Executive Summary
Artificial Intelligence is no longer simply a technology investment.
It is becoming a business capability that influences strategic decisions, operational processes, customer experiences, workforce productivity, product development and competitive positioning.
Organizations are investing in AI to improve efficiency, accelerate innovation, enhance decision-making and create new business opportunities. At the same time, these investments introduce risks involving data privacy, cybersecurity, intellectual property, regulatory compliance, operational resilience, model reliability, human oversight and organizational reputation.
This creates an important leadership challenge.
Who ultimately ensures that AI is being adopted responsibly, that its risks remain within the organization's appetite, and that its business value is being realized?
The answer cannot be limited to the technology function.
CIOs, CISOs, Chief Risk Officers, Legal, Compliance, Data and business leaders all have important responsibilities. But the organization also needs strategic direction, executive ownership and appropriate Board-level oversight.
This is where AI governance moves from an operational control discipline to an enterprise leadership responsibility.
The Board does not need to understand the technical architecture of every AI model. It does need to understand where AI is being used, what strategic opportunities it creates, which risks could materially affect the organization, who is accountable, and whether management has appropriate controls and assurance mechanisms in place.
This article explores how organizations can establish that leadership model, including an original practical framework for Board oversight, executive accountability, AI governance committees, risk appetite, performance reporting and strategic assurance.
The central proposition:
AI governance should not merely protect the organization from AI risk. It should enable the organization to pursue AI opportunities with informed oversight, clear accountability and confidence.
1. Why AI Governance Belongs in the Boardroom
Historically, many organizations approached emerging technology risks through their IT, Information Security, Privacy or Compliance functions.
That approach remains relevant, but AI changes the scale and nature of the discussion.
Consider the following scenarios:
An organization deploys generative AI across multiple business functions, but has no consolidated understanding of where sensitive information is being processed.
An AI-driven recruitment solution influences candidate selection, creating potential discrimination and employment-related concerns.
An autonomous AI agent is granted access to enterprise applications and begins executing actions beyond its intended scope.
A third-party AI provider changes its underlying model, materially affecting the behaviour of a business-critical service.
An AI-enabled product generates inaccurate outputs that affect customers and create reputational exposure.
A business unit rapidly expands AI adoption without corresponding investment in security, governance, monitoring or human oversight.
These are not isolated technology problems.
They can become enterprise-level issues involving financial performance, legal exposure, customer trust, regulatory obligations and strategic resilience.
The Board therefore needs visibility into the organization's AI strategy and its associated risk profile.
This does not mean that every AI deployment should require Board approval.
It means that leadership must establish the governance structures, decision rights, risk boundaries and reporting mechanisms that allow AI adoption to remain aligned with organizational objectives.
The Board's role is to provide direction and oversight. Management's role is to translate that direction into operating decisions, controls and measurable outcomes.
That distinction should be the foundation of the governance model.
2. The Difference Between Board Oversight and Executive Management
One of the most important questions in enterprise AI governance is where accountability sits.
A common mistake is to assign AI governance entirely to the CIO, CISO or GRC function.
These functions may coordinate or lead important parts of the program, but they cannot independently own every business decision, AI use case or enterprise risk.
A more effective model separates strategic oversight from operational management.
The Board of Directors
The Board provides strategic oversight and challenges management on whether the organization's AI activities are aligned with business objectives, risk appetite and applicable obligations.
Its responsibilities may include:
Understanding the organization's AI strategy and material dependencies.
Reviewing significant AI-related risks and opportunities.
Challenging management on governance effectiveness.
Understanding material incidents and unresolved risk exposures.
Overseeing whether appropriate accountability and assurance structures exist.
Ensuring AI risk receives appropriate attention within enterprise risk oversight.
The exact responsibilities depend on the organization's governance structure, jurisdiction, sector and applicable legal duties.
The CEO and Executive Leadership Team
The CEO and executive leadership team translate strategic direction into organizational priorities.
They should ensure:
AI initiatives align with business strategy.
Accountable executives are identified.
Appropriate resources are allocated.
Risk ownership is established.
Business units follow approved governance requirements.
Material risks and exceptions are escalated.
AI investments deliver measurable business outcomes.
The CIO and CTO
Technology leadership is responsible for ensuring that the technology strategy and architecture support responsible AI adoption.
This may include:
AI platform strategy.
Enterprise architecture.
Model and application lifecycle management.
Technology integration.
Scalability and resilience.
Technical standards.
Infrastructure and platform dependencies.
The CISO and Information Security Leadership
Security leadership addresses the security implications of AI adoption and AI-enabled capabilities.
Key areas include:
AI-related threat modelling.
Data protection and access controls.
Secure AI architecture.
Application and API security.
AI-specific attack surfaces.
Security monitoring.
Incident response and resilience.
The Chief Risk Officer / GRC Leadership
Risk and GRC functions provide the governance architecture that connects AI risks to enterprise risk management.
Their responsibilities may include:
AI risk methodology.
Risk appetite alignment.
Control framework development.
Regulatory and compliance oversight.
Third-party AI risk governance.
Risk reporting.
Control assurance.
Issue and exception management.
Legal, Privacy and Compliance Leadership
These functions help establish how AI activities interact with applicable laws, regulations, contracts, privacy requirements and intellectual-property obligations.
They also help determine when specific AI use cases require additional legal or regulatory review.
Business and Functional Leaders
Business leaders own the business purpose and operational consequences of AI use within their functions.
They must ensure that:
AI systems are used for approved purposes.
Business risks are understood.
Human oversight is appropriate.
Operational controls are followed.
Performance and exceptions are monitored.
Material issues are escalated.
The important principle is that AI governance is distributed across the enterprise, but accountability must never become fragmented.
3. Establishing the AI Governance Operating Model
An organization does not necessarily need a new executive committee, a new reporting hierarchy or a completely separate governance department to manage AI.
It does, however, need an operating model that connects strategic direction, business ownership, risk oversight and technical execution.
I propose a practical structure built around four interconnected layers.
Layer 1 — Board Oversight
The Board or its designated committee receives strategic AI risk and performance reporting.
Depending on the organization's structure, oversight may sit with the Board, Risk Committee, Audit Committee, Technology Committee or another appropriately mandated committee.
Layer 2 — Executive AI Governance Council
A cross-functional executive council provides enterprise-level direction.
Potential participants include:
CEO or executive sponsor
CIO / CTO
CISO
CRO
Legal and Compliance
Privacy leadership
Data leadership
Business executives
Responsible AI / AI Governance leadership
Its role is to establish priorities, resolve cross-functional issues, review material risks, approve decisions within its authority and escalate matters requiring Board attention.
Layer 3 — AI Governance and GRC Function
This function coordinates the governance framework.
It may manage:
AI policies and standards
AI inventory
Risk assessments
Governance workflows
Control requirements
Regulatory mapping
Third-party risk coordination
Exceptions
Monitoring
Assurance reporting
Layer 4 — Business and Technology Execution
The teams developing, procuring, deploying and operating AI systems implement the requirements.
They remain responsible for the controls and operational outcomes within their respective areas.
The resulting structure can be represented as:
Board Oversight
↓
Executive AI Governance Council
↓
AI Governance / Enterprise GRC
↓
Business Owners + Technology + Security + Data + Compliance
↓
AI Systems, Controls, Monitoring and Outcomes
This model should connect with existing Enterprise GRC and risk-management structures wherever possible.
Creating a parallel AI governance organization without clear integration can introduce duplicate approvals, competing policies and unclear accountability.
The objective is not more committees.
It is better decisions.
4. The AI Governance Accountability Matrix
An operating model becomes meaningful only when responsibilities and decision rights are documented.
I propose the following practical accountability matrix.
| Governance Activity | Primary Accountability | Supporting Functions |
|---|---|---|
| Enterprise AI strategy | CEO / Executive Leadership | CIO, CTO, Business Leaders |
| AI risk appetite | Board / Risk Committee, as applicable | CEO, CRO, GRC |
| AI governance policy | Executive Management | Legal, Compliance, GRC, Security |
| AI inventory | Designated AI Governance Owner / Business Owners | IT, Procurement, Data |
| AI risk assessments | Business / AI System Owners | GRC, Security, Privacy, Legal |
| Technical AI security | CISO / Security Leadership | Engineering, IT, AI Teams |
| AI platform and architecture | CIO / CTO | Engineering, Data, Security |
| AI regulatory oversight | Legal / Compliance Leadership | GRC, Business Owners |
| Third-party AI risk | TPRM / Vendor Risk Leadership | Procurement, Security, Legal |
| AI incident response | Designated Incident Leadership | Business, Security, Legal, GRC |
| Control assurance | Control Owners and Second Line Oversight | Internal Audit |
| Independent audit | Internal Audit | Relevant Management Functions |
| Material AI risk escalation | Executive Leadership | CRO, CISO, Legal, Business Owners |
This is an illustrative allocation. Organizations should adapt it to their own governance structures and formally distinguish between who is accountable, who performs the activity, who provides oversight and who must be consulted.
A particularly important point:
Internal Audit should retain its independence.
It should not become the operational owner of AI governance or assume management's responsibility for designing and operating controls that it may later need to audit.
5. Defining AI Risk Appetite at the Enterprise Level
Risk appetite is one of the most important tools available to the Board and executive leadership.
Without it, AI governance can become a collection of disconnected approvals and technical restrictions.
Organizations need to establish what level of AI-related risk they are prepared to accept in pursuit of business objectives.
For example:
An organization may be comfortable using generative AI for internal productivity while maintaining strict restrictions on uploading confidential customer data to unapproved platforms.
It may support AI-assisted decision-making but prohibit fully autonomous decisions in certain high-impact business processes.
It may permit AI agents to automate low-risk workflows while requiring additional approvals and safeguards before granting access to financial systems or privileged enterprise applications.
These are risk appetite decisions.
A practical AI risk appetite framework could address the following areas:
| Risk Area | Example Risk Appetite Position |
|---|---|
| Data Privacy | No unauthorized disclosure or processing of protected personal information |
| Cybersecurity | AI systems must meet defined security requirements before production use |
| Human Oversight | Material decisions affecting people must have appropriate human oversight where required by risk and applicable obligations |
| Model Reliability | AI systems must meet documented performance and reliability thresholds for their intended use |
| Regulatory Compliance | AI deployment must be assessed against applicable legal and regulatory obligations |
| Third-Party AI | Material external dependencies must undergo risk-based due diligence |
| Autonomous Actions | Agent permissions must be limited according to defined risk thresholds and authorization boundaries |
| Transparency | Material AI use cases must have documented ownership, intended purpose and relevant limitations |
These are illustrative positions, not universal requirements.
The organization should distinguish between:
Risks it will not accept.
Risks it will accept only with defined controls.
Risks that require executive approval.
Risks that can be accepted by designated business owners.
Risks that must be escalated to the Board or an authorized committee.
Risk appetite should also be translated into measurable thresholds, escalation triggers and decision authorities.
A policy stating that the organization has a "low tolerance for AI risk" is not particularly useful unless management can explain what that means in operational terms.
6. The Board AI Governance Scorecard
Boards generally do not need lengthy technical reports.
They need concise, decision-oriented information that explains what is happening, why it matters and whether management is taking appropriate action.
A useful AI governance scorecard should combine strategic performance, risk exposure, control effectiveness and emerging issues.
I propose six reporting dimensions.
1. AI Adoption and Strategic Value
Number of material AI initiatives.
Business functions adopting AI.
AI investments and expected benefits.
Productivity or operational improvements.
Strategic dependencies.
The Board should understand whether AI investment is creating the intended business value.
2. AI Risk Exposure
Number of identified AI systems.
High-impact or high-risk use cases.
Material open AI risks.
Unapproved or restricted AI usage.
Significant third-party dependencies.
3. Governance and Compliance
Percentage of in-scope AI systems with accountable owners.
Risk assessment coverage.
Regulatory applicability reviews.
Policy exceptions.
Overdue governance approvals.
4. Security and Resilience
Material AI security incidents.
Significant vulnerabilities.
AI-related data exposure events.
Critical service dependencies.
Tested fallback and recovery arrangements.
5. Control Effectiveness and Assurance
Critical AI controls tested.
Control effectiveness results.
Unresolved assurance findings.
Overdue remediation.
Evidence completeness.
6. People and Accountability
AI literacy and training coverage.
Human oversight effectiveness.
Business ownership.
Executive escalations.
Significant decisions involving AI systems.
The scorecard should not become another collection of green and amber indicators.
Every material metric should have a defined owner, reporting frequency, threshold and escalation route.
7. KPIs, KRIs and the Questions Behind the Numbers
There is a difference between measuring AI adoption and measuring AI governance effectiveness.
For example:
KPI: Percentage of employees trained on responsible AI use.
This measures progress against an organizational objective.
KRI: Number of material AI systems operating without an approved risk assessment.
This indicates exposure to potential governance failure.
Similarly:
| KPI — Performance Indicator | KRI — Risk Indicator |
|---|---|
| Percentage of AI use cases delivering expected business benefits | Percentage of material AI systems with overdue risk reassessments |
| AI training completion rate | Number of material AI policy violations |
| Percentage of AI systems with assigned owners | Number of material AI systems without accountable owners |
| Percentage of critical controls tested | Number of critical AI controls rated ineffective |
| Percentage of vendors completing AI due diligence | Number of critical AI dependencies with unresolved assurance gaps |
| Percentage of material incidents closed within target | Number of unresolved high-severity AI incidents |
| Percentage of AI systems with documented monitoring | Number of material systems with monitoring gaps |
The Board should receive both performance and risk information.
An organization could have excellent AI adoption metrics while simultaneously accumulating significant unaddressed AI risk.
That is why the two perspectives must be considered together.
The six questions behind every Board AI dashboard
What is changing in our AI environment?
What value are we realizing?
What risks are increasing?
Which controls are not operating effectively?
What decisions or interventions are required?
Who is accountable for the next action?
If a dashboard cannot answer these questions, it may be reporting activity rather than supporting governance.
8. AI Governance Committees: Avoiding the Committee Trap
Many organizations respond to emerging technology risks by establishing committees.
This can be useful, but committees alone do not create accountability.
An AI Governance Council should have a clearly defined mandate.
Its responsibilities might include:
Reviewing material AI use cases.
Establishing governance priorities.
Resolving cross-functional conflicts.
Reviewing significant AI risks.
Approving exceptions within delegated authority.
Evaluating emerging regulatory requirements.
Reviewing AI incident trends.
Monitoring implementation of governance controls.
Escalating material matters to executive leadership.
But there are several questions that should be answered before establishing the committee.
Who chairs it?
A senior executive with sufficient organizational authority should sponsor the governance agenda.
Who participates?
Membership should reflect the organization's actual AI risks and operating model.
What decisions can it make?
The committee should have documented decision rights and escalation thresholds.
How frequently does it meet?
Meeting frequency should reflect the scale, risk and pace of AI adoption.
How are decisions recorded?
Material decisions, approvals, exceptions and risk acceptances should be documented.
How does it report to the Board?
There should be a defined reporting relationship, not an informal expectation that important issues will eventually reach senior leadership.
Most importantly, the committee should not become a bottleneck for every AI experiment.
Low-risk activities can be governed through delegated processes, while material or high-impact use cases receive enhanced review.
Effective governance should enable responsible innovation, not unnecessarily delay it.
9. Strategic AI Risk: Beyond Compliance and Cybersecurity
A Board-level AI discussion should not be limited to regulatory compliance or cybersecurity.
Those are critical components, but AI introduces broader strategic considerations.
Strategic Dependency
Is the organization becoming overly dependent on a small number of AI providers or foundation models?
Intellectual Property
Could AI adoption expose proprietary information, trade secrets or confidential business knowledge?
Workforce Transformation
How will AI affect employee roles, skills, organizational structure and workforce planning?
Business Model Disruption
Could competitors use AI to change pricing, customer experience, operating models or delivery economics?
Operational Resilience
Can critical business processes continue if an AI service becomes unavailable or produces unacceptable outputs?
Reputation and Trust
How would customers, employees, regulators and investors respond to a material AI failure?
Competitive Advantage
Are governance processes enabling the organization to adopt AI responsibly and at scale, or are they creating unnecessary friction?
This last question is particularly important.
AI governance should not be viewed only as a defensive control mechanism.
It is also an enabler of sustainable AI adoption.
Organizations that understand their risks, assign ownership, establish clear decision rights and create reliable assurance mechanisms may be better positioned to scale AI with confidence.
10. AI Incidents and Executive Decision-Making
Not every AI incident requires Board involvement.
However, material incidents should have clearly defined escalation criteria.
Consider an AI system that begins generating inaccurate recommendations in a business-critical workflow.
The response may require decisions about:
Whether the system should continue operating.
Whether its use should be restricted.
Whether the affected process should revert to manual execution.
Whether customers or employees must be informed.
Whether regulators or other authorities must be notified.
Whether a third-party provider must be engaged.
Whether the system can safely return to production.
These are operational and executive decisions.
A mature governance framework should establish decision rights before the incident occurs.
For example:
| Decision | Typical Decision Authority |
|---|---|
| Routine operational restriction | Designated AI / Business Owner |
| Material security containment | Incident Commander / Security Leadership |
| Suspension of a critical AI service | Authorized Business and Executive Leadership |
| Material customer or regulatory communication | Legal, Compliance and Executive Leadership, as applicable |
| Acceptance of significant residual risk | Designated risk-acceptance authority |
| Strategic withdrawal of a material AI capability | Executive Leadership, with Board oversight where appropriate |
The precise allocation depends on the organization and the nature of the incident.
The Board should not be expected to manage technical incident response.
It should, however, receive timely escalation of material issues and understand whether management is responding effectively.
The principle is straightforward:
The authority to deploy an AI system must be matched by the authority and readiness to restrict, suspend or withdraw it when necessary.
11. The AI Governance Leadership Framework
To bring these elements together, I propose an original practical framework for Board and executive-level AI governance.
I call it the AI Governance Leadership Framework — Six Pillars of Executive Oversight.
Pillar 1 — Strategic Direction
Define how AI supports business strategy, investment priorities and organizational objectives.
Pillar 2 — Accountability
Assign clear ownership across the Board, executive leadership, business functions and control functions.
Pillar 3 — Risk Appetite
Establish boundaries for acceptable AI use, material risk exposure and escalation.
Pillar 4 — Governance and Controls
Integrate AI governance into enterprise policies, risk management, procurement, security, privacy and operational processes.
Pillar 5 — Performance and Assurance
Measure AI value, monitor risk, test controls and obtain evidence of governance effectiveness.
Pillar 6 — Continuous Oversight
Review emerging risks, incidents, regulatory changes, strategic dependencies and opportunities for improvement.
These six pillars form a connected management cycle:
Strategic Direction → Accountability → Risk Appetite → Governance & Controls → Performance & Assurance → Continuous Oversight
The cycle then informs the next round of strategic decisions.
This is important because AI governance is not a one-time approval exercise.
It is an ongoing leadership responsibility that must evolve as AI capabilities, business uses and risk exposures change.
12. What Should Boards Ask Management Every Quarter?
A quarterly AI governance review can be a useful mechanism for maintaining strategic visibility, although the frequency should reflect the organization's risk profile and governance calendar.
I would recommend focusing on ten questions.
AI Strategy: Where are we using AI to create measurable business value?
AI Visibility: Do we have a reliable view of material AI systems and their owners?
Risk Exposure: Which AI risks have increased since the previous review?
Risk Appetite: Are any AI initiatives operating outside approved risk boundaries?
Security and Privacy: Have we experienced material AI-related security or data incidents?
Third-Party Dependencies: Are critical AI capabilities dependent on suppliers we cannot adequately monitor?
People: Do employees and decision-makers have the necessary AI literacy and training?
Assurance: Can management demonstrate that critical AI controls are operating effectively?
Resilience: Can we safely suspend or replace AI capabilities that become unacceptable?
Strategic Readiness: Are our governance capabilities keeping pace with our AI ambitions?
These questions should lead to decisions, not simply another presentation.
The value of Board oversight is not measured by the number of AI governance meetings conducted.
It is measured by whether those discussions improve organizational decisions, clarify accountability and strengthen the organization's ability to manage AI responsibly.
13. A Practical 90-Day Roadmap for Executive AI Governance
For organizations that are still establishing enterprise-level AI governance, a structured 90-day starting point can help create momentum.
Days 1–30: Establish Executive Visibility
Identify an executive sponsor.
Confirm the AI governance mandate.
Identify material AI systems and business use cases.
Map existing ownership and decision rights.
Review current AI policies and risk appetite.
Identify major gaps in Board and executive reporting.
Deliverable: An executive AI governance baseline.
Days 31–60: Establish Accountability and Oversight
Form or designate the appropriate executive governance forum.
Define responsibilities across business and control functions.
Establish AI risk escalation criteria.
Define approval and risk-acceptance authorities.
Agree on initial KPIs and KRIs.
Establish reporting expectations.
Deliverable: An AI governance operating model and accountability matrix.
Days 61–90: Introduce Measurement and Assurance
Implement an executive AI governance scorecard.
Identify priority control domains.
Establish evidence and assurance expectations.
Review material third-party dependencies.
Conduct a governance readiness assessment.
Present material gaps and improvement priorities to the Board or designated committee.
Deliverable: An executive AI governance dashboard and improvement roadmap.
The roadmap is illustrative. Organizations with mature AI programs may need to focus on integration and assurance rather than establishing foundational structures.
The key is to move from informal oversight to a repeatable, evidence-based governance process.
14. Where International Standards and Regulations Fit
Board-level AI governance should be informed by recognized standards and applicable regulatory obligations.
Several important references provide a foundation.
ISO/IEC 42001:2023 establishes requirements for an Artificial Intelligence Management System. Its leadership provisions address top-management commitment, alignment with strategic direction, integration into business processes, resources, management responsibilities and continual improvement.
This is particularly relevant because it positions AI management as an organizational management responsibility rather than a standalone technical activity. ISO/IEC 42001 — Official Standard
NIST AI Risk Management Framework provides a voluntary framework organized around Govern, Map, Measure and Manage. Its Govern function addresses organizational policies, accountability, leadership, roles and responsibilities, while supporting integration of AI risk management across the organization. NIST AI RMF
ISO/IEC 38507:2022 provides guidance for the governance implications of organizations using artificial intelligence. It is particularly relevant to understanding the role of governing bodies in overseeing AI adoption and its implications for organizational governance. ISO/IEC 38507
The EU AI Act establishes obligations for different actors involved in AI systems. For example, Article 26 specifies obligations for deployers of high-risk AI systems, including appropriate technical and organizational measures, human oversight and monitoring. These obligations should be understood in the context of the organization's actual role and the system's regulatory classification. EU AI Act — Article 26
These references do not prescribe one universal Board committee structure or executive reporting model.
Rather, they provide governance principles and requirements that organizations should translate into structures appropriate to their size, industry, AI exposure and regulatory environment.
Final Thoughts
The evolution of AI governance is bringing an important question to the forefront of enterprise leadership:
Can an organization scale AI responsibly if its leadership does not understand the risks, own the decisions or oversee the outcomes?
AI governance cannot succeed as an isolated technology initiative.
It requires alignment between business strategy, executive accountability, enterprise risk management, technology, cybersecurity, legal, compliance, privacy and operational leadership.
The Board does not need to approve every AI use case.
It does need confidence that management understands where AI is being used, that material risks are visible, that responsibilities are clear, that controls are effective and that unacceptable risks can be escalated and addressed.
Likewise, executive leadership cannot delegate all responsibility to a governance committee or GRC function.
The governance framework must be embedded in the way the organization makes decisions, allocates resources, approves investments, manages risk and measures performance.
Ultimately, the organizations that succeed with AI will not necessarily be those that deploy it fastest.
They will be those that understand how to combine innovation with accountability, strategic oversight and trust.
AI governance is not about asking the Board to understand every algorithm. It is about ensuring that the organization understands every material decision it makes with AI.
Technology may accelerate innovation. Trust determines whether that innovation endures.
Looking Ahead
Across the first nine instalments of GRC Insights | Volume I – Responsible AI Governance, we have explored the foundations of responsible AI adoption:
Data stewardship
The AI governance blind spot
AI risk registers
Governance maturity
Board-level metrics
AI incident management
Governance assurance
Third-party AI risk
Executive and Board accountability
The next challenge is to look beyond the traditional AI model and consider a rapidly evolving capability: Agentic AI.
AI systems are increasingly moving from generating recommendations and content to interacting with tools, accessing enterprise information, executing workflows and taking actions with varying degrees of autonomy.
That creates a new governance question:
How do you govern an AI system that does not simply answer a question, but can independently take action on behalf of your organization?
Next: Part X — Agentic AI Governance: Who Controls the Agents That Act on Our Behalf?
We will explore autonomous AI agents, identity and access management, delegated authority, human intervention, agent monitoring, accountability, security controls and the extension of Enterprise GRC into the agentic AI environment.
Because when AI begins acting on behalf of an organization, governance must extend beyond what it knows to what it is authorized to do.
Sources & Further Reading
1. ISO/IEC 42001:2023 — Artificial Intelligence Management System
The international standard for establishing, implementing, maintaining and continually improving an AI Management System. Particularly relevant to leadership commitment, policy, roles, responsibilities and integration into organizational processes.
ISO/IEC 42001 — Official ISO Page
2. NIST — Artificial Intelligence Risk Management Framework (AI RMF 1.0)
A voluntary framework for managing AI risks through Govern, Map, Measure and Manage. Its governance function provides a useful foundation for executive accountability and organizational oversight.
NIST AI Risk Management Framework
3. NIST — AI RMF Playbook
Practical implementation guidance aligned with the AI RMF functions, including governance structures, accountability, documentation, measurement and risk management.
4. ISO/IEC 38507:2022 — Governance Implications of the Use of Artificial Intelligence by Organizations
Guidance on the governance implications of AI adoption, with relevance to the responsibilities of governing bodies and organizational leadership.
ISO/IEC 38507 — Official ISO Page
5. European Union — Artificial Intelligence Act
The official legislative text establishing obligations for different AI actors and systems, including provisions concerning high-risk AI systems and their deployers.
6. European Union — Article 26: Obligations of Deployers of High-Risk AI Systems
A useful reference for understanding specified deployer responsibilities, including human oversight, monitoring and operational controls.
7. The Institute of Internal Auditors — Global Practice Guide: Artificial Intelligence
A useful reference for Internal Audit professionals considering AI governance, risk and assurance responsibilities.
IIA — Artificial Intelligence Resources
A note on the original framework
The AI Governance Leadership Framework — Six Pillars of Executive Oversight, Board AI Governance Scorecard, accountability matrix and 90-day roadmap presented in this article are original practical models developed for the GRC Insights | Responsible AI Governance series.
They are intended to support organizational discussion and implementation. They are not official NIST, ISO/IEC, IIA or regulatory frameworks, nor should they be interpreted as legal requirements.
Regulatory applicability and governance responsibilities depend on the organization's jurisdiction, structure, industry, AI use cases and the roles it performs.
.png)
