Skip to content
Book a consult

Insights  /  Governance

What “AI governance” should look like in practice

How to design controls that protect the business without slowing delivery.

Sopra Labs AI  ·   ·  6 min read
sopralabs ai governance hero

Key takeaways

  • An AI policy is a statement of intent. Governance is the working system that decides which AI uses go ahead, who is accountable for each one, and how the output is checked.
  • The gap between the two is measurable. In a 2026 survey of 1,200 senior decision-makers, 17% said governance is embedded by design and 5% said accountability is clear across the AI lifecycle (OneTrust).
  • Five working parts carry most of the load: an inventory, risk tiers, review gates, named owners and monitoring. Each one maps to the NIST AI Risk Management Framework.
  • Risk tiers are what keep governance fast. Low-risk work gets a same-day yes, so review time goes to the few uses that need it.

The policy passed. Nothing changed.

The AI policy was approved in the spring. Eleven pages, reviewed by legal, signed by the executive team, posted to the intranet.

Six months later, in an operations review, the COO asks what sounds like a simple question: how many AI tools are we using, and who approved them?

IT can name four, the ones with licenses. A quick poll of department heads turns up fourteen. Finance has been summarizing vendor contracts in a tool nobody reviewed. Marketing has an agent drafting customer emails. A sales manager built something over a weekend that the team now depends on.

Nobody broke the policy. The policy said to use AI responsibly. It never said who decides what that means.

A policy says what. Governance says who, when and how.

This is the normal state of things, not a scandal. McKinsey’s 2026 global survey found that 44% of respondents say AI is now scaling across their enterprise, up from 38% a year earlier (McKinsey). Use is spreading faster than the means of overseeing it.

The numbers on oversight are less comfortable. OneTrust and Sapio Research surveyed 1,200 senior decision-makers in mid-2026. Of those, 87% said their organizations encourage the use of AI agents, and 47% said that use is supported by clear governance. Nearly a third (31%) had identified use cases for review only after they were already in use (OneTrust). The survey comes from a company that sells governance software, so read it as evidence from an interested party. The direction still matches what the COO just found.

The reason is structural. A policy is written as a set of principles: be responsible, protect data, keep a human involved. Principles do not allocate decisions. An employee with a useful tool and a deadline has two options: ask permission from a process that does not exist, or ask nobody. The finance analyst is not reckless. There was no path to yes, so there was no reason to ask.

The same survey found that a third of organizations had employees turn to unapproved tools because the approved options were too slow. Slow governance does not reduce AI use. It moves it out of sight.

NIST’s AI Risk Management Framework describes governance the other way round. Its GOVERN function “is a cross-cutting function that is infused throughout AI risk management and enables the other functions of the process” (NIST). Governance in that sense is not a document that precedes the work. It is part of how the work runs.

The stakes are no longer hypothetical. In IBM’s 2026 breach research, covering 602 organizations, more than 20% reported a breach that targeted AI models or applications (IBM). Regulation is arriving in stages as well. The EU AI Act’s transparency duties applied from 2 August 2026, while its high-risk obligations for stand-alone systems were moved to 2 December 2027 after the European Parliament and Council approved the change in June 2026 (Jones Walker). A delay is not a reason to wait. An organization that already knows what it runs will find those obligations far easier to meet.

Build the five working parts

Practical governance is five things that exist and get used. None of them needs new software to start.

Start with the inventory. You cannot govern what you have not listed. NIST makes this a baseline: “Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities” (NIST Playbook, GOVERN 1.6). A spreadsheet is enough at first: what the system is, who owns it, what data it touches, and who relies on its output. Include the AI features inside tools you already license.

Sort by risk, not by tool. Three tiers will do. Low: internal drafting and research with no sensitive data. Medium: customer-facing content and anything that informs an internal decision. High: decisions about people, regulated data, or money. Most use falls in the low tier, and it should get a yes the same day under standing rules. That is where the speed comes from.

Put review where the risk is. Medium and high tiers get defined review gates: before launch, after a material change, and on a schedule. NIST asks that “processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the govern function” (NIST AI RMF, MAP 3.5). Decide in advance which outputs a person checks, and what happens when the check fails.

Name the owner. Every system on the inventory has one accountable person, and the approvals are written down. NIST places the ultimate responsibility plainly: “Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment” (NIST AI RMF, GOVERN 2.3). A RACI and a decision log are unglamorous. They are also what you will reach for when someone asks who approved this.

Watch what runs. Track usage, incidents and output quality, and review the inventory every quarter. Retire what nobody uses. Re-tier what has changed. New models and tools arrive constantly, and a governance system that cannot absorb them will be bypassed.

The usual objection is that this is bureaucracy. Bureaucracy is what happens when every request gets the same heavy review. Tiering is the opposite: it gives most work a fast lane and saves scrutiny for the few uses that warrant it.

If customers or regulators later ask for formal assurance, ISO/IEC 42001 “specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System” (ISO). An organization with these five parts in use starts that work from evidence, not from a blank page.

The same question, six months on

The COO asks again: how many AI tools are we using, and who approved them? This time the answer takes a minute. Fourteen systems, each with an owner, a tier and a last-review date. Two were retired. One moved up a tier when it started touching customer data.

Nothing about that answer is impressive, which is the point. Governance was never the eleven pages. It is being able to answer the question.

The opening scenario is a composite of common patterns, not a client engagement. SopraLabs builds these working parts with leadership teams as the Governance & Risk Controls module of our services.

Frequently asked questions

What is AI governance?

AI governance is the set of roles, rules and checks an organization uses to decide which AI uses go ahead, who is accountable for each one, and how results are monitored. A written policy is one input. The working parts are an inventory, risk tiers, review gates, named owners and monitoring.

What is the difference between an AI policy and AI governance?

A policy states principles. Governance allocates decisions: who approves a new use, what review it gets, and who answers for it afterward. An organization can have a signed policy and still be unable to say what AI it is running.

Do we need to adopt the NIST AI RMF or ISO/IEC 42001 to get started?

No. The NIST AI Risk Management Framework “is intended for voluntary use” and is free, which makes it a practical reference (NIST). ISO/IEC 42001 is a management system standard for “organizations of any size” and becomes relevant when customers or regulators ask for formal assurance (ISO).

Who should own AI governance?

Executive leadership is accountable for AI risk decisions. Day to day, a small cross-functional group drawn from operations, security, legal and the business runs the review gates, and every AI system has one named owner.

Sources

Keep reading

Browse all insights