Most organisations that are building an AI governance framework for the first time face the same challenge: they need to govern AI systems that are already deployed, while simultaneously designing governance architecture for systems in development or planned. The framework must work retrospectively and prospectively, must be proportionate to the organisation's actual AI footprint, and must be credible to regulators. Start with the Inventory The foundation of any AI governance framework is a complete inventory of AI systems in use. AI is often deployed at team or department level without central visibility. Models developed by business teams using off-the-shelf tools, vendor-supplied AI components embedded in operational software, and AI capabilities accessed through API connections to third-party platforms may all be in use without having been subject to any governance assessment. The inventory should capture each AI system's purpose, the processes it supports, the data it uses, the decisions it makes or influences, and who is currently accountable for its performance. Establish the Risk Tiers Not all AI systems require the same level of governance. A proportionate risk tiering system classifies AI systems by their regulatory significance, decision-making power, and potential for harm. Customer-facing AI systems making consequential decisions are tier one, requiring the most intensive governance. Internal efficiency tools with no customer impact and no regulatory significance are tier three, requiring minimal governance overhead. A governance framework that treats all AI systems equally will fail to protect against the risks that matter most. Define the Accountability Structure Every AI system must have a named accountable individual: a Senior Manager who is responsible for the system's performance, its compliance with governance requirements, and the response to any governance failures identified. This accountability must be genuine, not nominal. The accountable individual must have sufficient understanding of the AI system and sufficient authority over its operation to fulfil the accountability meaningfully. Documentation Standards Governance documentation for each AI system should cover: the business purpose and scope, the data inputs and their sources, the logic or model type, the output types and how they are used, the monitoring framework, the escalation and override procedures, the fairness assessment approach, and the accountability assignment. Documentation should be maintained and version-controlled. Monitoring and Review Governance frameworks that exist on paper but are not operated in practice provide no protection. The monitoring and review cadence must be defined and adhered to: monthly performance reviews for high-risk AI systems, quarterly for medium-risk, annual for low-risk. Each review should produce a documented output and any actions arising should be tracked to completion.
Frequently Asked Questions
Where do you start when building an AI governance framework?
With a complete inventory of all AI systems in use, including vendor-supplied AI components, team-level deployments, and API-accessed AI capabilities. The inventory is the baseline from which everything else is built.
What is an AI risk tiering system?
A classification system that assigns governance intensity based on regulatory significance, decision-making power, and potential for harm. Customer-facing AI systems making consequential decisions are tier one (most intensive governance). Internal efficiency tools with no customer impact are tier three (minimal governance overhead).
What documentation is required for each AI system?
Business purpose and scope, data inputs and sources, logic or model type, output types and how they are used, monitoring framework, escalation and override procedures, fairness assessment approach, and accountability assignment.
How often should AI governance be reviewed?
Monthly performance reviews for high-risk AI systems, quarterly for medium-risk, annual for low-risk. Each review should produce a documented output and actions tracked to completion.
Ready to act on this?
Start with the AI Workforce Blueprint™ — a fixed-price 2-3 week engagement that maps your specific opportunity and produces a board-ready roadmap.
Book a Blueprint Call →