An AI governance framework you can run next quarter
An AI governance framework is the set of roles, steps and records that decide how AI may be used in your organization. A workable one gives every AI system the same path: it is registered, described in a requirements document, approved in concept by the CISO at Gate 1, assessed for risk before and after controls, approved for production at Gate 2 with a kill switch, reported to the board and kept as audit evidence.
- 01
Discover
Employee reports, identity-provider imports or a spreadsheet surface the AI in use.
Reviewer - 02
Triage to the AI register
Each finding becomes an AI system, a non-AI tool or a duplicate, with an owner.
ReviewerSystem owner - 03
Requirements document
Purpose, data, users and expected controls are written down before approval.
System owner - 04
Gate 1: concept approval
The security executive decides whether the idea can proceed, with conditions.
CISO - 05
Risk in dollars
Risk is estimated before and after controls, then the figures are validated.
CFO validates - 06
Gate 2: production approval
Release is approved with a named owner and a kill switch notice.
CISO - 07
Board briefing
Approved systems, open conditions and residual risk roll up for leadership.
Board - 08
Audit package out
A structured package goes to your auditor and to your monitoring tool.
AuditorDay 2 tool
then Day 2 monitoring →
One AI system moves through eight steps. It is discovered, triaged into the AI register, described in a governance requirements document, approved in concept by the CISO at Gate 1, assessed for risk in dollars before and after controls with the CFO validating the figures, approved for production by the CISO at Gate 2 with a kill switch notice, included in a board briefing, and finally exported in an audit package to the auditor and to the Day 2 continuous monitoring tool.
The components
Six components make up a framework that people will actually follow.
- Roles and a governance board: who decides, who owns each system, who validates the numbers.
- An AI register: one list of every AI system, with an owner.
- A requirements document: purpose, data, users, regulations and expected controls, written before approval.
- Two approval gates: concept approval, then production approval.
- Risk in dollars: estimated before and after controls, validated by finance.
- Reporting and evidence: a board briefing and an audit package built from the same records.
Why two gates
One approval at the start misses what changed during the build. One approval at the end arrives too late to change the design. Gate 1 lets the CISO stop or condition an idea cheaply; Gate 2 confirms that the conditions were met, names the owner and records who can switch the system off and how quickly.
How the framework relates to NIST AI RMF, ISO 42001 and the EU AI Act
The framework is the operating process. NIST AI RMF, ISO/IEC 42001 and the EU AI Act are sources you map it to. The same register, requirements documents and approval records supply evidence for each. See the comparison of EU AI Act, NIST AI RMF and ISO 42001.
Starting small
Name the roles, set a meeting calendar, list the AI systems you know about, and run your next AI request through the two gates. A simple process used every time beats a thorough policy nobody follows. The free starter kit includes a board charter, an intake form, a requirements document template and an approval checklist.
Frequently asked questions
- What is an AI governance framework?
- The roles, steps and records that decide how AI may be used in an organization: a register of AI systems, a requirements document, approval gates, risk assessment, reporting and audit evidence.
- How do I govern AI in my company?
- Give every AI system the same path: register it, write a requirements document, approve the concept at a first gate, assess risk before and after controls, approve production at a second gate with a kill switch, and report to the board on a schedule.
- What is an AI governance board?
- A standing cross-functional group, typically security, finance, legal and privacy, engineering or data, and a business sponsor, that sets AI rules, reviews higher-impact systems, decides on residual risk and assigns an owner to each system.