Chapter 11. AI Governance, Regulation, and Risk Management
11.1 Why governance is necessary
AI governance defines who may use AI, for what purposes, with which data, under what controls, and with what accountability. It should cover experimentation, procurement, development, deployment, monitoring, incident handling, and retirement. Good governance enables useful innovation by clarifying acceptable boundaries.
NIST's AI Risk Management Framework organises risk work through four functions: Govern, Map, Measure, and Manage. Its generative AI profile expands attention to risks associated with generative systems and proposes actions across the lifecycle (NIST, 2023, 2024). These resources are voluntary frameworks, not substitutes for applicable law.
11.2 Governance in practice
Governance should be proportionate to risk. A tool used to brainstorm public campaign ideas has a different risk profile from a system that ranks job applicants or determines access to essential services. The organisation should classify use cases, set minimum requirements, and require stronger assessment where potential harms are greater.
An AI register can record system name, provider, purpose, owner, affected groups, data types, risk tier, approvals, model/version, controls, review date, and incident history. A register helps leaders understand the AI estate and avoid hidden or duplicate deployments.
11.3 Regulation and jurisdiction
AI law is developing and differs by jurisdiction and sector. Depending on where an organisation operates, relevant requirements may include privacy and data protection, consumer protection, discrimination, employment, safety, intellectual property, cybersecurity, financial services, education, health, and sector-specific AI rules.
The European Union's AI Act is a significant risk-based legal framework, but its requirements and implementation timelines must be checked against current official EU guidance. Organisations operating across borders should not assume that a single policy satisfies every legal obligation. Seek qualified legal advice for consequential deployments.
11.4 Standards and guidance
International and national resources can support governance. The OECD AI Principles provide high-level values and policy guidance. NIST's AI RMF provides a practical risk-management structure. ISO/IEC 42001 specifies requirements for an AI management system, while ISO/IEC 23894 provides AI risk-management guidance. The applicability and current editions should be verified through the official standards bodies.
Frameworks are most useful when translated into operational controls, owners, evidence, review dates, and escalation. A checklist alone does not prove that a system is safe or fair.
11.5 Documentation and auditability
Keep records proportionate to the system's risk and purpose. Useful records include the business case, data sources, impact assessment, procurement review, evaluation results, human oversight plan, approval, user instructions, known limitations, monitoring results, changes, and incidents.
Auditability helps an organisation explain what it deployed, why it deployed it, how it tested it, what evidence supported the decision, and how it responded when circumstances changed. It also supports learning across projects.
11.6 Current developments and caution
By October 2026, governance discussions increasingly include AI agents, cybersecurity, human oversight, and the possible systemic consequences of rapid deployment. Recent reporting has described calls for stronger oversight of agentic AI in financial services and debate about international oversight of advanced systems (Reuters, 2026a, 2026b). These reports illustrate active policy discussion; they should not be read as proof that every proposed measure has become binding law.
Because this field changes quickly, readers should distinguish enacted requirements from consultation papers, voluntary commitments, proposals, news reporting, and expert opinion. Confirm legal status through official primary sources before making compliance decisions.