Published October 29, 2026
What AI governance is, and why now
AI governance is the set of decisions an organization makes about the AI it builds, buys and uses: who approves a use, how its risk is judged, what controls apply, and who watches it once it is live.
The EU AI Act made this a legal question for many organizations. It entered into force on August 1, 2024. Its prohibitions and its AI literacy duty have applied since February 2, 2025. The Act became applicable on August 2, 2026, with exceptions.
The Act distinguishes a provider, who develops an AI system and places it on the market or puts it into service under its own name, from a deployer, who uses an AI system under its own authority. An organization that buys an AI system and uses it is a deployer. Deployers of high-risk systems have their own obligations, set out in Article 26.
Who owns it, and how far it reaches
The first decision is where governance sits. One option is a separate AI review board. The other is to add AI questions to reviews that already exist: architecture, security, privacy, procurement and third-party risk.
A separate board gives one place to escalate, but it can become a queue that teams avoid. Existing reviews already see new software.
A third model combines the two: existing reviews handle low and medium risk, and a small group decides the high-risk cases and owns the policy. Either way, name one accountable executive and one owner for each AI system.
The frameworks
| Framework | What it is | Binding? |
|---|---|---|
| NIST AI RMF 1.0 | Released January 26, 2023. Four functions: Govern, Map, Measure and Manage. A Generative AI Profile, NIST AI 600-1, followed on July 26, 2024. | Voluntary |
| ISO/IEC 42001:2023 | Requirements for an AI management system, published December 18, 2023. Uses the harmonized structure shared by ISO management system standards, with identical clause numbers, clause titles and core text. | A standard, not a law; third-party certification available |
| EU AI Act | Regulation (EU) 2024/1689. Bans some practices, sets obligations for high-risk systems, and sets transparency duties for some others. | Law in the EU, including for providers and deployers outside the EU when the AI's output is used in the EU |
| Colorado SB26-189 | Signed May 14, 2026. Repeals and reenacts the 2024 Colorado AI Act (SB24-205) as rules on automated decision-making technology in consequential decisions such as employment, housing, lending, insurance and health care. Developer documentation duties start January 1, 2027. | Law in Colorado |
ISO/IEC 42001 states that its shared structure eases implementation alongside other management system standards, such as those for security and privacy. If you already run one, such as an ISO/IEC 27001 system, consider extending it rather than building a second.
NIST states that AI RMF 1.0 is being revised as part of the White House AI Action Plan.
The order of the work
- Build the inventory. List every AI system in use or in development, with its owner, its purpose, the data it uses, the vendor, and the decisions it influences. NIST AI RMF GOVERN 1.6 calls for mechanisms to inventory AI systems.
- Classify by risk. Define three or four tiers. Check every system against the EU AI Act categories: prohibited practices, the high-risk uses in Annex III such as recruitment, worker management, credit scoring and life and health insurance pricing, and the transparency cases in Article 50.
- Write the governance policy. Who approves what at each tier, which controls each tier requires, and when a system must be reviewed again.
- Set up review. Add AI questions to intake, procurement and architecture review. Route high-risk cases to the decision group. Agree a target turnaround for each tier and publish it.
- Add controls for high-risk systems. Apply the Article 26 deployer duties: human oversight, checks on input data you control, monitoring, log retention, and reporting risks and serious incidents to the provider.
- Cover suppliers. Add AI questions to third-party risk assessments and AI terms to contracts.
- Monitor and re-review. Report the inventory, review queue and incidents to the accountable executive.
What takes longer than expected
- The inventory. Expect AI to arrive inside software you already own, through vendor updates. Procurement records show what was bought, not which products now contain AI. Plan to repeat discovery.
- Agreeing what counts as AI. Settle a definition before the inventory starts. The EU AI Act defines an AI system in Article 3(1) as a machine-based system that infers from its input how to generate outputs such as predictions, content, recommendations or decisions.
- Vendor information. Deployers must use high-risk systems according to the provider's instructions for use. Check that older contracts require the vendor to supply them.
- Tiering the edge cases. Under Article 6(3), an Annex III system is not high-risk if, for example, it performs only a narrow procedural task or a preparatory task. A system that profiles people is always high-risk. A provider that relies on Article 6(3) must document its assessment.
The detail plans leave out
- Changing a system can make you its provider. Under Article 25, a deployer that puts its name on a high-risk system, substantially modifies one, or changes a system's intended purpose so it becomes high-risk takes on the provider's obligations. Review triggers must catch these changes.
- Logs. Deployers of high-risk systems must keep the logs the system generates, where they control them, for at least six months unless other law says otherwise.
- Telling workers. An employer must inform workers' representatives and affected workers before using a high-risk AI system in the workplace.
- Named overseers. Deployers must assign human oversight to people with the necessary competence, training and authority.
- Retirement. NIST AI RMF GOVERN 1.7 calls for processes to decommission AI systems safely. Give each inventory entry an end date and an exit step.
The regulatory calendar and the contracts
The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on July 24, 2026 and entered into force on July 27, 2026. It moved the high-risk dates.
| Obligation | Applies from |
|---|---|
| Prohibited practices and AI literacy | February 2, 2025 |
| General-purpose AI model obligations | August 2, 2025 |
| Transparency duties in Article 50, and general application | August 2, 2026 |
| Machine-readable marking for generative systems already on the market before August 2, 2026 | December 2, 2026 |
| New bans on AI that generates non-consensual intimate content or child sexual abuse material | December 2, 2026 |
| High-risk systems listed in Annex III | December 2, 2027 |
| High-risk systems in products covered by Annex I | August 2, 2028 |
| Existing high-risk systems intended for use by public authorities | August 2, 2030 |
The Omnibus also softened the AI literacy duty. Providers and deployers must take measures to support the AI literacy of their staff, and are not required to guarantee any individual's level.
Fines for prohibited practices reach 35 million euros or 7% of worldwide annual turnover, whichever is higher. Breaches of deployer or transparency obligations reach 15 million euros or 3%. For SMEs, the lower figure applies. Since the Omnibus, small mid-cap companies also get the lower figure, except for prohibited practices.
In AI vendor contracts, ask for the instructions for use and technical documentation, notice of material model changes, incident notification, cooperation with your logging and oversight duties, and a statement of whether your data is used to train their models.
Skills and operations
Plan to draw on legal, privacy, security, data science and procurement, with a small core team that runs the inventory and the review queue.
Budget for reviewer time. Track the review queue from the first month. Treat a growing queue as a warning that teams may go around the process.
Settle these first
- Which executive is accountable for AI governance?
- What counts as an AI system for your inventory?
- Are you a provider or a deployer for each system, and could a planned change make you a provider?
- Which of your uses fall under Annex III, and are any used in the EU?
- Will governance sit in existing reviews, in a separate board, or both?
- Will you align to NIST AI RMF, certify to ISO/IEC 42001, or both?
Questions
- Has the EU AI Act high-risk deadline moved?
- Yes. The Digital Omnibus on AI moved high-risk obligations for Annex III systems from August 2, 2026 to December 2, 2027, and for systems in Annex I products from August 2, 2027 to August 2, 2028. The original prohibitions still apply from February 2, 2025.
- Do we need ISO/IEC 42001 certification?
- Neither the EU AI Act nor the Digital Omnibus mentions ISO/IEC 42001. A certificate from a third-party certification body gives customers and auditors independent evidence that an AI management system exists.
- Is the NIST AI RMF mandatory?
- No. NIST states it is intended for voluntary use.
- Does the EU AI Act apply to AI we buy rather than build?
- Yes, if you use it in the EU or its output is used in the EU. An organization that uses an AI system under its own authority is a deployer. Deployers of high-risk systems carry the Article 26 duties described above.