What Is AI Governance?

Every year IBM and the Ponemon Institute study several hundred organizations that have suffered a data breach. Their 2026 report, covering 602 breaches between March 2025 and February 2026, found that AI use had grown again. Oversight had not. Only 32 percent of the breached organizations had policies in place to manage AI and prevent shadow AI, down from 37 percent a year earlier; the other 68 percent had none or were still writing them. Fewer required strict approval before an AI system was deployed, 38 percent against 45 percent, and only 19 percent of organizations said their AI governance and security teams coordinated their work at all¹.

That is the contradiction at the center of this chapter. Organizations are using more AI every year and deciding less about it. And the figures make a second, subtler point. Many organizations, with or without a policy, had no approval step and no link between the people who write the rules and the people who defend the systems. A policy says what should happen. It does not say who decides, who checks, or who can stop something when it goes wrong. That missing part is governance.

The core idea

AI governance is the system of decision rights, accountability, policies, controls and oversight that makes sure AI is developed and used responsibly and in line with the organization’s objectives. Put more simply, it answers four questions for every AI use that matters: who may decide, under what rules, who answers for the outcome, and how we will know whether it is working.

The position matters. Governance is not a review bolted on after a system is built, and it is not a separate track run by the legal department. It is the layer that connects what the organization wants AI to do with what its teams actually do. Strategy chooses where AI should create value. Management gets the work done. Governance decides who decides, which rules apply and how oversight works.

The leading frameworks put it in the same place. The NIST AI Risk Management Framework has four functions, Govern, Map, Measure and Manage, and describes Govern as a cross-cutting function that is infused throughout the other three. Its accountability category expects executive leadership to take responsibility for decisions about AI risk². Governance, in other words, is not a specialist activity at the edge of AI work. It is the frame around all of it.

A system, not a document

In any organization, governance is how decisions get made, authority is assigned, expectations are set, risk is managed, performance is monitored and people are held to account. AI governance applies that discipline to AI systems and the activities around them. Like any system, it has parts.

The parts depend on each other. A policy without a process is a wish. A process without a control is a habit, and a control without monitoring is a guess. This is why ISO/IEC 42001, the first international standard for an AI management system, published in December 2023, is written as a management system standard. It sets requirements for establishing, implementing, maintaining and continually improving an AI management system, in the same family as the quality and information-security standards many organizations already hold³. The emphasis on continual improvement is deliberate. AI systems change after launch, and so do the people and data around them, so governance cannot be a one-off approval.

None of this means governance is one committee, one tool or one checklist. The committee, the office and the operating model each have their own chapters later in this module. Here the point is narrower and more important: if any of the six parts is missing, an organization can believe it is governed and not be.

Why informal decisions stop working

Every organization already makes AI decisions. The question is whether it makes them on purpose. When one employee uses AI to summarize internal notes, an informal decision is good enough. When the same organization uses AI to screen customers, generate production code, process contracts and run agents that take actions, informal decisions stop scaling. Each use touches different data, different people and different obligations.

And the use is already wide. In Microsoft and LinkedIn’s 2024 survey of 31,000 people in 31 countries, 75 percent of knowledge workers said they used generative AI at work, and 78 percent of those users brought their own tools rather than waiting for their employer’s⁴. As AI Is Already Inside Your Organization showed, much of this use is invisible to the people who would be accountable for it.

Without a common way to decide, the pattern is predictable. One team adopts one tool, another team a different one, a third uses a free public service and a fourth builds its own. The result is duplication, inconsistent standards and data going where nobody approved. The risks themselves were the subject of Module 06: confidential data in prompts is covered in Privacy and Confidential Data, vendor exposure in Model and Third-Party Risk, and systems that act on their own in Agentic AI and Autonomous Actions. Governance is how an organization decides, consistently, what to do about all of them.

Decision rights come first

If governance is a system, its first part is decision rights. For every important AI system, someone must be able to answer seven questions.

Who can propose it? Who can build or buy it? Who can approve it, deploy it and change it? Who can stop it? And who is accountable for what it does? Where these answers are unclear, governance is ambiguous, and ambiguity is where incidents grow. A model starts giving poor answers or a tool starts moving data it should not, and nobody is sure who has the authority to switch it off. The right to stop is the easiest one to leave blank, because nobody thinks about it until the moment it is needed.

Executives already know how to do this, because they do it with money. Almost every organization has a delegation of authority: a schedule that says who may sign a contract, approve a purchase or commit spending of a given size. A team lead approves small amounts, a function head larger ones, and only the board approves the largest. Nobody calls that bureaucracy. It is what lets thousands of spending decisions happen every day without each one reaching the chief financial officer.

AI governance applies the same habit to a new kind of decision. The analogy has a limit: a purchase is approved once, while an AI system keeps changing after it is approved, which is why the rights to change and to stop belong on the list. Assigning these rights to named roles is the work of AI Roles, Ownership and Accountability. Here it is enough to know that the rights must exist and be written down before they are needed.

The board’s place in this picture is familiar too. The Institute of Internal Auditors’ Three Lines Model separates the governing body’s oversight, management’s ownership of risk, and internal audit’s independent assurance⁵. AI does not need a different model. It needs to be inside the one the organization already runs.

Broader than policy, compliance, risk or strategy

Executives often use neighboring words as if they meant governance. Each one names a part, not the whole.

A policy states what is required and what is prohibited; governance adds who enforces it, who approves exceptions and who escalates. Compliance asks whether the organization meets its obligations; governance asks who answers for that, and how decisions are made where the law says nothing yet, which for AI is often. Risk management asks what can go wrong, how likely it is and how bad it would be; governance decides who owns each risk and who has the authority to accept it. Strategy might say “use AI to improve customer onboarding”; governance decides which onboarding uses are permitted, who approves them, what controls they need and how their performance is watched.

Responsible AI principles relate to governance in the same way. The OECD AI Principles, adopted by dozens of governments and updated in 2024, say that organizations developing, deploying or operating AI should be held accountable for its proper functioning⁶. A principle like that is necessary and not sufficient. Governance is what turns it into decisions, owners, controls and evidence. The principles themselves are the subject of AI Governance Principles, and the chain from principle to evidence is drawn in AI Policy vs AI Governance.

Bought or built, from idea to retirement

Governance does not begin at deployment. It covers the whole life of an AI system: the idea, design, the decision to build or buy, testing and approval, deployment and operation, monitoring and change, and finally retirement.

It also applies when the organization did not build the model. A software service with AI inside, a coding assistant or a document platform is still a decision the organization makes about its own process. Buying AI moves the engineering to a vendor. It does not move the accountability.

The law draws the same line. The EU AI Act distinguishes the provider, who develops a system and places it on the market, from the deployer, an organization that uses an AI system under its own authority, and gives deployers duties of their own⁷. Existing law applies too. The GDPR already governs many AI uses that involve personal data, including decisions made solely by automated means and the impact assessments required for high-risk processing⁸.

How governance works at each stage of that cycle is the subject of AI Lifecycle Governance. The point for now is scope: governance covers every AI system the organization relies on, from first idea to last day, whoever built it.

Proportion is what makes governance an enabler

A common belief is that governance means a central team approves everything. That does not scale, and it is not the goal. Both extremes slow an organization down.

At one end, too much governance: every experiment waits for a committee, people stop asking, and AI use moves out of sight. At the other end, too little: no visibility, then an incident, then a loss of trust, and then a sudden clampdown on the whole program. The clampdown is common: Samsung banned generative AI tools in one of its largest divisions in May 2023, after staff uploaded sensitive source code to a public chatbot⁹. A ban like that is a reasonable emergency measure. It is not governance. It buys time, but it does not say who may approve which use, and as Privacy and Confidential Data showed, bans tend to push use out of sight rather than end it.

The stance that works sits between the extremes. Low-impact uses get light, local decisions. High-impact uses get more review and stronger monitoring. A sandbox with approved tools, non-sensitive data and a small group of users can move quickly; governance tightens as a use moves toward production, customers and consequential decisions. How to sort uses into tiers is the work of AI Inventory and Risk Classification. The principle belongs here: good governance should raise people’s confidence to use AI, not lower it.

Story: the audit question nobody could answer

The case below is an illustrative composite, not a real company, built from a pattern common among suppliers that hold their customers’ confidential data. Read the situation and decide what you would do before reading on.

You lead a tire maker with plants and test tracks in many countries, developing tires for car makers who guard their vehicle designs closely. AI has arrived as it does everywhere. A sales team drafts quotes with a general-purpose AI assistant. Development engineers paste a car maker’s load and handling specifications into a free public tool to check their calculations. One regional plant has built its own agent to search old test reports. There is an AI policy, written last year. There is no list of what is in use and no common approval process.

Then a major car maker sends an audit question. Its supply contract forbids sharing its design data with third parties without consent. Which AI tools have touched our data? Nobody can answer.

You have three options. You could ban every AI tool until a full policy is written. You could set up a governance committee, write a thorough policy and answer the customer when that is done. Or you could, within two weeks, find out what is in use, name an owner for each use, and pause only the uses that put customer data into unapproved tools.

The third option is the governance answer. A ban would push use out of sight, exactly when the company needs to see it, and would not answer the customer’s question about the past. A committee would be useful later, but it would keep the customer waiting for a structure when what it asked for was a fact. In the third option, every site declares its AI use, with no penalty for honesty. Each use gets a named owner. The uses that put customer data into public tools are paused, and the engineers move to an approved assistant with clear data rules. The company can then answer the car maker with evidence, and its teams keep using AI.

Notice what the company did not need. It did not need a thicker policy; it already had one. It needed visibility, owners and the authority to pause, which are three of the seven decision rights.

What this means for leaders

The first lesson is that a policy is not proof of governance. When a board asks whether AI is governed, the answer is not a document but a demonstration: for the AI uses that matter, the organization can pass the hundred-uses test below. The second is that governance should be built into structures the organization already trusts, its delegation of authority, its risk ownership and its lines of assurance, rather than invented beside them. The third is that proportion is not a concession; it is what makes governance work at all.

Check yourself

1. AI governance is really just compliance with AI law.MythFact
2. An organization can have an AI policy and still have no AI governance.MythFact
3. Good governance means a central committee approves every AI use.MythFact
4. Buying AI from a vendor moves the accountability to the vendor.MythFact
5. In the NIST AI Risk Management Framework, Govern is a cross-cutting function.MythFact
6. Banning AI tools is a form of AI governance.MythFact

What comes next

Governance is the system for making AI decisions responsibly at scale. That raises a prior question: why should an organization care about responsible AI beyond meeting the rules? The next chapter, Why Responsible AI Matters, connects it to trust, business outcomes, stakeholder expectations and long-term value.