ModelRefs / AI Governance — AI Glossary

AI Governance — AI Glossary

The policies, processes, roles, and controls organizations implement to manage AI risk, ensure accountability, and maintain compliance.

Overview

AI governance covers model selection, vendor risk, data provenance, usage policies, audit trails, incident response, and board-level oversight. Frameworks: NIST AI RMF, ISO 42001, EU AI Act. Operationally implemented through shadow AI audits, acceptable use policies, and model risk management.

Reference details

Topicgovernance
Last reviewed2026-06-24

How it works

  1. An inventory is established first, because nothing can be governed that is not known to exist — which model versions are deployed, in which product surfaces, serving which decisions.
  2. Each use case is classified by risk against a stated scheme, so the controls that follow are proportionate rather than uniform.
  3. A gate sits before deployment requiring named artifacts — an evaluation result, a data provenance record, a named approver — and the gate is what converts a policy into a constraint.
  4. Serving writes an immutable record per decision: model version, the inputs it saw, the output returned, and the approval under which it was running.
  5. Deployed use cases are re-evaluated on a schedule, since the model, the data and the regulation all move independently of each other.
  6. Incident response is defined in advance with a rollback path to a known-good version, because the point at which a response plan is needed is not the point at which one can be designed.

Example: The question an auditor actually asks

Not “do you have a policy?” but “show me which model version answered this customer on 14 March, what data it saw, who approved that deployment, and what your evaluation said at the time.” Governance is whatever makes that answerable months later. If the answer requires archaeology, the governance is aspirational.

Commonly confused with

Governance is not the same as compliance. Compliance is meeting a specific external requirement; governance is the internal apparatus that makes compliance demonstrable and repeatable. You can pass an audit without governance — once.

When to use it

Reach for it when:

  • AI touches regulated decisions, personal data, or material spend
  • More than one team deploys models and consistency matters
  • You are subject to the EU AI Act, ISO 42001 or a sector regulator

Reach for something else when:

  • As a document nobody references — unenforced governance is worse than none, because it is evidence you knew
  • At a weight that stops experimentation on genuinely low-risk internal tools

Referenced by

This term is used by the following ModelRefs references:

Continue your research

Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to AI Governance — AI Glossary.

Frequently asked questions

What is AI Governance?

The policies, processes, roles, and controls organizations implement to manage AI risk, ensure accountability, and maintain compliance.

What concepts are related to AI Governance?

Closely related concepts include eu ai act, responsible ai.