Research
AI Governance, Risk & Compliance
Regulators, customers and boards expect organizations to know where AI is used and how its risks are controlled. This area covers the laws, standards, assessments and assurance practices that make AI governable.
Topics in AI Governance, Risk & Compliance
AI Regulations (EU AI Act, US state laws)
The main AI laws, their scope and where their timelines stand.
Frameworks & Standards (NIST AI RMF, ISO/IEC 42001)
Voluntary frameworks and certifiable standards for AI governance.
Responsible AI (bias, transparency, accountability)
Putting fairness, transparency and accountability into practice.
Overview
AI governance sets the rules, roles and controls for developing, buying and using AI. It draws on regulation such as the EU AI Act and a growing body of US state law, voluntary frameworks such as the NIST AI Risk Management Framework, and management system standards such as ISO/IEC 42001.
The regulatory picture is changing quickly. Deadlines have moved in the EU, and US state laws are being amended, replaced and challenged. A durable program is built on an inventory of AI systems and a risk-based control framework that can absorb new requirements without starting over.
New report: Third-Party AI Risk
A 60-page lifecycle method for the AI you buy, license, switch on or download, with supplier tiering, the Assurance Evidence Ladder and ready-to-use forms and checklists.
What leaders need to get right
- Inventory. Know every AI system in use, including AI inside purchased software.
- Risk tiers. Scale review and controls to the potential impact of each use.
- Accountability. Named owners and a clear approval path.
- Evidence. Documentation and testing that stand up to an auditor or regulator.
Research report
Extend your AI governance program to agents
Governing Agentic AI 2026 adds an agent registry, risk tiering, approval authorities by tier, a RACI and a model agent governance policy to the governance you already run.
Featured research report
Governing Agentic AI 2026
67-page playbook for governing enterprise AI agents: autonomy levels, risk tiers, agent identity, MCP controls and human oversight. Includes 10 ready-to-use templates.
Questions leaders should ask
- Do we have a complete inventory of AI systems, including vendor AI?
- Which of our AI uses would be considered high-risk under laws that apply to us?
- Who can approve, pause or retire an AI system?
- Could we show an auditor how a specific AI decision was governed?
Other research areas
Related research reports
In-depth reports with ready-to-use templates.
- Governing Agentic AI 2026$59.99 PDF report
- Third-Party AI Risk$59.99 PDF report
Related research reports
Reports connected to this topic.
Latest insights on AI Governance, Risk & Compliance
Trust, Security, and Accountability: The Foundations of Responsible AI Delivery
Trust in an AI service requires examining correctness, protection, and accountability separately, with evidence that boundaries are enforced.
EU AI Act After the Digital Omnibus: The New Compliance Calendar and What Not to Delay
High-risk AI obligations under the EU AI Act now start in December 2027 and August 2028. Transparency duties did not move. A clear calendar and a plan for using the extra time.