AI governance framework: building a responsible AI plan

An AI governance framework is the set of owners, policies, controls and reviews that decide how your organisation uses AI and what happens when it gets something wrong. Build it by listing every system that automates a decision, ranking those systems by impact, giving each one a named owner, and scaling the controls to the risk. If you operate in the EU, the AI Act sets the deadlines. Its high-risk rules for systems such as hiring and credit scoring now apply from 2 December 2027.

Companies use AI to screen job applicants, detect fraud, manage supply chains and set prices. I have seen hiring platforms reject qualified candidates just because they had a career break. I have seen decision systems apply the wrong rules to entire customer segments. The common thread was that nobody had set clear policies for how the system should behave, or what to do when it did not.

That is a management failure, not a technical one. Most businesses cannot answer three basic questions:

1. Who approves how AI is used?
2. Who checks that it is working as expected?
3. What happens when it gets something wrong?

Governance answers them. Done well, it does not slow things down. It makes sure the systems you rely on are used responsibly.

1. 01List every systemIf it automates a decision, it is in scope
2. 02Rank by impactHiring, credit, pricing and customer scoring first
3. 03Name one ownerA person, not a committee
4. 04Scale controls to riskTests, human review points and alerts
5. 05Review on a fixed cycleMonthly for critical systems, quarterly for the rest

Failures and edge cases fed back into the controls

Teams that assume their software vendors handle compliance are usually wrong. Under the EU AI Act, the organisation that deploys a system has its own obligations.

Framework	Where	Status and what it asks for
EU AI Act	European Union	Law since August 2024. Risk-based: bans some uses, sets duties for high-risk systems, transparency rules for others
GDPR	European Union	Lawful basis, data minimisation and rights around automated decisions that affect people
ISO/IEC 42001	Global	Certifiable AI management system standard, published December 2023
NIST AI RMF	United States	Voluntary framework built on Govern, Map, Measure and Manage
US state laws	United States	No comprehensive federal AI law; a growing set of state laws, with federal efforts to preempt them
Singapore Model AI Governance Framework	Singapore	Voluntary guidance on explainability and accountability
OECD AI Principles	OECD members	Non-binding international principles

Canada's proposed Artificial Intelligence and Data Act died when Parliament was prorogued in January 2025, so it no longer belongs on this list.

EU AI Act dates after the 2026 Digital Omnibus

The EU amended the AI Act in July 2026 through the Digital Omnibus on AI, Regulation (EU) 2026/1744, which delayed the high-risk rules. These are the current dates from the European Commission's AI Act timeline:

Date	What applies
1 August 2024	AI Act enters into force
2 February 2025	Prohibited practices and AI literacy duties
2 August 2025	General-purpose AI model rules; national authorities and penalties
2 August 2026	Most remaining rules, including Article 50 transparency duties; enforcement starts
2 December 2026	New prohibitions on non-consensual sexual deepfakes and child abuse material
2 December 2027	High-risk rules for Annex III systems, such as employment, credit scoring and essential services
2 August 2028	High-risk rules for AI built into products covered by EU product-safety law (Annex I)

The delay buys time. It does not remove the work. If you use AI to screen candidates or score credit, the documentation, human oversight and monitoring you need for December 2027 take longer to build than most teams expect. When you buy such a system, ask the vendor now how it will meet the high-risk requirements.

1. Scope and policy

Before anything else, find out where systems are making decisions. Most teams skip this or assume IT has a list. It usually does not.

Go department by department. Look at the tools that filter applicants, approve transactions or score customers. If it automates a decision, it is in scope, whether or not anyone calls it AI. If you run SAP, include the AI features you have switched on, such as Joule and embedded predictive scenarios.

Then write policies in plain language people will follow. "We prioritise ethical AI use" is not a policy.

2. Ownership

However well a system performs, someone has to own the outcome. Shared responsibility means nobody acts.

Give each system one named owner who uses it in practice, signs off key changes, keeps the documentation and answers when things go wrong. Decide in advance who can pause a system after a complaint.

In one company I worked with, three people each thought someone else was responsible. The result was months of silence around a critical issue no one addressed.

3. Risk assessment and controls

Every system carries risk. What matters is whether the risk is visible.

Do not borrow generic risk lists. Ask whether your system could unfairly reject candidates, recommend wrong prices or misclassify customers. Then build controls: testing before deployment, manual review points in use, and alerts when results fall outside expected ranges. Put two or three realistic scenarios in each risk policy so people understand why it exists.

4. Monitoring and audit

Systems change. Input data shifts and updates alter behaviour. I remember a finance team that ran into a silent error in their recommendation tool. It took two weeks to notice. One regular audit would have caught it on day two.

Set a fixed review cycle: monthly for critical systems, quarterly for the rest. One team I worked with caught a major pricing error simply because it reviewed a few sample outputs once a month. Track failures and edge cases, and feed them back into the controls.

5. Transparency

People who work with a system, and in regulated areas the people affected by it, need to understand what it does. Explain inputs and decisions in plain language. Document limitations as well as strengths. Overselling a system leads to misuse.

6. Training

People make mistakes in day-to-day use even when everything is documented. Train business users, not just technical staff, with your own data and cases. One HR team I worked with ran 30-minute refreshers twice a year using real feedback from past candidate screenings. Nothing complex, but it helped users feel confident and responsible.

The most useful first artefact is a register. Some of the most effective frameworks I have seen started as spreadsheets and grew from there. For each system, capture:

1. System and purpose: what it decides or recommends, and for whom.
2. Owner: one named person, plus a deputy.
3. Risk tier: for example high (affects people's jobs, money or access to services), medium or low, plus the EU AI Act category if it applies.
4. Data used: sources, personal data involved, consent and retention.
5. Vendor or in-house: and what documentation the vendor provides.
6. Controls: pre-deployment tests, human review points, alerts.
7. Review cycle: monthly, quarterly or annual, and the date of the last review.
8. Incident route: who is told, who can pause it, how users are informed.

Fill it for the high-impact systems first: hiring, pricing, credit and customer scoring. Low-risk internal tools can wait.

Start with high-impact use cases. I once worked with a company where an automated tool screened out job applicants for vague reasons. They only realised after several complaints. One review session would have caught it early.

Scale oversight to risk. One team I worked with applied the same review depth to an internal chatbot as to a pricing engine. It exhausted the governance team and slowed development without much benefit.

Document decisions when they are made. Backfilled documentation fails because people forget the context. A shared folder of dated one-page decision notes beats an elaborate system nobody updates.

Do not wait for the perfect framework. I have seen teams spend months refining policy language that no one ended up using. Start with one rule, one owner and one review cycle, then adjust.

Expect resistance and answer it. Governance looks like bureaucracy to the teams using the tools. Connect it to what they care about: customer trust, fines avoided, public failures prevented.

Automated decisions without oversight can fail fast and expensively. In 2012 Knight Capital's automated order router, running defective code, sent more than 4 million orders in 45 minutes and the firm lost more than $460 million (SEC). Amazon abandoned an experimental recruiting tool after finding it penalised CVs that mentioned women's organisations. The quieter failures are more common: a system drifts for months until a complaint or an audit finds it.

ISO/IEC 42001 is the certifiable standard for an AI management system, published in December 2023. NIST's AI Risk Management Framework is the voluntary reference most US organisations use. For individuals, the IAPP's Artificial Intelligence Governance Professional (AIGP) certification is the best-known credential.

Dedicated tools exist, such as IBM watsonx.governance, Fiddler AI and the Responsible AI dashboard in Azure Machine Learning. For most organisations the practical start is simpler: the register above, logging, access controls and review cycles. For risk scoring in more depth, see my AI risk management framework guide. If your AI runs inside SAP, my article on AI governance in SAP implementations covers the SAP-specific controls, and my AI governance framework page sets out how I help organisations put one in place.

What is an AI governance framework?

A set of owners, policies, controls and review cycles that decide how an organisation uses AI, how systems are tested and monitored, and what happens when something goes wrong. It also makes decisions explainable to regulators and affected people.

When do the EU AI Act high-risk rules apply?

After the Digital Omnibus on AI (Regulation (EU) 2026/1744), the high-risk rules for Annex III systems, such as AI used in employment, credit scoring and essential services, apply from 2 December 2027. High-risk rules for AI built into products covered by EU product-safety law apply from 2 August 2028. Prohibitions have applied since February 2025 and transparency duties since August 2026.

Why does AI governance matter in SAP environments?

SAP systems now include AI that makes or shapes decisions, such as Joule, predictive scenarios in finance and supply chain, and candidate screening in HR. A biased or wrong output can spread across integrated processes before anyone notices. Governance holds those features to the same accountability as the manual processes they replaced.

Who is responsible for AI governance?

It is cross-functional: compliance, IT and security, data teams, legal and risk, and executives. The most important structural decision is one named owner per AI system. A person, not a committee.

What certifications exist for AI governance?

For organisations, ISO/IEC 42001 is the certifiable AI management system standard. NIST AI RMF is a voluntary framework rather than a certification. For individuals, the IAPP's AIGP certification is the best-known AI governance credential.

What happens when AI governance is ignored?

Visible failures include Amazon abandoning a recruiting tool that penalised women and Knight Capital losing more than $460 million in 45 minutes through a faulty automated trading system. The more common failure is quieter: a system drifts for months and nobody notices until a complaint or audit.