Setting up an AI governance framework: from scattered rules to control

Short answer: AI governance is not a single measure but a coherent system: knowing which AI you use, who is responsible, which rules apply, how you assess risk and how you adjust. The AI Act prescribes the individual duties; standards such as ISO/IEC 42001 and the NIST AI RMF provide the structure to make them manageable. You don't have to start big — but you do have to start coherently.

Why a framework, not scattered actions

The obligations come from several directions at once: AI literacy (Art. 4), risk management (Art. 9), deployer duties (Art. 26), the fundamental-rights assessment (Art. 27), monitoring and incident reporting (Art. 72-73), plus the GDPR. Tackle them as separate projects and you get overlap, gaps and no overview. A framework reduces the duties to one set of processes and one line of accountability.

The building blocks

1. Inventory. Map every AI system — including bought-in tools and generative assistants. See AI system inventory.
2. Classification. Determine each system's regime: prohibited, high-risk, transparency-bound or minimal. The self-scan does this with reference to the source.
3. Roles and ownership. Appoint someone accountable (the board, an AI officer or committee) and assign an owner per system. Without an owner every measure fades.
4. Policy. Set clear rules: acceptable use, procurement, human oversight, handling of data and of generative AI.
5. Literacy. Make sure those who work with AI understand the system — an applicable duty, and the basis for effective oversight.
6. Risk and rights assessment. Combine the FRIA (where required) with a DPIA for personal data.
7. Monitoring and incidents. Set up logging, periodic review and a reporting route for serious incidents.
8. Lifecycle and suppliers. Ensure updates, retraining and contractual terms keep tracking the system — see AI in contracts.

Lean on an existing standard

You don't have to reinvent the wheel. ISO/IEC 42001 provides a certifiable management system (AIMS) with exactly this cycle; the NIST AI RMF orders risk management into govern, map, measure and manage. If you already run ISO 27001 for information security, you'll recognise the structure and can hook AI governance onto it rather than beside it.

Start in proportion

Match the weight to your risk. An SME with a few generative assistants needs a register, a use policy and literacy. An organisation that builds or deploys high-risk systems needs the full package. The order is always the same: first see what you have, then classify, then assign and assure.

Governance is not a document but a rhythm: inventory, assess, adjust, repeat. The organisation that sets that rhythm now faces no surprises at the next new rule — or the next supervisory question.