Academy/Secure & Govern
AI Governance in Practice
The EU AI Act after its 2026 amendments, NIST AI RMF and ISO/IEC 42001 combined into one system; use-case intake and risk tiering; the AI inventory; third-party, embedded and agentic AI; and eight baseline controls.
S201Practitioner·14 slides·About 13 minutes
AxiareteAcademy
S201Secure & Govern · Practitioner
AI Governance in Practice
Turning regulation and frameworks into a working governance system for AI.
FormatKnowledge pack · 14 slides
ForRisk, security and IT leaders
LevelPractitioner
Axiarete Academy · S20102 / 14
The premise
AI governance as a continuous management system
Effective AI governance answers four questions continuously: what AI we use, what could go wrong, who decided it was acceptable, and how we know it still is.
InventoryEvery system, including features inside SaaS.
RiskHarm to people and the business, by tier.
AccountabilityWho decided, and on what basis.
AssuranceMonitoring, evaluation and periodic review.
AI Governance in PracticeSecure & Govern
Axiarete Academy · S20103 / 14
Regulation
The EU AI Act regulates by risk
| Category | Examples | Obligations |
|---|---|---|
| Prohibited | Social scoring, manipulation, emotion recognition at work | Banned since February 2025; two more bans from December 2026 |
| High-risk | Annex III uses such as employment, credit and critical infrastructure | Risk management, data governance, logging, human oversight, conformity assessment |
| Transparency | Chatbots, and AI-generated or manipulated content | Disclosure and labeling |
| Minimal | Most other uses, such as spam filters | Voluntary codes; AI literacy measures still apply |
| General-purpose models | Broadly capable models, such as large language models | Documentation, copyright policy and training-content summary since August 2025; more for systemic-risk models |
AI Governance in PracticeSecure & Govern
Axiarete Academy · S20104 / 14
Timeline
Key dates after the 2026 amendments
The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since July 27, 2026, deferred the high-risk dates, added two prohibitions and eased the AI literacy duty.
1Aug 2024The Act enters into force.
2Feb 2025Prohibitions and AI literacy apply.
3Aug 2025General-purpose model duties apply; earlier models by August 2027.
4Aug 2026Transparency duties apply and enforcement begins.
5Dec 2026Bans on non-consensual sexual deepfakes and CSAM apply; earlier generators must mark outputs (Art. 50(2)).
6Dec 2027High-risk obligations for Annex III uses apply; earlier systems only if significantly redesigned.
7Aug 2028High-risk obligations for Annex I products apply.
AI Governance in PracticeSecure & Govern
Axiarete Academy · S20105 / 14
Roles
Your obligations depend on your role
Most enterprises are deployers. They become providers by building a system, by rebranding or substantially modifying a high-risk one, or by repurposing one into high-risk use (Art. 25).
| Role | Who it is | Core obligations for high-risk systems |
|---|---|---|
| Provider | Develops or commissions a system and places it on the market or puts it into service under its own name or trademark | Quality management system, risk management, data governance, technical documentation, logging, human-oversight design, conformity assessment, registration, post-market monitoring |
| Deployer | Uses a system under its own authority | Use it as instructed, assign competent oversight, check input data it controls, monitor and report incidents, keep logs at least six months, inform workers and affected people, assess fundamental-rights impact where Art. 27 applies |
AI Governance in PracticeSecure & Govern
Axiarete Academy · S20106 / 14
Frameworks
How ISO/IEC 42001, NIST AI RMF and the law fit together
Use ISO/IEC 42001 for the management system, NIST AI RMF for risk methods and the law for obligations. ISO/IEC 42005 (2025) guides AI system impact assessment.
ISO/IEC 42001A certifiable AI management system: policy, roles, risk and impact assessment, controls, internal audit and improvement. Published in 2023.
NIST AI RMFA voluntary framework in four functions: Govern, Map, Measure and Manage. Version 1.0 (2023), now under revision; Generative AI Profile (NIST AI 600-1), 2024.
Legal obligationsThe EU AI Act, sector regulation and data protection law; in the United States, state laws such as Colorado’s, challenged by the Justice Department and rewritten in 2026.
AI Governance in PracticeSecure & Govern
Axiarete Academy · S20107 / 14
Intake
From use-case intake to periodic review
1RegisterPurpose, owner, model, data and users.
2ClassifyLegal category, provider or deployer role, and internal tier.
3AssessImpact, data, security and fairness, as the tier requires.
4DecideApprove, approve with conditions, or decline.
5DeployWith the controls the decision requires.
6MonitorPerformance, incidents and drift.
7ReviewOn every material change, and on a fixed cycle.
AI Governance in PracticeSecure & Govern
Axiarete Academy · S20108 / 14
Tiering
Tier risk on factors you can assess
| Factor | Lower risk | Higher risk |
|---|---|---|
| Who is affected | Staff as users of assistive tools | Customers, applicants, the public |
| Role in the decision | Suggests; a person decides | Determines or materially shapes the outcome |
| Autonomy | A person reviews every output | Acts without review |
| Data | Public or internal | Personal or special-category data |
| Reversibility | Easily corrected | Hard to reverse once acted on |
| Domain | No sector rules | Employment, credit, health, critical services |
AI Governance in PracticeSecure & Govern
Axiarete Academy · S20109 / 14
Agents
Govern agents by what they are allowed to do
Singapore’s Model AI Governance Framework for Agentic AI (January 2026) begins with two duties: assess and bound the risks upfront, and make humans meaningfully accountable.
Tier by actionSet the risk tier by the most consequential action the agent can take.
Bound in advanceApprove tools, data and spending limits with the use case, at the minimum necessary.
Accountable personEach agent traceable to a named person who answers for what it does.
Delegated authorityNever beyond the rights of the person or role it acts for.
CheckpointsHuman approval before significant or irreversible actions.
StopA tested way to interrupt it, as Art. 14(4)(e) requires for high-risk systems.
AI Governance in PracticeSecure & Govern
Axiarete Academy · S20110 / 14
Inventory and suppliers
Govern the AI you buy as rigorously as the AI you build
Many AI features arrive through updates to software you already license.
Record for every system
- Purpose, owner and users
- Provider, model and version
- Data used, and where it is processed
- Legal category, role and risk tier
- Controls, evaluations, incidents and next review
Require from suppliers
- No training on your data without consent
- Data residency and sub-processors
- Notice of material model changes
- Incident notice, cooperation and access to logs
- Settings to disable features you have not approved
AI Governance in PracticeSecure & Govern
Axiarete Academy · S20111 / 14
Controls
Eight baseline controls
AI literacyTraining matched to how each role uses AI.
Approved toolsSanctioned options that reduce use of unapproved AI tools.
Human oversightDesigned into the workflow, with authority to stop.
TransparencyPeople are told when they are interacting with AI.
LoggingInputs, outputs and decisions; high-risk logs kept at least six months.
EvaluationOn representative cases, before release and on every material change.
Incident responseExisting processes extended to AI harms; Art. 73 reports due within 2, 10 or 15 days.
Security testingPrompt injection and data leakage tested and controlled.
AI Governance in PracticeSecure & Govern
Axiarete Academy · S20112 / 14
Pitfalls
How AI governance goes wrong
Governing only what you build
Include SaaS features and purchased AI
Approval as a one-time event
Review on change and on a fixed cycle
Blocking every tool
Offer approved alternatives
Policy without an inventory
Start by knowing what is in use
Treating every use case as high risk
Tier, and spend effort where risk is real
Working apart from security and privacy
One intake, shared controls and evidence
AI Governance in PracticeSecure & Govern
Axiarete Academy · S20113 / 14
Getting started
A 90-day plan
Days 1–30Foundations
- Name an accountable executive and a cross-functional council
- Publish acceptable use and approved tools
- Start the inventory, including SaaS AI features
Days 31–60Process
- Launch intake and risk tiering
- Formalize role-based AI literacy (Art. 4)
- Add AI clauses to supplier contracts
Days 61–90Assurance
- Assess the highest-risk use cases first
- Define monitoring and incident handling
- Map gaps against ISO/IEC 42001 and the EU AI Act
AI Governance in PracticeSecure & Govern
Axiarete Academy · S20114 / 14
Summary
Key takeaways
- Governance is a continuous system: inventory, risk, accountability and assurance.
- Under the amended EU AI Act, Annex III high-risk obligations apply from December 2027.
- Know, system by system, whether you are a provider or a deployer.
- Use ISO/IEC 42001 for the management system and NIST AI RMF for risk methods.
- Hold purchased and embedded AI to the same intake, tiering and review.
AI Governance in PracticeSecure & Govern
Further reading
- AI Act implementation timeline (opens in a new tab)European Commission, AI Act Service Desk
- Digital Omnibus on AI: legislative train (opens in a new tab)European Parliament
- AI Risk Management Framework (opens in a new tab)NIST
- ISO/IEC 42001: AI management systems (opens in a new tab)ISO, 2023
- ISO/IEC 42005: AI system impact assessment (opens in a new tab)ISO, 2025
- Singapore launches new Model AI Governance Framework for Agentic AI (opens in a new tab)IMDA, January 2026
- Trust and AI governance at AxiareteAxiarete
Bring this course to your leadership team
We run private working sessions that apply these frameworks to your own estate, data and pending decisions.