AI Governance

AI governance is the organizational machinery that decides whether a model gets built, how it gets reviewed, and who is accountable when it fails — distinct from AI ethics, which asks what principles a system should follow, and distinct from AI regulation, which is what a government requires by law. Governance is the practical layer between the two: the committees, review gates, documentation standards, and monitoring processes an organization actually runs so that stated principles and legal requirements translate into something enforced on a specific model before it ships, not just written down somewhere.

NIST's AI Risk Management Framework organizes governance around four functions that are meant to run continuously, not once at launch. The NIST AI RMF (2023) structures the work as Govern — set organizational policy, roles, and accountability before any model work starts; Map — understand the specific context, intended use, and risks of a given system; Measure — analyze and track risk with concrete metrics, not just qualitative judgment; and Manage — actually respond to identified risks and monitor the system after deployment. The framework is voluntary rather than mandatory in the US, but it has become a common reference architecture that other standards and internal governance programs are built around, specifically because it treats governance as an ongoing cycle tied to each system's lifecycle rather than a one-time checklist filled out before launch and then forgotten.

The three-lines-of-defense model, borrowed directly from financial risk management, is the organizational structure most AI governance programs actually run on. The first line is the team that builds and operates the model — they own the risk day to day and are closest to the technical details. The second line is an independent risk, compliance, or AI governance function that reviews and challenges the first line's work without being part of the team that built it, which is the structural feature that makes the review meaningful rather than a formality — the same people who built a system reviewing their own work tends to miss what an independent reviewer catches. The third line is internal audit, periodically checking that the first two lines are actually functioning as designed, rather than just checking the model itself. This structure predates AI governance by decades — it's the same model banks have used for general risk management since well before machine learning was a governance concern — and it was adapted to AI specifically because it already solved the core problem of how to make independent review stick inside an organization that also wants to move fast.

Model cards and datasheets turned ad hoc documentation into a governance artifact with a standard shape. Mitchell and colleagues' model cards (2019) specify a consistent format for documenting a trained model's intended use, performance across subgroups, known limitations, and training data characteristics — information that used to live, if it existed at all, scattered across a team's internal notes rather than in a reviewable document. Gebru and colleagues' datasheets for datasets (2018) do the same for training data itself, documenting provenance, collection methodology, and known gaps. Neither format is a legal requirement by default, but both have become the de facto documentation standard a second-line review expects to see before approving a system, precisely because a review process is only as good as what the reviewer can actually inspect — an undocumented model is not reviewable in any meaningful sense, whatever informal assurances its builders offer.

ISO/IEC 42001 made AI governance certifiable the way information security governance already was. Published in 2023, it's the first international standard for an AI management system, modeled closely on ISO 27001's approach to information security management — defining the policies, roles, and continuous-improvement processes an organization needs, and allowing a third party to formally certify that an organization's AI governance program meets the standard. This matters commercially in a specific way: certification gives an organization a recognized, external signal of governance maturity it can show to customers, regulators, and partners, rather than only an internal claim that governance processes exist — the difference between "we have a review process" and "an independent auditor verified we have a review process that meets a published standard."

Read AI governance as the answer to a narrower question than AI ethics or AI regulation ask: not "what should a system do" and not "what does the law require," but "what process, inside this specific organization, actually catches a problem before a model ships, and who is accountable if it doesn't" — which is why the field has converged on structures borrowed from older risk disciplines rather than inventing new ones, since the core problem of making independent review stick inside an organization under pressure to move fast was never unique to AI in the first place.