AI governance
Definition
AI governance is the set of rules defining which AI systems a company operates, on what data, with which permissions, under whose responsibility, and how outcomes are reviewed. It makes AI use auditable towards management, auditors and regulators.
For companies in the EU this connects directly to the AI Act and the GDPR: purpose, legal basis, data flows and risk classification must be documented per use case.
Practically it is a short register — system, purpose, data, model, hosting region, owner, escalation rule — kept current rather than a policy binder.
In practice
- Per-use-case register: purpose, data, model, owner, risk class
- Documented escalation and human oversight rules
- Reviewed when the process, model or provider changes
Related terms
- EU AI ActThe EU AI Act is the European regulation that classifies AI systems by risk and attaches obligations accordingly — from transparency duties for ordinary business applications to strict requirements for high-risk uses such as employment decisions or creditworthiness.
- Data residencyData residency defines in which jurisdiction company data is stored and processed. For AI systems it covers the hosting region of the application, the database, the model endpoint and any logs, plus whether prompts may be used for provider training.
- GuardrailsGuardrails are the technical limits around an AI system: allowed tools, value ranges, spending and volume caps, forbidden actions and mandatory approvals. They turn an unpredictable model into a system that fails safely and visibly.