AI governance in companies: policies, roles, inventories and audits
AI governance in companies combines written policies, defined roles, an inventory of AI workloads, and periodic audits to manage risk. Frameworks like the NIST AI Risk Management Framework and internal auditing methods help organizations align AI with ethical principles. Sources include IBM, Microsoft, NIST, and OECD.
The scope of AI governance
AI governance refers to the processes, standards, and guardrails that help ensure AI systems are safe and ethical, as described by IBM's AI governance overview. It directs AI research, development, and application to support safety, fairness, and respect for human rights.
Governance encompasses a wide range of practices, protocols, and safeguards, including human oversight and input from developers, users, policymakers, and ethicists. It also addresses risks such as bias, privacy infringement, and misuse, as noted in the same IBM source.
Governance policies and roles
Companies document AI governance policies to align AI activities with ethical standards, regulatory requirements, and business objectives, according to Microsoft's governance guidance. Policies typically cover model selection, onboarding procedures, and controls for third-party tools and data.
Clear roles and accountability are essential. Microsoft's Responsible AI page lists six core values: fairness, reliability and safety, privacy and security, transparency, accountability, and inclusiveness. These principles guide how organizations assign responsibility for AI outcomes and ensure meaningful human oversight.
Inventories and risk assessment
An AI inventory is the starting point for risk assessment. The NIST AI RMF Playbook offers a voluntary framework with four functions: Govern, Map, Measure, and Manage. It provides suggested actions for integrating trustworthiness considerations throughout the AI lifecycle, supporting structured risk assessment and mitigation.
The playbook is based on the AI RMF 1.0 and includes suggested actions, references, and guidance to achieve outcomes for each function. Organizations can borrow as many or as few suggestions as apply to their specific context.
Audits and accountability
Internal algorithmic auditing helps close the accountability gap in AI development. The SMACTR framework introduced on arXiv defines an end-to-end audit process that yields a set of documents forming an overall audit report, drawing on organizational values or principles.
This framework is designed to be applied throughout the internal development lifecycle, making it easier for practitioners to identify harmful repercussions before deployment and trace emergent issues back to their source, as described in the paper.
Tools and frameworks
The OECD catalogue collects technical, educational, and procedural tools to help AI actors develop and use trustworthy systems. Examples include the EU AI Regulation Decoded dataset, which maps EU AI Act obligations to audit evidence, and CREST's AI Principles for cybersecurity.
These tools support transparency, human agency, robustness, and other trustworthy AI objectives across the lifecycle, from design to operation. Organizations can select resources from the catalogue based on their specific governance needs.
| Principle | Definition | Risk assessment question |
|---|---|---|
| AI Privacy and Security | AI workloads should respect privacy and be secure. | How might these workloads handle sensitive data or face security breaches? |
| Reliability and Safety | AI workloads should perform safely and reliably. | In which situations could they operate unsafely or give unreliable results? |
| Fairness | AI workloads should treat people equitably. | How could they lead to unequal treatment or unintended bias in decisions? |
| Inclusiveness | AI workloads should be inclusive and empowering. | Which groups might be excluded or disadvantaged by the design or use? |
| Transparency | AI workloads should be understandable. | What parts of the decision process could be hard for users to interpret or explain? |
| Accountability | People should be accountable for AI workloads. | Where might responsibility be unclear or hard to assign during development or use? |
Frequently asked questions
What is AI governance?
AI governance refers to the processes, standards, and guardrails that help ensure AI systems are safe, ethical, and aligned with human rights, as defined by IBM.
Why do companies need AI governance?
Companies need AI governance to manage risks such as bias, privacy infringement, and misuse, to maintain regulatory compliance, and to build trust with users and stakeholders.
What are common AI governance policies?
Typical policies cover model selection and onboarding, controls for third-party tools and data, privacy and security measures, transparency requirements, and clear accountability for AI outcomes.
How are AI audits conducted?
AI audits can use frameworks like SMACTR, which define an end-to-end internal audit process that documents decisions throughout development and deployment, producing an audit report aligned with organizational values.
What tools support AI governance?
The OECD catalogue lists technical, educational, and procedural tools such as the EU AI Regulation Decoded dataset and CREST AI Principles, which help organizations address transparency, safety, and accountability.