AI governance framework

An AI governance framework is a structured model for managing AI risk and accountability, setting out the principles, roles, risk tiers, and controls an organisation applies across the life of an AI system.

Published frameworks give you the vocabulary and the structure: risk classification, defined roles, documentation duties, monitoring after deployment. Widely referenced examples include the NIST AI Risk Management Framework and the ISO/IEC 42001 management system standard. Check the current text of any framework before relying on it, since this area is moving quickly.

What a framework does not give you is enforcement. It tells you that high-risk uses need human oversight; it does not stop a team pointing an assistant at a folder it should not see.

The gap between the two is where most programmes live. A framework is the map, and the controls inside your tools are the road. Treating adoption of a framework as completion of governance is the common and expensive mistake.