Research
AI Governance, Risk & Compliance
Regulators, customers and boards expect organizations to know where AI is used and how its risks are controlled. This area covers the laws, standards, assessments and assurance practices that make AI governable.
Topics in AI Governance, Risk & Compliance
AI Regulations (EU AI Act, US state laws)
The main AI laws, their scope and where their timelines stand.
Frameworks & Standards (NIST AI RMF, ISO/IEC 42001)
Voluntary frameworks and certifiable standards for AI governance.
Responsible AI (bias, transparency, accountability)
Putting fairness, transparency and accountability into practice.
Overview
AI governance sets the rules, roles and controls for developing, buying and using AI. It draws on regulation such as the EU AI Act and a growing body of US state law, voluntary frameworks such as the NIST AI Risk Management Framework, and management system standards such as ISO/IEC 42001.
The regulatory picture is changing quickly. Deadlines have moved in the EU, and US state laws are being amended, replaced and challenged. A durable program is built on an inventory of AI systems and a risk-based control framework that can absorb new requirements without starting over.
New report: Third-Party AI Risk
A 60-page lifecycle method for the AI you buy, license, switch on or download, with supplier tiering, the Assurance Evidence Ladder and ready-to-use forms and checklists.
What leaders need to get right
- Inventory. Know every AI system in use, including AI inside purchased software.
- Risk tiers. Scale review and controls to the potential impact of each use.
- Accountability. Named owners and a clear approval path.
- Evidence. Documentation and testing that stand up to an auditor or regulator.
Research report
Extend your AI governance program to agents
Governing Agentic AI 2026 adds an agent registry, risk tiering, approval authorities by tier, a RACI and a model agent governance policy to the governance you already run.
Featured research report
Governing Agentic AI 2026
67-page playbook for governing enterprise AI agents: autonomy levels, risk tiers, agent identity, MCP controls and human oversight. Includes 10 ready-to-use templates.
Questions leaders should ask
- Do we have a complete inventory of AI systems, including vendor AI?
- Which of our AI uses would be considered high-risk under laws that apply to us?
- Who can approve, pause or retire an AI system?
- Could we show an auditor how a specific AI decision was governed?
Other research areas
Related research reports
In-depth reports with ready-to-use templates.
- Governing Agentic AI 2026$59.99 PDF report
- Third-Party AI Risk$59.99 PDF report
Related research reports
Reports connected to this topic.
Latest insights on AI Governance, Risk & Compliance
AI Agent Audit Trails: Reconstructing Decisions, Tool Calls, and Approvals
An AI agent audit trail is useful only if it can answer who initiated a task, what authority the agent had, which external actions were attempted, what the controls permitted, [...]
Buying AI Security Agents: A Third-Party Risk and Control Framework
Buying an AI security agent is not the same as buying another monitoring tool. A conventional product may collect telemetry, detect a threat, and recommend a response. An agent may [...]
Four Control Planes for Enterprise AI Agents: Identity, Authorization, Egress and Audit
A four-part framework for governing enterprise agents through independently enforceable identity, authorization, egress and audit controls.