Lesson · 6 min · Stage 1
What AI governance is
Learning goal: Explain AI governance in one minute.
For reference purposes only. Not legal advice.
Draft: not yet fact-checked or legally reviewed
Key points
- AI governance is the set of rules, roles and practices that keep AI use responsible and lawful.
- It matters for three reasons: people can be harmed, trust is easy to lose, and the law is catching up.
- Governance is wider than compliance. Compliance asks "what must we do?"; governance also asks "what should we do, and who decides?"
- A simple lifecycle of eight stages covers the work, from setting up to retiring a system.
- Many roles are involved: leaders, owners, builders, legal, privacy, security and audit.
Who this is for: anyone new to the topic. Related stage: Set up governance.
The one-minute version
AI governance is how an organization decides how AI is used, who is answerable for it, and how problems are found and fixed. It is made of three things: rules (a policy), roles (who decides and who does the work), and practices (checks, records and reviews that actually happen).
Why AI needs its own governance
Traditional software follows fixed rules. Given the same input, it gives the same output, and it fails when there is a bug or an outage. AI systems learn statistical patterns from data and give answers that can vary. They can keep running smoothly while producing wrong, unfair or harmful results, and nothing crashes to warn you. That is why you need ongoing monitoring, fairness checks and clear owners, not just testing before release.
Governance is more than compliance
Compliance means meeting the rules that apply to you. Governance includes that, and also covers choices the law does not make for you: which uses are acceptable, how much risk you will accept, and who signs off. A good program lets you answer a regulator, a customer or your own board with evidence.
Two layers: charter and operating model
Think of governance in two layers. The governance charter is the “what and why”: the program’s purpose, authority, scope and escalation routes. The operating model is the “how”: workflows, team structures, decision levels and tools. When something is slow, ask which layer is the cause. If the targets are unrealistic, that is a charter problem. If work is blocked by manual approvals, that is an operating model problem.
Example
A delivery company switched its customer service chat to a generative model. Nobody tested for unintended output before launch and nobody was accountable for production monitoring. The chatbot refused simple tracking questions and wrote a poem criticizing the company. The model was not the only failure: the program had no owner and no pre-launch check.
What to do now
- Find out who in your organization is accountable for AI use. If nobody, name someone.
- Read the eight lifecycle stages and note which ones you already do.
- Take the two-minute readiness check.
Sources
- Supplied governance study notes (module 1)
Reviewed 2 Oct 2026. Sources: NIST AI Risk Management Framework; OECD AI Principles.
Terms used: Governance charter, Operating model.
Part of: Everyone path, Leaders path.
Was this page useful? Tell us what is missing or wrong ↗ · Report a correction