Research
AI Governance, Risk & Compliance
Regulators, customers and boards expect organizations to know where AI is used and how its risks are controlled. This area covers the laws, standards, assessments and assurance practices that make AI governable.
Topics in AI Governance, Risk & Compliance
AI Regulations (EU AI Act, US state laws)
The main AI laws, their scope and where their timelines stand.
Frameworks & Standards (NIST AI RMF, ISO/IEC 42001)
Voluntary frameworks and certifiable standards for AI governance.
Responsible AI (bias, transparency, accountability)
Putting fairness, transparency and accountability into practice.
Overview
AI governance sets the rules, roles and controls for developing, buying and using AI. It draws on regulation such as the EU AI Act and a growing body of US state law, voluntary frameworks such as the NIST AI Risk Management Framework, and management system standards such as ISO/IEC 42001.
The regulatory picture is changing quickly. Deadlines have moved in the EU, and US state laws are being amended, replaced and challenged. A durable program is built on an inventory of AI systems and a risk-based control framework that can absorb new requirements without starting over.
What leaders need to get right
- Inventory. Know every AI system in use, including AI inside purchased software.
- Risk tiers. Scale review and controls to the potential impact of each use.
- Accountability. Named owners and a clear approval path.
- Evidence. Documentation and testing that stand up to an auditor or regulator.
Questions leaders should ask
- Do we have a complete inventory of AI systems, including vendor AI?
- Which of our AI uses would be considered high-risk under laws that apply to us?
- Who can approve, pause or retire an AI system?
- Could we show an auditor how a specific AI decision was governed?
Other research areas
Latest insights on AI Governance, Risk & Compliance
New articles in this area are on the way. In the meantime, explore the Research library.