The short answer
AI governance is how an organization steers its use of AI, and an AI governance framework writes down who decides what. For a mid-size organization I’d start with six parts. You need one owner and a small committee, clear decision rights, an inventory of every AI system, four risk tiers, a review schedule and a handful of metrics. Comply with the EU AI Act where it applies to you, and borrow structure from the NIST AI Risk Management Framework and ISO/IEC 42001 instead of adopting either one whole. The committee charter and the one-page policy outline on this page are ready to adapt.
See the starter framework- What Owner, decision rights, inventory, risk tiers, reviews and metrics.
- Start with One owner and a list of the AI you already use.
- EU deadline High-risk rules for AI in hiring and people decisions apply from 2 December 2027.
What is AI governance?
AI governance is how an organization steers its use of AI. It covers who is accountable for AI, who may approve new tools, agents and use cases, how risks are assessed and how you check what happens once AI is in use. NIST describes governance as a cross-cutting function that runs through all other AI risk work (NIST).
Four terms tend to get mixed up.
- AI governance is the whole system, from who is accountable to how you check the results.
- An AI governance framework is that system written down, so it survives the next reorganization.
- An AI policy is the set of rules for employees, such as which tools and which data. It is one part of governance.
- Compliance means meeting legal duties, for example under the EU AI Act. Governance is how you make sure that happens.
Board oversight of how management handles AI is a separate job, and the subject of my AI training for boards. Getting people to change how they work is another, covered in my leader’s playbook for AI transformation.
Why isn’t an AI policy enough?
A policy tells people what to do. Governance is how someone decides, checks and adjusts. In the AI & HR Barometern 2026, 176 of 329 HR professionals in Sweden say their organization has an AI policy or clear guidelines. Among those 176, 49 percent say AI tools that are not formally approved are still used in HR. Across all 329, only 9 percent say their organization is well prepared for the AI Act and other AI requirements in HR. My reading is that many organizations stopped at the document.
Source: AI & HR Barometern 2026, humAIn Academy (raw data, main results in State of AI in HR). 329 HR professionals in Sweden who chose to respond, 8 June to 24 September 2026. They are likely more interested in AI than HR overall, and the answers describe how HR respondents see their organization, not employees in general.
How do the NIST AI RMF, ISO/IEC 42001 and the EU AI Act fit together?
They answer different questions. The EU AI Act says what you must do. The NIST AI RMF helps you think through risk. ISO/IEC 42001 describes how to run AI governance as a management system that an outside auditor can check. Status as of November 2026.
| Framework | What it is | Binding? | How to use it |
|---|---|---|---|
| EU AI Act | EU Regulation 2024/1689, in force since 1 August 2024. Amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026 | Yes, for organizations established or located in the EU, for providers that place AI on the EU market, and for organizations outside the EU when the output of their AI system is used in the EU | Comply where it applies, and use its risk categories to sort all your AI |
| NIST AI RMF 1.0 | US framework released in January 2023, with four functions called Govern, Map, Measure and Manage. A Generative AI Profile followed in July 2024, and NIST says the framework is being revised under the White House AI Action Plan | No, voluntary | The Govern function as a checklist, including an inventory of AI systems and documented roles |
| ISO/IEC 42001:2023 | International standard for an AI management system, published in December 2023, for organizations of any size that develop or use AI | No. Certification is voluntary and done by independent certification bodies, not by ISO | Written roles, records and regular review, plus certification if someone needs independent proof |
For a mid-size organization, my advice is to sort your AI by the law’s risk categories, use NIST’s Govern function as a checklist and save ISO/IEC 42001 for when customers, partners or regulators ask for independent proof. ISO itself says the standard does not replace laws or regulations, so a certificate doesn’t show that you meet the AI Act (ISO). To map one framework to the other, NIST’s AI Resource Center lists a crosswalk from the AI RMF to ISO/IEC 42001, submitted by Microsoft (NIST).
What does the EU AI Act ask of organizations that use AI, and when?
The Act separates the provider, who develops an AI system and puts it on the market or into service under its own name, paid or free, from the deployer, the organization that uses it. Most organizations are deployers. If you build your own AI tool or agent for a high-risk use, put your name on one, or substantially change one, you can become the provider, with heavier duties.
The rules apply in stages. This is the status as of November 2026, after the omnibus (EUR-Lex).
| From | What applies | What to do now |
|---|---|---|
| 2 February 2025 | The bans in Article 5, including emotion recognition at work except for medical or safety reasons, and the duty to take measures that support staff’s AI literacy | Check the inventory for banned uses and start training |
| 2 August 2026 | Most remaining rules, including transparency. Chatbots must make clear that they are AI, and deployers must disclose deepfakes and some AI-generated text they publish (Article 50) | Check how your chatbots present themselves and set a labeling rule for content you publish |
| 2 December 2027 | The high-risk rules for Annex III systems, including AI in hiring and people decisions | List the systems that may be high-risk, ask vendors how they will comply, and plan oversight, logs and information to employee representatives |
Annex III lists AI intended for recruitment, promotion, termination, task allocation and performance monitoring. Such a system can fall outside the high-risk rules if it doesn’t materially influence the decision, for example when it only performs a narrow procedural or preparatory task. A system that profiles people is always high-risk (Article 6(3)).
From 2 December 2027, if you deploy a high-risk system, for example one that screens candidates or evaluates performance, the Act lists these duties among others (EUR-Lex).
- Use it according to the provider’s instructions.
- Assign human oversight to people who have the competence, training and authority for it.
- Make sure the input data you control is relevant.
- Monitor how it works, report serious incidents and stop using it if it presents a risk.
- Keep the logs it generates for at least six months.
- Inform workers’ representatives and affected workers before you use it at the workplace.
- Tell people when the system makes or assists decisions about them.
Public bodies and private organizations that provide public services must also assess the impact on fundamental rights before first use. That assessment can refer to your data protection impact assessment. Breaching the deployer duties can cost up to 15 million euros or 3 percent of worldwide annual turnover, whichever is higher. For SMEs and small mid-caps, the lower of the two applies.
Outside the EU, other rules can cover the same uses. In New York City, Local Law 144 has been enforced since 5 July 2023. Employers and employment agencies that use an automated employment decision tool must have it bias-audited within the year before use, publish a summary of the results and notify candidates and employees (NYC DCWP). Ask your lawyer which rules apply where you hire and employ people.
A starter AI governance framework for a mid-size organization
This is the framework I propose for an organization of a few hundred to a few thousand people without a dedicated AI risk team. It has six parts, and the first version fits on a few pages. Add process only where the risk tier calls for it.
1. Roles and an owner
In the same survey of 329 HR professionals in Sweden, 33 percent say the leadership team has the main responsibility for AI, 26 percent say IT and 23 percent say it’s shared. Only 4 percent say HR, and 19 percent name unclear ownership among the biggest obstacles to using more AI in HR. My view is that when several functions share responsibility, nobody ends up owning the whole. Name one owner on the leadership team and split the rest of the work like this.
| Role | Responsible for |
|---|---|
| Executive owner | Direction, how much risk you accept and the final call on high-tier uses. Chairs the committee. |
| AI governance lead | The inventory, the request process, the metrics and preparing committee decisions. Part of someone’s job in most mid-size organizations. |
| IT and information security | Approved tools, access rights, integrations and logs. |
| Data protection and legal | Personal data, vendor contracts, data protection impact assessments and AI Act duties. |
| HR | Training, changes to roles, information to employees and their representatives, and AI used in people processes. |
| System owners | One named person for each AI system in the inventory. |
| Managers | Making sure their team uses AI within the rules and raises problems early. |
| Board | Checking that management has AI risk under control and that AI supports the strategy. |
2. Decision rights
Write down who decides what, and measure how long decisions take. In my view, a slow answer sends people to their personal accounts. A missing or weak approved tool does the same, as I describe in Shadow AI.
| Decision | Who decides | Who is consulted |
|---|---|---|
| Use an approved tool for everyday work | The employee, within the policy | Nobody |
| Add a new AI tool or AI feature | AI governance lead and IT security | Data protection |
| Connect AI to company systems or data | IT and the system owner | Data protection, AI governance lead |
| Let an AI agent act after a person approves each action | AI governance lead and IT security | System owner, data protection |
| Let an AI agent act on its own | The committee | IT security, system owner |
| Use AI in decisions about people, such as hiring, promotion, performance or termination | The committee, with the executive owner | HR, legal, employee representatives |
| Change the policy or the risk tiers | Executive owner | The committee |
| Stop a system after an incident | System owner or AI governance lead, right away | The committee afterwards |
Five questions on the request form are enough to place most requests in a tier.
- What will the tool do, and for which team?
- What data goes in, and does it include personal data?
- Will it make or support decisions about people, such as candidates, employees or customers?
- Can it act in other systems, for example send messages, write data or change settings?
- Who will own it, and is there a contract and a data processing agreement?
A yes to question 3 points to the high tier. A yes to question 4 means an agent, which goes in the elevated tier if a person approves each action and in the high tier if it acts on its own. Personal data in a tool without a contract and a data processing agreement is not allowed.
3. An inventory of AI systems
NIST’s Govern function asks for mechanisms to inventory AI systems, resourced according to risk priorities (NIST). A spreadsheet is fine for the first year. Give each system one row with these columns.
- Name, vendor and version or plan
- System owner
- What it is used for
- What data goes in, and whether it includes personal data
- Who it affects, such as employees, candidates or customers
- Risk tier
- Who approved it, and when
- Contract and data processing agreement
- Next review date
Include AI features inside software you already pay for, such as Copilot in Microsoft 365 or AI in your applicant tracking system. Then ask teams what they use beyond the approved list.
4. Four risk tiers
I suggest four tiers that build on how the AI Act sorts risk, with a few additions of my own, such as personal data in unapproved tools and AI agents. Most everyday use lands in the lowest tier, and that is where you want it.
| Tier | Examples | What it takes |
|---|---|---|
| Not allowed | Emotion recognition of employees, banned in the EU except for medical or safety reasons. Personal or confidential data in tools without an agreement. | Blocked where possible, and named in the policy |
| High | In HR, AI that targets job ads, screens or ranks candidates, supports decisions on promotion or termination, allocates tasks based on behavior or personal traits, or monitors and evaluates performance. Elsewhere, AI that assesses people’s creditworthiness, prices life or health insurance for individuals, or evaluates students at an education or training institution. AI agents that act on their own in your systems. | Committee approval, a named human overseer with time and authority, a data protection impact assessment, information to employee representatives and affected staff before workplace use, logs kept for at least six months, a way to stop it, review every six months |
| Elevated | Chatbots that talk to customers or employees, AI-generated content you publish, connections between AI and company data, agents that act after a person approves each action | Approval from the AI governance lead and IT security, a named owner, testing before launch, disclosure where the AI Act requires it, quarterly review |
| Everyday | Drafting, summarizing, analysis and research in an approved tool, signed in with a work account | Allowed under the policy, with training and no case-by-case approval |
For HR-specific checks in the high tier, such as what to ask a vendor, see Ethical AI in HR.
Sort AI agents by what they are allowed to do. Gartner’s four autonomy levels from May 2026 are observe, advise, act with approval and act autonomously. Its recommended controls grow with each level, from approval workflows with audit trails for agents that act with approval to continuous monitoring, rapid rollback and circuit breakers that halt autonomous agents (Gartner). In my tiers, agents that observe or advise land in the everyday or elevated tier, depending on what data they read. Agents that act after approval go in the elevated tier, and I’d keep agents that act on their own in the high tier until you’ve seen them work. Gartner also warns that locking simple agents down as hard as autonomous ones drives shadow development.
5. A review schedule
- Committee. Monthly for the first six months, then quarterly.
- Inventory. Updated when something changes, checked by the AI governance lead every quarter.
- High-tier systems. Reviewed every six months and after any significant change.
- Elevated-tier systems. Reviewed every quarter by the system owner and the AI governance lead.
- Incidents. Reported to the AI governance lead the same day. Serious incidents with a high-risk system also go to the provider and the authorities, as the AI Act requires.
- Policy and tiers. Reviewed once a year, or when the law or your tools change.
- Reporting. To the leadership team every quarter, and to the board once or twice a year.
6. A handful of metrics
In the same survey, 70 percent of the 329 HR professionals say they don’t measure the effect of AI in HR, and 5 percent say they have defined KPIs. Pick five of these metrics and report them every quarter. The first targets are my suggestions, so adjust them once you have a baseline.
| Metric | What it tells you | A first target |
|---|---|---|
| Share of AI systems in the inventory with a named owner and a tier | Whether the inventory is real | Every high and elevated system from the start |
| Working days from a tool request to a decision | Whether the process pushes people to their own accounts | 10 working days or fewer, as in the charter |
| Share of staff who have completed AI training, by team | Where support is missing | The leadership team and all managers within the first 90 days |
| Monthly active users of the approved tools | Whether the approved tool is good enough for the work | A rising trend after the first quarter |
| Incidents reported, and days to close them | Whether people report problems and whether you fix them | Some reports, which shows people dare to raise them, and each one closed within [30] days |
| Time saved or quality gained on two or three common tasks, measured before and after | Whether AI pays off in the work | A baseline in weeks 9 to 13, then a target per task |
AI governance committee charter (template)
Copy the text below and fill in the brackets. Five to seven members is enough for a mid-size organization. Keep the committee small enough to decide.
AI GOVERNANCE COMMITTEE CHARTER [Organization]. Approved by [leadership team or CEO] on [date]. 1. Purpose This committee makes sure we use AI in ways that help the business, protect people and data, and meet the law. It owns the AI policy, the AI inventory and the risk tiers. 2. Scope All AI systems and AI features we use for work. This includes AI inside software we already license, tools that staff request, connections between AI and our systems, and AI agents. 3. Members [Executive owner], a member of the leadership team, chairs the committee. [AI governance lead] prepares meetings and keeps the inventory and the decision log. [IT or information security] [Data protection officer or legal counsel] [HR] [One business lead, rotating every six months] [Employee representative] is invited when a decision affects staff. 4. Decision rights The committee approves or rejects uses in the high tier, including AI agents that act on their own in our systems. It sets the risk tiers, proposes changes to the AI policy and decides what happens after a serious incident. The AI governance lead and IT security approve uses in the elevated tier, including AI agents that act only after a person approves each action, and report them to the committee. The committee does not approve everyday use of approved tools. The AI policy covers that. The executive owner has the final say when the committee disagrees, and escalates to the leadership team when a risk is larger than we have agreed to accept. 5. Meetings Monthly for the first six months, then quarterly, and extra meetings when needed. A decision needs the chair and at least half of the members. Every decision goes into the decision log with the reason. 6. Requests Anyone can request a new tool or use case through [form or channel]. The AI governance lead answers within [10] working days. High-tier requests go to the next committee meeting. 7. Inputs Requests, changes to the inventory, incident reports, the quarterly metrics and changes in law or vendor terms. 8. Outputs The decision log, an updated inventory, a quarterly report to the leadership team and a report to the board [once or twice] a year. 9. Review The committee reviews this charter once a year.
A one-page AI policy outline
The policy is the part employees read, so keep it to one page and link to the details. Here is an outline with example wording to adapt.
AI AT [ORGANIZATION] Valid from [date]. Owner [name]. Questions to [channel]. 1. Why we use AI We use AI to [save time on routine work, improve quality, serve customers faster]. We want you to use it. 2. Approved tools Use [tools], signed in with your work account. The current list is at [link]. 3. Data that never goes into AI Never put personal data about colleagues, candidates or customers into a tool that is not on the approved list. [Salary data, health information, customer contracts and board material] stay out of all AI tools unless [owner] has approved the use. When unsure, leave it out and ask. 4. You own the output Check facts, numbers and tone before anything goes to a customer, a candidate, the board or the public. AI can be wrong and still sound sure. 5. Be open about AI Say so when someone is talking to an AI system and not a person, and follow [our labeling rule] for AI-generated content we publish. 6. Decisions about people AI may support decisions on hiring, promotion, pay, performance or termination, but a person decides. These uses need approval from the AI governance committee. 7. Not allowed [Emotion recognition of staff. Personal AI accounts for work tasks. AI agents connected to our systems without approval.] 8. New tools and agents Request them through [form]. You get an answer within [10] working days. 9. Training Everyone completes [course] within [time]. Managers also complete [module]. 10. Report problems If AI gives a harmful result, exposes data or does something it should not, tell [contact] the same day. Nobody gets in trouble for reporting.
If you read Swedish, my AI policy page has a free three-page template in Word, with a table of which information may go into which tools. Run your version past data protection, IT and, where needed, a lawyer before the leadership team approves it.
How do you get AI governance running in 90 days?
- Weeks 1 to 4. Name the owner and list what you have. The leadership team appoints the executive owner and an AI governance lead. Build the inventory from what IT can see and what teams say they use.
- Weeks 5 to 8. Set the tiers, rights and rules. Sort every system into a tier. Approve the charter and the one-page policy, and tell employee representatives what is coming. Plan training that starts with the leadership team, as in the AI literacy playbook. To set a target level per role and keep a record of your Article 4 measures, use the AI fluency framework.
- Weeks 9 to 13. Run it once and measure. Hold the first committee meeting on real requests. Take a baseline for the metrics, send the first short report to the leadership team and agree what goes to the board.
Frequently asked questions
What is an AI governance framework?
An AI governance framework writes down how an organization steers its use of AI. A practical one names an owner and a committee, keeps an inventory of AI systems, sorts them into risk tiers, sets out who decides what, and sets a review schedule and a few metrics. Public frameworks such as the NIST AI RMF and ISO/IEC 42001 can supply the structure, and the EU AI Act sets legal duties where it applies.
Who should own AI governance?
One member of the leadership team, as executive owner. An AI governance lead runs the inventory and the requests, IT, data protection, legal and HR each own their part, and every AI system has a named owner. In my view, responsibility that is shared between functions without one name leaves gaps.
Who should sit on an AI governance committee?
A member of the leadership team as chair, an AI governance lead, IT or information security, data protection or legal, HR and one business lead. Five to seven people is enough for a mid-size organization. Invite employee representatives when a decision affects staff.
Do we need ISO/IEC 42001 certification?
No law requires it. ISO/IEC 42001 is a voluntary standard for AI management systems, and certification is done by independent certification bodies. Consider it when customers, partners or regulators ask for independent proof. ISO says the standard does not replace laws or regulations, so it does not replace your work on the EU AI Act.
Does the EU AI Act apply to companies outside the EU?
It can. The Act applies to organizations established or located in the EU that use AI, to providers that place AI on the EU market wherever they are based, and to providers and deployers outside the EU when the output of their AI system is used in the EU. A US or UK company with operations, staff or candidates in the EU should check its use cases.
When do the EU AI Act’s rules for AI in HR apply?
Annex III of the AI Act lists AI intended for recruitment, promotion, termination, task allocation or performance monitoring as high-risk. Article 6(3) has narrow exceptions, but AI that profiles people is always high-risk. Those rules apply from 2 December 2027, after the Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the date. The ban on emotion recognition at the workplace has applied since 2 February 2025.
Sources
- EUR-Lex: AI Act, Regulation (EU) 2024/1689
- EUR-Lex: Digital Omnibus on AI, Regulation (EU) 2026/1744
- NIST: AI Risk Management Framework
- NIST AI Resource Center: AI RMF Core
- NIST AI Resource Center: crosswalks
- ISO: ISO/IEC 42001:2023
- ISO: ISO/IEC 42001 explained
- Gartner: governance of AI agents by autonomy level (May 2026)
- NYC Department of Consumer and Worker Protection: automated employment decision tools
- State of AI in HR (AI & HR Barometern 2026, humAIn Academy)
Want to set up AI governance with your leadership team?
In an AI workshop for executive teams, you use AI tools on your own business questions and decide what to test first, who owns it and what to measure. The questions are agreed before the session, so the charter on this page can be one of them. 13 leadership teams rated my sessions 4.97 of 5 on average. If you want support over several months, my AI change programs cover training, responsibilities and follow-up.