How organisations keep AI systems lawful and accountable: the NIST AI Risk Management Framework, the EU AI Act's risk tiers, management-system standards, and how to turn them into concrete engineering controls such as inventories, model cards and deployment gates.
AI governance is the set of policies, roles, processes and technical controls an organisation uses to make sure the AI systems it builds or buys are lawful, safe, fair and accountable. Regulation is the external part: laws and standards that say what must be done. Governance is the internal machinery that turns those requirements, plus the organisation's own risk appetite, into everyday engineering practice.
For practitioners this is less abstract than it sounds. Governance shows up as a model inventory you must register in, a risk assessment before launch, documentation such as model cards and datasheets, an approval step, and logging and monitoring requirements in production. This page covers the two frameworks you are most likely to meet, the NIST AI Risk Management Framework and the EU AI Act, and how to implement them in a machine-learning workflow. It describes well-established structure only; for legal obligations always read the primary texts and take legal advice.
Published by the US National Institute of Standards and Technology in January 2023, the AI RMF is voluntary and sector-neutral. Its core has four functions. Govern establishes the culture, accountability, policies and processes and applies across everything else. Map establishes context: what the system is for, who it affects, and which risks arise. Measure uses quantitative and qualitative methods to analyse and track those risks. Manage prioritises risks and allocates resources to treat, transfer or accept them. The framework also lists characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed. NIST later published a companion profile for generative AI (NIST AI 600-1, 2024).
The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024, with obligations phasing in over the following years. It is risk-based. A short list of practices is prohibited. High-risk systems, those used as safety components of regulated products and those in listed areas such as employment, education, access to essential services, law enforcement and migration, must meet requirements including a risk-management system, data governance, technical documentation, record-keeping, transparency to deployers, human oversight, and accuracy, robustness and cybersecurity, and undergo conformity assessment. Limited-risk systems carry transparency duties, such as telling people they are interacting with an AI system and marking AI-generated content. Everything else is minimal risk. Providers of general-purpose AI models have separate documentation and copyright-policy duties, with extra obligations for models deemed to pose systemic risk.
The Act distinguishes the provider, who develops a system or has it developed and places it on the market under its own name, from the deployer, who uses it in a professional capacity. Most heavy obligations for high-risk systems fall on providers, while deployers must, among other things, use the system according to its instructions, assign competent human oversight and keep the logs it generates. An engineering team that fine-tunes a vendor model and ships it inside its own product can become a provider, so it is worth establishing your role for each system early, during intake rather than at launch.
ISO/IEC 42001:2023 specifies an AI management system that organisations can be certified against, in the style of ISO 27001 for security. ISO/IEC 23894 gives guidance on AI risk management. The OECD AI Principles (2019, updated 2024) are a widely adopted high-level statement of values.
A practical way to start is a machine-readable model inventory record created at use-case intake and checked automatically in CI before deployment. The YAML below is an illustrative internal schema, not a format mandated by any regulation; the Python gate refuses to deploy a high-risk model that lacks required evidence.
model_id: credit-limit-scorer
version: 3.2.0
owner: risk-analytics@example.com
use_case: Suggest credit limit increases for existing customers
risk_tier: high # internal tier, mapped to EU AI Act category
affected_people: retail customers
human_oversight: analyst approves every decrease
training_data:
sources: [core_banking.transactions_2019_2024]
personal_data: true
lineage_doc: docs/lineage/credit-v3.md
evaluations:
accuracy_auc: reports/eval_v3.html
fairness: reports/fairness_v3.html
robustness: null # missing -> gate will fail
model_card: docs/model_cards/credit-v3.md
monitoring:
drift_dashboard: dashboards/credit-drift
incident_contact: ai-incidents@example.comimport sys, yaml
REQUIRED = {
"high": ["model_card", "human_oversight", "monitoring",
"evaluations.accuracy_auc", "evaluations.fairness",
"evaluations.robustness", "training_data.lineage_doc"],
"limited": ["model_card", "monitoring"],
"minimal": ["model_card"],
}
def get(d, dotted):
for k in dotted.split("."):
d = d.get(k) if isinstance(d, dict) else None
return d
rec = yaml.safe_load(open(sys.argv[1]))
missing = [f for f in REQUIRED[rec["risk_tier"]] if not get(rec, f)]
if missing:
print(f"BLOCKED {rec['model_id']} {rec['version']}: missing {missing}")
sys.exit(1)
print("governance gate passed")Run it as python gate.py model.yaml in the deploy pipeline. With the record above it prints BLOCKED ... missing ['evaluations.robustness'] and exits non-zero, which stops the release until the evidence exists.
| Instrument | Type | Scope | What it asks of you |
|---|---|---|---|
| NIST AI RMF 1.0 | Voluntary framework (US) | Any organisation, any sector | Govern, Map, Measure, Manage risks; trustworthy-AI characteristics |
| EU AI Act | Binding regulation (EU) | Providers and deployers placing AI on the EU market | Obligations scaled by risk tier; conformity assessment for high risk |
| ISO/IEC 42001 | Certifiable standard | Organisation-wide management system | Policies, roles, risk assessment, continual improvement, audits |
| GDPR | Binding regulation (EU) | Any processing of personal data | Lawful basis, data minimisation, rights around solely automated decisions |
| OECD AI Principles | Intergovernmental principles | Governments, adopted widely | High-level values; no direct obligations |