For Heads-of · Practitioner
Governance Framework
A structured set of policies, roles and controls that guides an organisation's decisions about AI and its oversight of AI systems.
- governance
- oversight
- policy
- structure
Definition
A governance framework is the organisational structure that makes principled AI use possible. It defines who decides what, how issues are escalated, who is accountable, and how oversight works across the AI lifecycle.
Why it matters
Without one, an organisation has no coherent control over AI risk: teams make conflicting decisions, standards drift, and accountability is unclear when something goes wrong. The starting point is usually a written policy, and its absence is the register's no documented AI policy risk.
Components
Typically an oversight committee, an AI acceptable use policy and supporting standards, a risk and impact assessment procedure, an AI inventory, change management, and a regular review and audit cycle. ISO/IEC 42001 is the most widely used template for assembling these into a management system.
Related Terms
Accountability
The principle that individuals and organisations can be held responsible for decisions made by the AI systems they deploy, and must be able to explain those decisions to the people affected.
AI Inventory
A maintained register of every AI system, model and AI-enabled feature an organisation uses, builds or buys, with an owner, a purpose, a risk tier and a status for each. It is the first control in every AI governance framework because none of the others can be applied to a system nobody has listed.
AI TRiSM (AI Trust, Risk and Security Management)
Gartner's name for the discipline of making AI systems trustworthy, governable and secure in operation: governance, runtime inspection and enforcement, information governance, and the infrastructure underneath. It is a market category and a vocabulary rather than a standard, and most of what it names already has a home in ISO/IEC 42001, the NIST AI RMF and the OWASP LLM Top 10.
Control Objective
A specific, measurable statement of what a control is meant to achieve against a named risk. It describes the outcome, not the mechanism, and it is only useful if a failure to meet it would be detectable.
ISO/IEC 42001
The international standard for an AI management system (AIMS): the policies, roles, risk assessment, impact assessment, controls and evidence an organisation puts around its development and use of AI so that the whole can be audited and certified. Published December 2023, and since 2025 surrounded by companion standards for impact assessment (42005) and for the bodies that certify against it (42006), and from 2026 by EN 18286, the European quality management standard written for the EU AI Act.
Risk Appetite
The level and types of risk an organisation is willing to accept in pursuit of its strategic objectives. Applied to AI, a single organisational posture is rarely enough: appetite has to be set separately across distinct risk dimensions and tiers of decision consequence.
Shadow AI
The use of AI tools, models or features inside an organisation without the knowledge, approval or oversight of whoever is responsible for governing them. It is the AI-era form of shadow IT, with one difference that matters: the tool is usually free, browser-based, and takes the organisation's data as its input.