AI Governance

What it is

It extends questions that data governance already asks, about ownership, permitted use and quality, to systems that make or support decisions. It adds questions of its own: how a system is classified by risk, how it is tested, and who may approve its use.

Two reference points exist to build against. The NIST AI Risk Management Framework organises the work into four functions: govern, map, measure and manage. ISO/IEC 42001:2023 is a management-system standard for AI; DII cites it from its catalogue entry and has not read the standard itself.

Why it matters

Obligations for high-risk AI systems in the EU now have fixed application dates, and a management-system standard and a risk framework exist to build against. Data governance teams are being asked to extend their remit.

Under the EU AI Act as amended by Regulation (EU) 2026/1744, the rules for high-risk systems apply from 2 December 2027 for systems that are high-risk under Article 6(2) and Annex III, and from 2 August 2028 for those under Article 6(1) and Annex I.

The problem it addresses

DII editorial view

AI systems tend to arrive faster than the means of deciding about them. Without governance there is no inventory, no consistent view of risk and no named person who can approve or stop a use. The result is either uncontrolled use or case-by-case negotiation that slows everything down.

Business and organisational relevance

DII editorial view

The organisational question is where AI governance sits. It can extend an existing data governance function, sit with risk, or stand alone. One professional body reports that 77% of organisations are already working on AI governance; that figure is from its own summary of its 2025 report.

Practical use cases

• An inventory of AI systems, classified against the high-risk categories
• An approval route for new AI uses, with a named decision-maker
• Extending data governance roles to the data that AI systems are trained and run on

Benefits and opportunities

• Clear accountability for AI decisions before a regulator or customer asks
• One process for approving AI uses, in place of case-by-case negotiation

Risks, limitations and dependencies

• Governance defined on paper with no authority to stop a deployment
• Duplicating data governance instead of extending it
• Leaving classification of systems until the application dates are close

Prerequisites for adoption

DII editorial view

• Agreement on where AI governance sits relative to data governance and risk
• An inventory of AI systems in use and in development
• Decision rights: someone with authority to approve, restrict or stop a use

Implementation considerations

• Decide where it sits. Settle the relationship between AI governance and data governance first; most other choices follow from it.
• Inventory before policy. Inventory AI systems against the high-risk categories before the application dates.
• Build against a published framework. A recognised framework gives a structure that auditors and partners already understand.

The DII Radar assessment

Approved DII Radar assessment

DII assesses AI Governance as Very High relevance, with direction Rising. Its strategic impact is assessed as High and its enterprise adoption as Scaling. It is one of the ten entries on the current Radar.

DII relevance is our assessment of current significance and momentum, based on evidence, market development and adoption. Direction is the observed trajectory of relevance and adoption. Strategic impact is the potential or current significance to enterprise data capability, and enterprise adoption is the extent of current real-world enterprise adoption; together they set the position on the Radar. The Radar is not a prediction, vendor comparison or performance ranking.

Evidence basis: EU AI Act as amended by Regulation (EU) 2026/1744 (high-risk rules apply from 2 December 2027 and 2 August 2028); NIST AI RMF 1.0; ISO/IEC 42001:2023; IAPP survey report (2025).

See AI Governance on the Radar →

What to consider next

DII editorial view

• Decide where AI governance sits relative to data governance
• Inventory AI systems against the high-risk categories before the application dates
• Build against a published framework, so that auditors and partners recognise the structure