AI Governance Framework: Policies, Roles and Controls for US Companies
2 Views
Summarize Article
Related Blogs
Summarize Article
In IBM’s 2025 breach study, 63% of breached organizations had no AI governance policy in place, or were still drafting one. State law is catching up. Colorado’s new automated decision-making statute starts imposing duties on January 1, 2027.
An AI governance framework is the set of roles and rules a company uses to decide which AI systems it runs and how it checks them. It also names who answers when something goes wrong. Good intentions become named owners and a review calendar.
This guide gives US companies a working model with roles, a six-part policy set and risk tiers, then closes with a NIST mapping and a one-page template to adapt.
AI governance is the way a company directs and controls its use of AI, so each system stays lawful and earns its cost. The scope runs from who approves AI use to how results get checked over time. Without it, AI spreads through personal accounts and vendor features nobody reviewed.
People asking “what is AI governance” often expect a compliance checklist. In practice the answer looks more like an operating model. Compliance tells you which laws apply. Governance decides who reviews a new chatbot and who can switch a model off.
Two pressures make it urgent for US firms. The Colorado law, SB26-189, was signed on May 14, 2026. It requires notices and plain-language explanations for automated decisions in areas such as lending and employment, and it asks companies to keep compliance records for at least 3 years. Enterprise buyers also now ask suppliers about AI controls in their security questionnaires.
The regulations themselves are covered in our AI compliance framework guide. This post covers the operating model that keeps you compliant.
An AI governance framework should rest on a short list of principles, each backed by a concrete rule. Five work well for US companies. Proportionality matters most day to day, because it keeps heavy controls for high-risk systems and light ones for low-risk tools.
| Principle | What it means in practice |
| Accountability | Every AI system has one named business owner |
| Proportionality | Controls scale with the risk tier of the system |
| Transparency | People know when AI shapes a decision about them |
| Security | AI tools follow the company’s existing access controls |
| Monitoring | Systems get re-tested on a schedule after launch |
Put the principles on one page and have the executive team sign it. Every later policy decision gets tested against that page.
An AI governance framework assigns four core roles: an executive AI owner, a business owner per system, a risk reviewer and a security lead. A small review group brings them together for higher-risk approvals. Larger firms add model validation. Smaller firms let one person hold two roles.
| Role | Owns | Typical title |
| Executive AI owner | The framework and final escalation | CTO or Chief AI Officer |
| Business owner | One AI system’s results and risks | Head of the team using it |
| Risk and compliance | Risk tiering and legal review | General counsel or compliance lead |
| Security lead | Access control and vendor security | CISO or IT security lead |
| AI review group | Approval of Tier 1 and Tier 2 systems | The four roles above, meeting monthly |
Keep the review group small. Five people deciding in a monthly meeting move faster than a committee of fifteen.
The federal government offers a reference point. OMB memo M-25-21 gave each agency 60 days to name a Chief AI Officer and required processes for its high-impact AI. The role split translates well to private companies.
Need roles and policies in place before your next AI launch?
WebOsmotic drafts your AI governance framework, maps it to the NIST AI RMF and runs the first review cycle with your team.
A working AI governance framework has six short policy documents, each two to four pages long. Together they cover how staff use AI, how the company buys it and how it builds its own. Publish them in one place and review each one every 12 months.
Generative AI governance needs its own document because the risks differ. Staff paste data into prompts, and outputs can be wrong with full confidence. NIST’s Generative AI Profile, released July 26, 2024, lists 12 such risks and just over 200 actions to manage them.
Start that policy with two rules: an approved tools list, and a ban on entering regulated data into anything else. Add human review for every customer-facing output before the first public launch.
A model inventory lists every AI system the company runs or buys, with its owner and risk tier. Risk tiers then decide how much review each system gets. A three-tier scheme suits US companies of most sizes, based on the harm a wrong output could cause.
| Tier | Example systems | Required controls |
| Tier 1, high | Credit decisions, hiring screens | Review group approval, bias testing, human review |
| Tier 2, medium | Customer-facing chatbots | Owner approval and pre-launch testing |
| Tier 3, low | Internal drafting and summaries | Approved tools list only |
The top tier of your AI governance framework lines up with the decision areas named in Colorado’s law. Placing lending and hiring systems there from day one prepares you for state rules as they spread.
Monitoring follows the tier. High-risk systems log every decision and get re-tested every 90 days, while a monthly sample of 50 to 100 outputs is enough for the middle tier. Audit trails make this provable, and our guide to LLM audit trails shows what to capture.
The NIST AI Risk Management Framework sorts AI risk work into four functions, named Govern, Map, Measure and Manage. An AI governance framework maps onto them neatly. Roles and policies sit under Govern, while the inventory sits under Map. Testing and monitoring fill the last two.
| NIST function | What it asks | Where it lives in your framework |
| Govern | Is there a structure for AI risk? | Roles and policies |
| Map | Is each system’s risk understood? | Model inventory and risk tiers |
| Measure | Are risks tested and tracked? | Pre-launch testing and bias checks |
| Manage | Are risks acted on? | Monitoring and incident response |
The NIST AI RMF is voluntary. Version 1.0 came out on January 26, 2023. NIST says it is now being revised under the White House AI Action Plan.
Mapping to NIST gives auditors and enterprise customers a familiar reference. Firms that sell into large enterprises can go one step further with ISO/IEC 42001, the certifiable standard for AI management systems.
A one-page AI governance framework template names the owner and the principles, links the policies and sets the review rhythm. One page is the limit, so leaders actually read it. Detail lives in the six policies, so the page stays short. Adapt the template below.
| Section | Fill in |
| Executive AI owner | Name and title |
| Principles | Five lines, one per principle |
| Policies | Links to the six policy documents |
| Inventory | Location and the person who updates it |
| Risk tiers | Tier definitions and required controls |
| Review rhythm | Monthly review group, 90-day Tier 1 re-tests |
| Escalation | Who can pause an AI system, and within how many hours |
Review the whole framework once a year, and again when a new law or a major AI system arrives. For help drafting the policies or running the first inventory, our AI consultancy services team works alongside legal and security.
Before the governance work starts, the AI readiness assessment shows where today’s gaps sit.
Want the template filled in for your company?
Our AI consultants build the inventory and set a risk tier for each system. Your legal team gets policies it can sign within 6 weeks.
AI governance is how a company chooses its AI tools and sets rules for using them, then checks the results. A basic version needs one executive owner, a short acceptable use policy and a list of AI systems in use. Mid-sized firms can set that up in 4 to 6 weeks.
No single federal law requires one. State laws are arriving, though. Colorado’s SB26-189 sets duties for automated decisions starting January 1, 2027, with a 60-day cure period before the attorney general can act. Sector regulators also expect existing rules to cover AI.
Generative AI governance adds rules for prompts and outputs, because staff use these tools directly every day. Copyright questions also come up. NIST’s Generative AI Profile lists 12 risks specific to or made worse by generative AI, including confabulation and data privacy, so a separate short policy keeps the rules practical.
Start with an approved tools list and a rule against entering regulated data into unapproved tools. Add human review for customer-facing outputs. Those rules cover the most common incidents, and the procurement and incident response policies can follow within 90 days.
Review the whole framework every 12 months, re-test high-risk systems every 90 days and sample medium-risk outputs monthly. Trigger an early review when a new state law takes effect or the company launches a system that falls into the top tier.
