Statutory frameworks are arriving alongside it. The European Commission describes the AI Act as setting four levels of risk for AI systems, with transparency rules taking effect in August 2026 and high-risk obligations from 2 December 2027.
| Element | What it fixes | Common omission |
|---|---|---|
| System register | What exists and who owns it | Shadow systems unlisted |
| Risk classification | Proportionate control burden | One tier for everything |
| Approval path | Who authorises deployment | No named approver |
| Evidence set | What must be documented | Decided after build |
| Monitoring | Ongoing obligations | Stops at go-live |
Examples
Frameworks differ mainly in how much regulation applies and how many AI systems already exist in the estate. The four cases below show that spread, from full adoption of a published structure to an extension of existing reporting.
A bank maps its framework directly onto the nist ai risk management framework functions. Adopting a published structure shortened internal argument considerably.
A software vendor builds its controls around ai guardrails enforced in the platform. Policy and technical control are deliberately the same artefact.
A healthcare group requires an ai audit trail for every clinical-adjacent system. Without a recorded decision history, approval is refused regardless of model performance.
A services provider extends its existing esg environmental social governance reporting to cover AI. The board committee already existed, so only the evidence set changed.
Related terms
AI oversight involves several distinct artefacts that are easily conflated, and the entries below separate the framework itself from the technical controls and the evidence that its approval path demands.
- AI data provenance: the evidence most approval paths demand first.
- AI observability: the monitoring capability the framework’s post-deployment duties rely on.
- Model evaluation: the technical test that feeds the approval decision.
FAQ
Should an organisation adopt a published framework or write one?
Adopt and adapt. Published frameworks supply structure and external credibility, while the adaptation work is mapping them onto real decision rights.
Is the NIST framework mandatory?
No. It is explicitly intended for voluntary use, though many organisations adopt it because regulators and customers recognise its vocabulary.
How does this differ from an AI ethics program?
Governance is procedural and decides who approves against what. Ethics is substantive and decides what the organisation is willing to build at all.
What should risk classification be based on?
Impact on people and on the business, not on technical sophistication. A simple model deciding eligibility outranks a complex one summarising documents.
Does the framework cover third-party AI?
It must. Systems bought or embedded in a supplier’s service carry the same obligations, and a framework limited to internally built models misses most exposure.
When should the framework be built?
Before the second use case, not the twentieth. Retrofitting governance across an existing estate costs far more than building it alongside early adoption.
Read more on AI governance and outsourcing at Outsource Accelerator.
Independent
