An AI governance framework is the set of roles, policies, risk rules and records an organization uses to decide which AI systems it builds or buys, how each one is checked before and after it goes live, and who answers for it. If you already run data governance, a good part of it exists: owners, quality rules, lineage, access controls.
Key takeaways
- NIST’s AI Risk Management Framework 1.0, released January 26, 2023 and intended for voluntary use, organizes the work into four functions: Govern, Map, Measure and Manage. NIST’s framework page adds that it is revising version 1.0 under the White House AI Action Plan.
- ISO/IEC 42001:2023 (edition 1, published December 2023) specifies requirements for an AI management system, for organizations of any size that develop, provide or use AI.
- The EU AI Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024. Its first two chapters, with an AI literacy duty and the original list of prohibited practices, have applied since February 2, 2025; Regulation (EU) 2026/1744 later rewrote Article 4 as a duty to take measures that support AI literacy. The same amending act moved the high-risk requirements: those for the uses listed in Annex III start on December 2, 2027, and those for AI in Annex I products on August 2, 2028.
- Under Article 2(1), the AI Act also covers providers outside the EU that place AI systems on the EU market, and providers and deployers in other countries where the system’s output is used in the EU.
What is an AI governance framework?
It is the AI counterpart of a data governance framework, and it governs something different. Data governance looks after the data: what it means, who owns it, whether it is right and who may see it. AI governance looks after systems that learn from that data and then act on it, so it adds questions data governance never had to ask: whether a use should be allowed at all, who checks the output, and what happens when the model drifts or causes harm. Which AI uses are worth pursuing is a question for your data strategy; the framework sets the rules for the ones you pursue.
NIST lists AI risks that are new or larger than those of ordinary software, and several are about data: training data that doesn’t represent the setting the system is used in, data sets that go stale after deployment, and privacy risk from the way AI can combine data.
The parts, and where data governance ends
For each part we would expect in an AI governance framework, the table shows what a working data governance program already gives you, what AI adds, and where the published frameworks ask for it.
| Part | Data governance already gives you | New for AI | Where it is asked for |
|---|---|---|---|
| Policy | A data policy and a council that approves changes to it | An AI policy that lists the banned uses and the ones that need approval | NIST GOVERN 1; ISO/IEC 42001 (AI policy); AI Act Article 5 (prohibited practices) |
| Accountability | Data owners and stewards | An executive who answers for AI risk, an owner for each system, a person assigned to oversee it, and training for whoever does | NIST GOVERN 2; AI Act Article 26 for deployers of high-risk systems |
| Inventory | A data catalog | A register of every AI system in use, including the ones bought or built into software you already license | NIST GOVERN 1.6 |
| Risk classification | Data classified by sensitivity | Each AI use classified by its risk to people, with an impact assessment for the higher tiers | NIST Map function; AI Act Article 6 and Annex III |
| Training and input data | Quality rules, profiling and data lineage | Evidence that the data fits the system’s purpose and has been examined for bias | AI Act Article 10 for providers; Article 26(4) for deployers who control the input data |
| Privacy and rights | A legal basis for each use of personal data | A check that personal data, and other people’s content, may be used to train or prompt a model | AI Act Article 10(2) on the origin and original purpose of personal data; NIST GOVERN 6.1 on third-party rights |
| Lifecycle | Change control on pipelines | Testing before release, monitoring for drift, a review when the model or its data changes, and safe retirement | NIST GOVERN 1.7; Measure and Manage functions; AI Act Article 9 |
| Suppliers | Data sharing agreements | Risk reviews of bought models and AI features, with a plan for when a supplier’s system fails | NIST GOVERN 6 |
| Records and incidents | A data issue log | Automatic event logs, so the system’s operation can be traced, and a route for reporting AI incidents | AI Act Article 12; NIST GOVERN 4.3 |
The middle column is a head start. The data owner who signs off a customer table is not the person who should approve a model that scores those customers, and a data catalog that lists the table says nothing about the models trained on it. In our view, risk classification and human oversight have the least to reuse; AI data governance covers the training data row in depth.
The published frameworks: NIST AI RMF, ISO/IEC 42001 and the EU AI Act
NIST gives you the vocabulary and the outcomes, ISO/IEC 42001 gives you a management system an auditor can certify, and the AI Act is law for anyone it covers.
NIST AI RMF 1.0
The AI RMF is free and voluntary, for organizations of any size that design, develop, deploy or use AI systems. Its core has four functions. Govern sets the policies and roles and runs through the other three; Map frames the context and risks of one system; Measure analyzes and tracks them; Manage acts on them. Our post on the NIST AI RMF takes the functions one by one.
ISO/IEC 42001
ISO/IEC 42001:2023 is a management system standard: it sets the requirements an organization meets to set up and keep improving a management system for the AI it develops, provides or uses. It is sold by ISO; our ISO 42001 post explains certification.
The EU AI Act
The AI Act sorts AI by risk: some practices are banned, high-risk systems must meet the requirements of Chapter III, and some other systems carry transparency duties. The Digital Omnibus on AI, Regulation (EU) 2026/1744 of July 8, 2026, moved the high-risk requirements to December 2, 2027 for the uses listed in Annex III and August 2, 2028 for AI in products covered by the EU product laws listed in Annex I. It also rewrote Article 4: providers and deployers must now take measures to support their staff’s AI literacy, with no guarantee owed for any one person’s level. For a US company, Article 2(1) on scope is the first thing to read, and our EU AI Act compliance checklist turns the dates into tasks.
How do you put one in place?
- Find the AI you already have. List every system in use, including AI features inside software you license and tools staff signed up for themselves.
- Classify each use by risk. Agree on a small number of tiers, and check every use against the AI Act’s Annex III if its output could reach the EU. An AI risk assessment gives each higher-tier system its own record.
- Name the people. An owner per system and an oversight group that approves high-risk uses, with one executive accountable for both. In our view, extending the data governance council’s charter can be quicker than building a new committee, as long as its members can judge AI risk.
- Write the AI policy on top of the data policies. Refer to the data governance policy for data quality and privacy instead of restating it, and add what is new, such as the banned uses and who approves the rest.
- Extend the data controls to AI data. Run the existing quality rules and lineage over training sets and prompts, and check the right to use every document a generative AI assistant answers from.
- Put gates on the lifecycle. Approval before production and monitoring after it, with a date set to decide whether each system stays.
- Keep the evidence and score it. Keep the records an auditor would ask for, and measure where the framework stands with our AI governance maturity model, once a year at least.
For a baseline before step 1, the free AI Readiness and Maturity Assessment in Data Maturity Pro includes a Governance and Compliance area, with questions that run from the AI policy and the inventory to incident handling and internal audit. For a single use case, an AI readiness assessment is the smaller first check; the AI maturity model covers the stages after it.
The map of parts in this post is our own reading of the sources it links. Level Up Your Data has no affiliation with the European Union, the IEC, ISO or NIST, and none of them endorses this post.
Frequently asked questions
What is the difference between AI governance and data governance?
Data governance asks whether data is right and properly used; AI governance asks whether a system built on that data should run at all, and keeps checking it after it does. That second job doesn’t end at launch: NIST notes that AI systems may need corrective maintenance more often than ordinary software, because of drift in their data or model.
What is ISO/IEC 42001?
It is the international standard for an AI management system, published in December 2023 by ISO and the IEC. Its requirements cover an organization’s AI management system from setting it up to improving it over time: the policies and processes it uses to develop, provide or use AI responsibly.
Who is responsible for AI governance?
In the NIST AI RMF, executive leadership takes responsibility for decisions about AI risk (GOVERN 2.3). In our view, each system also needs a named owner below that. For high-risk systems, the AI Act adds that deployers must assign human oversight to people with the competence, training and authority to do it, once the high-risk rules apply.
Do small organizations need an AI governance framework?
They need a short one. ISO/IEC 42001 is written for organizations of any size. The 2026 amendment to the AI Act eases two duties of providers of high-risk systems: SMEs with no partner or linked enterprises may meet certain quality management requirements in a simplified way, and SMEs and small mid-caps may use a simplified form for technical documentation. A firm that only deploys bought tools, without changing them, isn’t a provider and has neither duty. In our view, an inventory, an owner per system and a one-page AI policy are a sensible start for such a firm.
Summary
An AI governance framework reuses the owners and controls of data governance and adds what only AI needs, starting with risk classification and human oversight. Start this month with the inventory of every AI system you use, since every other part of the framework hangs off that list.