AI governance
Definition
AI governance is the set of rules, owners and checks an organization uses to decide which AI uses are allowed, how their risks are handled, and who answers when something goes wrong. In the US, NIST publishes a voluntary framework for it, the AI Risk Management Framework.
By Ronan Liedmeier, fractional head of growth and course author · Published 17 October 2026 · Last updated 17 October 2026
Also called: AI risk management, AI policy
Without it, companies drift to anything goes or to a blanket ban that pushes people onto personal accounts as shadow AI.
How it works
The NIST AI Risk Management Framework, released on January 26, 2023 and meant for voluntary use, sorts the work into four functions. Govern builds a culture of risk management and runs across the other three. Map sets the context for the risks of a specific AI system. Measure analyzes and tracks those risks with quantitative, qualitative or mixed methods. Manage puts resources on the risks that were mapped and measured, on a regular schedule.
Example
The operations head of a 40-person online retailer writes a one-page AI policy. It names her as owner and sets two red lines: no customer data in personal AI accounts, and no AI-written email to customers without a person approving it. Each AI workflow gets a row in a shared sheet listing the data it touches and who reviews its output.
Common mistake
Writing a long responsible-AI policy and stopping there. A policy with no risk list per system and no measurement covers Govern and skips the other three functions. The other frequent failure is leaving every decision to IT, when the people who see the business consequences sit in sales, finance and operations.
Learn it in AI Academy
- Governance That Enables Instead of StranglesExpert · 8 min
Related terms
- Shadow AI
- Shadow AI is the use of AI tools at work without the company's approval or knowledge, such as staff pasting client documents into a personal chatbot account. It creates data risk, and it also shows where people already find AI useful.
- AI guardrails
- AI guardrails are checks and limits placed around an AI system that block or flag unsafe or wrong inputs and outputs before they cause harm. The strongest ones run as code outside the model, so a cleverly worded request can't talk its way past them.
- Human in the loop
- Human in the loop is a setup where an AI system pauses at set points so a person can approve or correct its work before it takes effect. It is used for actions that are hard to undo, such as sending emails to customers or moving money.
- AI observability
- AI observability is the practice of recording what an AI system does on every run, including each model call, tool call, cost and time taken, so you can see why it behaved the way it did. It is how teams debug and monitor AI once it runs on real work.