AI governance
What AI governance is, and how it runs in practice
AI governance is the operating structure that decides who owns each AI system, what it may do, who can change it, where people review its work, and what evidence proves it.
This guide covers what effective governance includes, how it differs from AI risk management, how the main frameworks relate to implementation, and which Sentient page answers each next question.
01
- Own
- Decide
- Control
- Prove
What AI governance is
Governance decides who may do what with AI, and keeps the record.
AI governance covers the models, AI vendors, agents, and automations a company builds or relies on. For each one it settles ownership, approved use, decision authority, required controls, human review, and the evidence that shows all of it happened.
A policy states intent. Governance is the structure that makes the intent hold when a model changes, a vendor is added, an agent gains a new permission, or a customer asks for proof.
It works best when it is built into the tools and workflows teams already use, so approvals, controls, evidence, and review are produced by doing the work rather than by separate compliance tasks.
Governance is something a company runs, not a document it keeps.
Questions governance answers
- Which AI systems are in use?
- Who owns each one?
- What is it approved to do?
- Who can approve a change or accept a risk?
- Where must a person review the outcome?
- What shows the controls actually ran?
02
- Inventory
- Authority
- Controls
- Evidence
What effective AI governance includes
Eight working parts that depend on each other.
Each part is a record, control, or workflow with a named owner. Remove one and the others stop holding.
01
Inventory
A current register of AI systems, models, vendors, agents, and automations, with their purpose, data, and dependencies.
AI system inventory
02
Ownership
One accountable person for each system, and a handover step when that person or team changes.
Accountability
03
Decision authority
Who can approve a use, accept a risk, grant an exception, or stop a system, and at which thresholds.
Decision rights
04
Controls
Approval gates, checks, and restrictions placed in the workflows where the work happens, sized to risk.
Operating controls
05
Human review
Defined review points with named reviewers who have the authority to approve, intervene, or stop an outcome.
Human oversight
06
Escalation and exceptions
The conditions that send a decision upward, who receives it, and how departures from approved use are approved and time-limited.
Triggers and routes
07
Change management
Changes to models, prompts, data, vendors, or permissions trigger review again, with the approval kept on record.
Change traceability
08
Evidence
Approvals, reviews, and decisions recorded as they happen, so they can be produced without reconstruction.
Audit evidence
Together they form one loop. An owner approves a use within defined authority. Controls and human review hold it to that boundary. Escalation and exceptions handle departures. Change management reopens the decision when the system changes. Evidence records every step.
03
- Identify
- Assess
- Decide
- Record
AI governance and AI risk management
Risk management finds the risk. Governance decides who acts on it.
The two are often used interchangeably. They do different jobs, and companies need both.
AI risk management
AI governance
AI risk management
Identifies and assesses risks in each AI system.
AI governance
Decides who owns each system and who is authorized to accept its risk.
AI risk management
Rates likelihood and impact.
AI governance
Sets the thresholds at which decisions escalate, and to whom.
AI risk management
Recommends treatments and mitigations.
AI governance
Assigns each treatment to an owner, builds the control, and records that it ran.
AI risk management
Maintains a risk register.
AI governance
Connects the register to approvals, changes, exceptions, and evidence.
The NIST AI Risk Management Framework reflects this. Its Govern function runs across the other three functions, Map, Measure, and Manage, rather than sitting beside them.
04
- Roles
- Forums
- Thresholds
- Cadence
AI governance operating model
The operating model is how governance gets run, week to week.
An AI governance operating model sets which roles and forums make which decisions, how AI questions reach people who can resolve them, and the recurring cadence that keeps records current.
It should fit the company. A growth-stage company may run it with a founder, an engineering lead, and a monthly review. An enterprise may need a cross-functional committee, risk tiers, AI vendor risk review, and board reporting.
Designing the operating model? AI governance consultingSized to the company you are now, with room to grow.
What the operating model sets
- Roles, forums, and accountability lines
- Decision rights and authority thresholds
- Risk tiers that scale scrutiny
- Review cadence and renewals
- Board reporting
- Handover when people change
05
- Identity
- Authority
- Runtime
- Revoke
When agents and automation gain authority
When systems act on their own, governance follows the authority.
Once agents and automations take actions instead of suggesting them, the question moves from what a model says to what a system is allowed to do, under whose authority, and how fast it can be stopped.
01
Identity and ownership
Agent identity
Each agent acts under its own identity with a named human owner, so its access and actions can be attributed and reviewed.
02
Delegated authority
Least privilege
Permissions sized to the task, with defined limits and an expiry, reviewed when purpose or scope changes.
03
Human approval thresholds
Human oversight
The actions that need a named person to approve them, placed where that review can still change the outcome.
04
Runtime governance
Runtime enforcement
Controls that hold while the system runs. Sentient defines which controls are required; your runtime mechanisms enforce them. Sentient is not the enforcement platform.
05
Revocation and shutoff
Fail-closed
Who can suspend an agent or automation, how quickly it takes effect, and what happens when a required control is unavailable.
06
- NIST
- ISO
- EU
- US states
Frameworks and regulation
Frameworks say what to achieve. Implementation decides how.
Each framework is a recognized route into the same operating work: inventory, ownership, controls, human oversight, evidence, and change records. Build that work once and map it to every framework that applies.
Sentient maps governance to the frameworks that apply. It does not give legal opinions, and it does not audit or certify.
01
NIST AI Risk Management Framework
Voluntary U.S. framework
Published by NIST in January 2023. It organizes AI risk work into four functions, Govern, Map, Measure, and Manage, and leaves the operating design to each company.
- Govern
- Map
- Measure
- Manage
02
ISO/IEC 42001
Certifiable management system standard
The international standard for an AI management system, published in December 2023. Certification is issued by accredited certification bodies after independent assessment.
- AI management system
- Annex A controls
- Management review
03
EU AI Act
EU regulation
Regulation (EU) 2024/1689, in force since August 2024, with obligations phased in by risk category and role. It can reach companies outside the EU whose AI systems or outputs are used there.
- Risk classification
- Human oversight
- Documentation
04
Emerging U.S. state requirements
State law
U.S. requirements are developing state by state. California is adding transparency, risk-assessment, and independent-audit standards. Which rules apply depends on the law and the company.
- Transparency
- Risk assessment
- Independent audit
Each framework has its own page covering what it requires operationally.
07
- Decide
- Build
- Test
- Operate
What implementation involves
Implementation turns decisions into records, controls, and workflows.
Governance becomes real when each requirement has an owner, a trigger, and a record, and the team uses it in daily work.
01
Decide what should exist
Governance architecture
Settle the operating model, ownership, decision rights, risk tiers, control requirements, and evidence requirements before building.
02
Build into existing tools
Embedded governance
Stand up the inventory, ownership records, controls, review paths, and escalation inside the tools teams already use, with automation handling routing and evidence capture.
03
Test on real work
Commissioning
Exercise every control, review, and escalation path on actual decisions and changes, and fix what fails before calling it operational.
04
Operate and keep current
AI governance operations
Run the review cadence, renew approvals, and update records as systems, people, and vendors change.
05
Prepare for independent review
Audit readiness
Organize the evidence so a customer, auditor, insurer, or acquirer can trace each control to its owner and history. Sentient prepares the operating environment; it does not manufacture assurance.
08
- Question
- Answer
Questions, answered
Short answers to common AI governance questions.
What is AI governance?
AI governance is the operating structure that decides who owns each AI system, what it is approved to do, who can approve changes or accept risk, where a person must review its work, and what evidence shows those decisions were followed. It covers models, AI vendors, agents, and automations in production.
What is enterprise AI governance?
Enterprise AI governance is the same structure run across many teams, systems, and vendors. It adds risk tiers, cross-functional decision forums, board reporting, and the evidence that enterprise procurement, auditors, and insurers expect to see.
Design the operating modelHow is AI governance different from AI risk management?
AI risk management identifies, assesses, and treats risks in AI systems. AI governance decides who acts on those findings: who owns each system, who may accept risk, which controls must run, and how the company proves they did. Risk management is one function inside governance.
What is an AI governance operating model?
An AI governance operating model sets the roles, decision forums, authority thresholds, and review cadence through which AI decisions get made and recorded. It should be sized to the company's systems, obligations, and stage rather than copied from a template.
AI governance consultingWho should own AI governance in a company?
An accountable executive should own the governance structure, and a named person should own each AI system, agent, and vendor. Ownership works when it comes with defined decision rights and a handover step for when people change roles.
09
- Discuss
- Design
- Implement
- Operate
Be ready before they ask
Build the operating structure before the next customer, investor, insurer, partner, or buyer demands proof.
Sentient builds the governance structure companies need to show how AI is owned, controlled, reviewed, evidenced, and operated. Talk to Sentient about what your customers, investors, insurers, partners, or buyers will expect to see.