Overview
AI governance establishes the policies, roles, processes, and oversight needed so artificial intelligence is developed and used responsibly. It sits at the center of an ISO 42001 AI Management System and can also run as a focused program for organizations not yet ready for full certification. Effective AI governance connects technical controls with business accountability, risk management, and impact on people.
What it covers
- AI policy, principles, and acceptable use
- Roles and accountability, including AI owners, risk owners, and oversight bodies
- AI system inventory and classification by risk and impact
- AI impact assessments for systems that affect individuals or automated decisions
- Risk management and control requirements across the AI lifecycle
- Oversight, escalation, and reporting to leadership
- Integration with information security, privacy, and quality management systems
How we help
Implementation, audits and maintenance.
Implementation
We help define AI governance structures, draft policy and principles, inventory AI systems, establish impact assessment and risk processes, and assign clear ownership. The result is a practical framework leadership can oversee and teams can follow.
Audits
Reviews of AI governance design and operation, including policy adherence, impact assessment completeness, and evidence of oversight. These reviews can support ISO 42001 readiness or stand alone as an independent assessment.
Maintenance
Ongoing support for AI inventory updates, periodic impact assessment refreshes, governance committee facilitation, and adjustments as AI use or regulations change.
Typical outcomes
What you have at the end
- Documented AI policy and principles
- Clear roles and accountability for AI systems
- A maintained inventory of AI systems with risk classification
- An impact assessment process in regular use
- Oversight and reporting leadership can rely on
- A foundation for ISO 42001 certification
Relevant credentials
Who does the work
Internal Auditor (I42001IA)
CertiProf · valid to Oct 2029AI Governance Fundamentals (I42001AIGF)
CertiProf · valid to Aug 2027Typical engagement
From gap analysis to certification.
Gap analysis
Current-state assessment against the standard and your obligations.
Risk assessment
Identify what could go wrong and plan how to treat it.
Governance & process design
Roles, policies and processes sized to how you operate.
Implementation & controls
Hands-on support designing and evidencing controls.
Internal audit & readiness
Independent internal audit and Stage 1 / Stage 2 preparation.
Training
Build capability so your team can run the system.
Related services
Often implemented together
Privacy Information Management
A standalone, certifiable PIMS under the 2025 edition, or transition from 2019.
Learn more → ISO/IEC 42001:2023AI Management System
Accountability, AI impact assessments and controls for a certifiable AIMS.
Learn more → ISO · CMMI · NISTGovernance, Risk & Compliance
Governance and control frameworks aligned to ISO, CMMI and NIST.
Learn more →Ready to start on AI Governance Programs?
Preparing for ISO certification, tightening governance, or need an independent assessment? Tell us where you are and we’ll map the route.
Or email [email protected]