Glossary
AI governance
Written with AI from the sources below and checked against our facts sheet. Last checked . How this site is made · Spot an error?
Part of: AIGP certification and exam
AI governance is the set of policies, roles, processes and controls an organization uses to direct how AI is built, bought and used. It assigns accountability, sets risk appetite and keeps each AI system lawful, safe, fair and aligned with the organization's values throughout its life.
In plain English
Think of how a company governs money. Nobody bans spending. Instead, the company decides who may approve which amounts, keeps records and pays auditors to check the books. AI governance does the same job for AI.
It answers three questions for every AI system: who decides, who does the work, and who answers for the outcome. Governance is not one document. It is a structure (people and committees), a rulebook (policies and standards) and a set of routines (intake, risk review, monitoring and audit). It covers AI the organization builds and AI it buys.
Example
Hollin Freight, a fictional logistics company with 2,500 staff, discovers 30 AI tools in use and nobody in charge of them. It stands up governance in this order:
- It checks for an existing structure and extends its privacy council instead of starting from zero.
- The chief operating officer becomes executive champion, with budget and authority.
- A small AI governance office takes on the daily work: an AI inventory, an intake form and risk-tiered reviews.
Then implementation begins. A route-planning tool gets a light review. A driver-monitoring tool that could inform dismissals goes to the cross-functional committee (legal, privacy, security, HR and operations) for a full impact assessment. Each system gets a named owner. A year later, internal audit tests whether the controls actually work.
Why it matters
No single law defines "AI governance", but the main frameworks require its building blocks:
- The NIST AI RMF makes GOVERN a cross-cutting function. It covers policies, accountability, training and risk culture, and informs MAP, MEASURE and MANAGE.
- ISO/IEC 42001 (December 2023) is a certifiable AI management system standard. It requires leadership commitment, defined roles, risk assessment and continual improvement.
- The EU AI Act does not impose "AI governance" by name. It does require AI literacy measures from everyone (Art. 4). High-risk providers need a risk management system (Art. 9) and a quality management system with an accountability framework (Art. 17). Deployers have duties under Art. 26.
- The OECD AI Principles name accountability as one of five values-based principles.
One theme runs through all of them: accountability stays with the organization that uses the AI. A vendor contract can shift costs, but not responsibility. Governance also sets the frame for AI risk management and for controlling shadow AI.
How the AIGP exam tests it
AI governance is the subject of the whole exam, but Domain I tests the structure directly (lesson I.B.1). Expect scenarios asking who should own a decision and what to do first.
Common traps:
- The lone "AI czar". One person cannot cover legal, security, ethical and technical risk. The best answer pairs an accountable executive with a cross-functional body.
- "Everyone is responsible." Shared accountability is no accountability. Look for exactly one accountable owner per decision.
- Implementation before structure. Mapping laws, building an inventory and training staff come after the structure exists.
- The wrong assurer. The governance office designs the controls, so it cannot independently test them. That is internal audit's job as the third line.
The tell: the right answer names an owner, brings in several functions and scales review depth to the risk of each use.
Frequently asked questions
What is the difference between AI governance and AI ethics?
AI ethics is the set of values AI should respect, such as fairness, privacy and human dignity. AI governance is the machinery that puts those values into practice: owners, policies, reviews, controls and audits. Ethics says what is right. Governance makes sure the organization acts on it consistently and can show the evidence.
Is AI governance required by law?
Not under that name, but laws require its parts. The EU AI Act requires AI literacy measures from all providers and deployers (Art. 4). High-risk providers also need risk and quality management systems (Arts. 9 and 17). Voluntary frameworks such as the NIST AI RMF and ISO/IEC 42001 describe a full program.
Who is responsible for AI governance in an organization?
The board sets risk appetite and holds leaders accountable. An executive champion gives the program authority and budget. A cross-functional committee approves policy and reviews high-risk uses. A governance office runs the program day to day. Each AI system has a named owner, and internal audit gives independent assurance that controls work.
What is the first step in setting up AI governance?
Check whether a structure already exists, such as a privacy or data governance council that could take on AI. Next, name an executive champion. Then decide who will maintain and implement the structure. Only after that does implementation start: mapping laws, building an AI inventory and training staff.