Skip to content
Dx
DOCReference

AI Governance — Practical Reference

AI Governance Frameworks — Practical Reference

Status: Shared language, not a replacement for judgment.

Use these as shared language and structure. None of them replace judgment.

Primary references (2026)

Framework Type Best used for Key idea
NIST AI Risk Management Framework (AI RMF) Voluntary guidance Most organizations, especially US-centric Four functions: Govern → Map → Measure → Manage. Includes Generative AI Profile.
ISO/IEC 42001 Certifiable management system standard Organizations that want external evidence of a formal AI management system Plan-Do-Check-Act cycle applied to AI; policies, risk, lifecycle, continual improvement.
EU AI Act Binding regulation (risk-based) Any organization with EU users or operations Prohibited / High-risk / Transparency / Minimal. High-risk obligations phased (major obligations 2027–2028). Forces explicit classification and human oversight for higher-risk uses.

Lightweight operating model (recommended default)

Combine the useful parts into something small enough to actually run:

  1. Inventory — Know what AI systems and significant uses exist.
  2. Classify — Low / Medium / High consequence (inspired by EU risk tiers + NIST mapping).
  3. Own — Named human owner with authority to pause or stop.
  4. Contract — Clear statement of allowed actions, data, and prohibitions (from Building & Agents).
  5. Measure — Baseline and ongoing signals for value and failure.
  6. Review — Cadence matched to risk (high = frequent, low = light).

This is enough for most teams. Add NIST, ISO, or EU AI Act detail only when the risk or the jurisdiction requires it.

See also the governance rules in Leadership & Adoption Module 3 (match process weight to actual risk) and the ownership map in Leadership & Adoption Module 5 (monitoring, shutdown authority, communication, learning).

How to Use This Section

  • Program owners: Use this model with the implementation timeline to avoid both chaos and bureaucracy.
  • Everyone: Treat external frameworks as tools, not as the goal. The goal is better decisions with clear ownership.