It's difficult enough to talk about AI governance needs in the abstract, let alone translate those AI governance goals into action.
Leading AI standards and frameworks, among them NIST AI RMF and ISO/IEC 42001, can help. But each organization's approach to AI governance varies. Let's examine some tactics designed to help companies control AI risks and liabilities pragmatically. These strategies can help organizations put the proper governance policies, guardrails and monitoring capabilities in place.
What is AI governance?
AI governance refers to the steps a business takes to align its AI systems with internal risk tolerance and compliance requirements.
Each AI governance strategy is different, depending on which AI assets a business deploys and which governance standards or frameworks it chooses to follow. But core components typically include the following:
- ID of all AI systems or assets used within the business, including shadow AI resources.
- Policies that define acceptable ways employees can use the business's AI assets.
- Controls capable of enforcing the rules described in governance policies.
- Assessment and reporting processes that enable the business to document its governance operations and outcomes, as well as identify potential gaps or shortcomings.
The special challenges of AI governance
Governance is not unique to AI systems; it applies to virtually every IT resource to help mitigate risks and liabilities.
AI governance operations, however, include special practices or requirements -- such as remediating potential AI bias or achieving a certain level of AI transparency -- that don't typically apply in other IT governance contexts. Therefore, implementing AI governance often requires more than simply applying existing governance policies, controls and tools to AI assets.
Instead, the business might need to modify policies and controls, or develop new ones, to accommodate the unique demands of AI governance. Governance and compliance tools designed specifically for AI might also play an important role in meeting AI governance needs.
AI governance frameworks and standards
Several organizations and standards bodies have developed AI governance frameworks or standards. Two dominate:
- NIST AI RMF. NIST introduced an AI risk management framework in 2023 that breaks AI governance into four core functions: govern, map, measure and manage.
- ISO/IEC 42001. This standard from the International Organization for Standardization (ISO) also debuted in 2023. It's similar in scope and coverage to NIST AI RMF; however, its structure and approach, which center on a plan-do-check-act model, differ from the four NIST AI RMF functions. ISO/IEC 42001 is also a certifiable standard that businesses can use as the basis for formal audits, whereas NIST AI RMF is a voluntary, non-certifiable framework.
Other AI governance frameworks or guidance exist. These include the E.U. AI Act -- a legal framework that requires organizations to manage specific types of AI-related risks -- and the OECD AI Principles, which provide high-level guidance on developing safe, secure and fair AI systems. For now, however, most businesses rely on NIST AI RMF and ISO/IEC 42001 to shape their AI governance priorities.
Putting AI governance into practice: A step-by-step guide
Defining high-level AI governance goals that align with frameworks like NIST AI RMF and ISO 42001 is the first step. The real question facing CIOs, CISOs and compliance teams is how to translate AI governance goals into action.
For the typical business, a practical approach to operationalizing AI governance involves the following five key steps.
1. Assess existing governance policies and controls
Examine which governance policies and controls the business already has in place. Evaluate the extent to which those resources apply to AI systems.
Many businesses are likely to have implemented data governance policies that define how organizational data can be used, designate data stewards and articulate data security, privacy and quality goals. Controls might also exist that enforce these policies by, for example, automatically detecting data that is not properly secured or by scanning resources to check for data quality issues such as incomplete or duplicate information.
In many cases, teams can extend or adapt existing policies to support AI systems.
2. Identify AI governance gaps
After assessing existing policies and controls, determine which AI governance requirements they leave out.
AI governance frameworks, including NIST AI RMF and ISO/IEC 42001, include components aimed at mitigating AI bias. Even at organizations that have implemented governance policies and controls to manage bias in other systems -- such as HR platforms that use algorithms, but not large language models (LLMs) to evaluate job candidates -- these resources might not fully address the unique challenges of bias in modern, LLM-based AI systems. Detecting and mitigating bias in modern AI often requires different approaches due to complexities like explainability limitations in AI models.
3. Close governance gaps
To close the gap between existing governance resources and AI governance needs, businesses typically need to do one of the following:
- Modify current policies or controls. For example, the business might need to extend its data governance policy to include provisions ensuring that data used for AI training is unbiased.
- Create new policies or controls. In situations where AI systems introduce new types of governance requirements that fall outside the scope of existing resources, businesses can develop new governance policies.
4. Automate and scale AI governance
Operationalizing AI governance requires the automation of governance workflows and controls. Tools should continuously monitor for situations in which a resource fails to comply with governance policies, or when a system is not being governed at all -- which might occur if employees use shadow AI tools or services.
Automatically generating evidence of compliance with governance policies and controls might be important for meeting regulatory requirements and passing audits. Governance and GRC platforms -- discussed in more detail below -- can help automate AI governance.
5. Revisit and revise governance strategy
AI governance requirements are likely to change as businesses that develop AI governance frameworks roll out updates, expansions or additional guidance. Case in point: the NIST AI RMF conceptual note on critical infrastructure, which NIST released three years after introducing the AI RMF itself. The AI systems that businesses deploy will also change over time.
For both reasons, establish a process to reassess and update AI governance rules. Some businesses do this by including statements in their governance policies that specify when to reassess, such as at regular intervals and/or in response to events that trigger reevaluation.
The role of automated governance platforms
As noted above, AI governance at scale is virtually impossible without automation. Since it's rarely practical or cost-effective to build custom governance control enforcement tools, monitoring software or reporting capabilities in-house, many businesses adopt automated governance platforms from third-party vendors.
Automated AI governance platforms are available in two main categories:
- Platforms specifically designed for AI governance. These tend to offer the most value for businesses that deploy complex AI systems or face complex AI-related regulatory requirements.
- Generic governance, risk and compliance (GRC) tools. These centralize the tracking, enforcement and reporting of governance policies across the organization with a focus on meeting compliance requirements. Capabilities specific to AI governance might not be as mature or as sophisticated in general-purpose GRC software. But that is likely acceptable for businesses that can meet their AI governance needs by extending existing governance policies rather than investing in a system purpose-built for AI governance.
How to operationalize AI governance with leading standards
Consider the following tactics when aligning effective AI governance with standards like the NIST AI RMF or ISO/IEC 42001:
- Treat AI standards as a starting point, not a definitive guide. Frameworks like NIST AI RMF and ISO/IEC 42001 offer excellent guidance on which types of AI risks businesses should address. But every business is unique, and it's important to adapt framework guidance to reflect organizational priorities.
- Think beyond compliance. Complying with regulatory requirements is often a top priority in AI governance, but governance strategies shouldn't stop there. They should also enhance the business' ability to maximize the value it derives from AI systems by ensuring these systems remain secure, reliable, transparent and unbiased -- even in contexts where compliance is not at stake.
- Designate clear stakeholders. Every governance initiative should include clear roles and responsibilities to define who writes policies, who implements controls and who generates and interprets evidence.
- Include diverse stakeholders. Ideally, the stakeholders in the AI governance process should represent a multitude of business units. More perspectives generally translate into more actionable, realistic governance policies and controls.
- Use a phased implementation strategy. Create governance policies and controls for high-risk or mission-critical AI systems before moving onto others.
- Make policies consistent across the business. The best governance rules are consistent; they hold all business units and systems to the same standards. This does not, however, mean that individual controls need to be the same everywhere. On the contrary, controls might vary depending on which AI system they support, who is using the system and so on.
- Plan for ongoing AI technology change. Effective AI governance policies and controls are also broad and adaptable enough to work with any type of system. They shouldn't assume, for example, that the business will always use a specific type of AI model or agentic platform.
Chris Tozzi is a freelance writer, research adviser, and professor of IT and society who has previously worked as a journalist and Linux systems administrator.
