AI governance: policy, register and the EU AI Act in practice

AI governance is how your organisation decides which AI it may use, who answers for it and how you prove that. In practice it comes down to five parts: policy, register, risk class, change process and oversight.

Most organisations already use AI before anyone has decided how: a Copilot licence here, a ChatGPT account there, a supplier that added a model to a system you already run. AI governance closes that gap. For a CIO, IT manager or information manager it is less a new framework than five documents and five owners, set up so that an auditor, a works council or a client can see who decided what.

By Tom Joseph · Last updated: 5 November 2026

Free consultation Pricing

In short

AI governance is the set of agreements, roles and documents that decides which AI your organisation may use, who is responsible for each system and how you demonstrate it. It sits next to IT governance and data governance rather than replacing them. In practice it consists of five parts: an AI policy, an AI register, a risk class per system under the EU AI Act, a change process for models and prompts, and human oversight with logging. ISO/IEC 42001 is the management-system standard that organises those parts if you want to certify them.

The five parts

What AI governance consists of

Part	What it records	Usual owner
AI policy	Which AI may be used for what, what is not allowed, and who approves a new use.	Board, with the CISO or privacy officer
AI register	Per system: purpose, owner, data used, supplier, risk class and status.	Information manager
Risk class per system	Where each system sits under the EU AI Act, and the duties that follow from it.	Compliance or legal, with the system owner
Change process	How a model, prompt or supplier change is tested, approved and rolled back.	IT department, through your change process
Oversight and logging	Which decisions a person checks, what is logged, and how long it is kept.	The process owner

Example

What a line in the AI register looks like

System	Purpose	Owner	Data	Risk class
Microsoft 365 Copilot	Summarising email and documents	Head of IT	Email and SharePoint, including personal data	Minimal; GDPR applies
Customer-service chatbot	Answering customer questions	Customer-service manager	Knowledge base and tickets	Limited; tell users they talk to AI
CV screening in the recruitment tool	Pre-selecting applicants	HR director	CVs and application letters	High (Annex III, employment)

Where it goes wrong

Where AI governance usually breaks

A policy without a register. The rules exist, but nobody can list which AI systems are actually running. Start with the inventory; the policy follows from what you find.
A register without owners. Every line needs a named person who answers for that system, not a department.
Model changes outside the change process. A supplier updates the model, the output changes, and nobody approved it. Treat a model or prompt change like any other release.
No evaluation set. Without a fixed set of test cases nobody can tell whether an update made the system better or worse.
Shadow AI. Staff use tools nobody registered. See detecting shadow AI and the works council.

Standards

AI governance, the EU AI Act and ISO 42001

The EU AI Act sets duties by risk class. Most business AI is minimal risk and carries no specific duties. Systems that talk to people or generate content, such as a chatbot, carry transparency duties. High-risk systems, such as AI used in recruitment or credit decisions, carry duties for documentation, human oversight and registration. A few uses are prohibited outright. Your register is where you record which class each system is in.

Two dates matter. The AI-literacy duty of Article 4 already applies to every organisation whose staff use AI; see AI literacy training. And since the Digital Omnibus (Regulation (EU) 2026/1744), the Annex III high-risk duties apply from 2 December 2027 and the Annex I duties from 2 August 2028; see the high-risk deadline.

ISO/IEC 42001, published in December 2023, is the management-system standard for AI. If you already run ISO 27001, most of the structure is familiar: scope, risk assessment, controls, internal audit. See ISO 42001 next to ISO 27001. Certification is optional; the five parts above are what an auditor will ask for either way.

Who does what

Who does what: board, IT, your ICT partner and Crux Digits

Area	Your organisation	Your ICT partner	Crux Digits
Policy	Decides and signs it off.	Applies it to access and tooling.	Drafts it from your inventory, with a template.
Register	Owns it and keeps it current.	Supplies the list of tools and licences.	Sets it up and fills the first version.
Risk class	Accepts the classification.	No role.	Classifies each system and lists the duties.
Systems we build	Approves releases.	Hosts and runs them.	Builds in logging, human checks, an evaluation set and the documentation.

How to start

How to start with AI governance

Step	What you get	Time	Price (excl. VAT)
AI Act readiness check	A readiness score and your weakest areas.	about 60 seconds	free
AI Act check	An inventory, a risk class and role per system, a usage-policy template and a to-do list.	within a week	€950
AI audit and strategy	Where AI pays off and in which order, with an AI Act and GDPR check per idea.	1 to 2 weeks	€2,500

From governance to working systems

Governance is not the goal; it is what lets you put AI into production without surprises. Once the register and policy stand, the next step is usually one system built with governance in it from the start. See AI implementation in the Netherlands, or for the policy document on its own, writing an AI policy.

Buyer guides

Compare further

AI Act checklist for SMEs AI Act readiness check AI literacy training EU AI Act consultants for SMEs AI implementation: cost and timeline Managed AI support

FAQ

Frequently asked questions

What is AI governance?

AI governance is the set of agreements, roles and documents that decides which AI an organisation may use, who is responsible for each system and how that is demonstrated. In practice: an AI policy, an AI register, a risk class per system, a change process and human oversight.

What is the difference between AI governance and data governance?

Data governance covers the data itself: quality, ownership, access and retention. AI governance covers the systems that use that data to decide or generate something: which systems, who owns them, their risk class and how changes are approved. You need both, and they share owners.

Is AI governance required by law?

The EU AI Act requires specific measures depending on the risk class of each system, and the GDPR applies whenever personal data is involved. A register and a policy are the practical way to show you meet those duties, even where the law does not name them.

Do we need ISO 42001 certification?

No, certification is optional. ISO/IEC 42001 is useful when clients or tenders ask for it, or when you already run ISO 27001 and want one management system. The five parts of AI governance are needed either way.

Where do we start?

With the inventory: list every AI system and tool in use, with an owner per line. The AI Act check does that in a week and gives you the risk class per system and a policy template to start from.

Which AI is already running in your organisation?

Tell us which AI tools and systems you know of. We tell you what your register should hold, which risk class each system has, and what to do first.

Book a free consultation →