CyberFreezeDevAI use register
A list of every AI tool in use, with purpose, owner, vendor, data and risk.
Read more about AI use register
Every AI tool or system in use: purpose, owner, vendor, data it touches, risk level.
- Home
- AI glossary
- AI governance
What is AI governance?
Written rules on which AI tools are allowed, what data goes in and who checks.
Definition
Policy, owners, an approval process and records for every AI use. For a small business, that can be two pages and a spreadsheet.
Read more about Definition
AI governance is how an organisation manages the risks and responsibilities of using AI. It covers policy (what is allowed), people (who owns each system and who reviews outputs), process (how a new AI use is approved, tested and monitored) and records (logs and documentation that show what happened).
It is not a separate bureaucracy. For a small business it can be a two-page policy, a spreadsheet register of AI uses and a named owner for each one.
The building blocks
Data rules
Which kinds of data may go to which tools, and what stays on private servers.
Read more about Data rules
Which data classes (client financials, health records, personal data) may go to which tools, and which must stay on private infrastructure.
Oversight
Where a person must review output, and which automatic guardrails run.
Read more about Oversight
Where a human in the loop is mandatory, and what guardrails run automatically.
Testing and monitoring
Evaluate before launch and check again later, especially when a vendor changes its model.
Read more about Testing and monitoring
Model evaluation before launch and periodic checks after, including when a vendor changes its model.
Incidents
How staff report a bad output or data leak, and who responds.
Read more about Incidents
How staff report a bad output or data leak, and who responds.
Rules and standards to know
EU AI Act
Sorts AI uses by risk and sets duties for high-risk systems serving the EU.
Read more about EU AI Act
Regulation (EU) 2024/1689 classifies AI uses by risk and sets duties for high-risk systems. It applies to providers and deployers serving the EU, including from outside it.
India DPDP Act 2023
Covers personal data passing through AI: consent, purpose limits and security safeguards.
Read more about India DPDP Act 2023
Governs personal data processing, including when it passes through AI systems: consent, purpose limitation and security safeguards.
UK GDPR
Data protection duties, including rules on solely automated decisions with significant effects.
Read more about UK GDPR
Data protection duties, including rules on solely automated decisions with significant effects.
Frameworks
NIST's AI Risk Management Framework and ISO/IEC 42001 give larger organisations a structure.
Read more about Frameworks
The NIST AI Risk Management Framework and ISO/IEC 42001 (AI management systems) give structure for larger organisations.
A practical example
An accounting firm stops staff pasting ledgers into free chatbots with a one-page policy, two approved tools, partner review and quarterly re-tests.
Read more about A practical example
A small accounting firm finds staff pasting client ledgers into free chatbots. It writes a one-page policy: client data only goes into approved tools, the approved list has two entries, and every AI-drafted client letter is reviewed by a partner. It keeps a register of the two tools, their data settings and owners, and adds a quarterly check where the owner re-tests each tool on ten known cases.
Common mistakes
Banning AI outright
Staff then use personal accounts anyway, which is worse. Approve safe options instead.
Read more about Banning AI outright
Staff use it anyway on personal accounts, which is worse. Approve safe options instead.
Policy without logs
Without a record of who used what on which data, nobody can check the policy.
Read more about Policy without logs
If you cannot show who used what on which data, the policy cannot be checked.
Treating it as a one-time project
Vendors change models and terms, so review the register on a schedule.
Read more about Treating it as a one-time project
Vendors change models and terms. Review the register on a schedule.
Related terms and pages
Questions
Does a small business need AI governance?
Yes, in proportion. A short policy, a list of approved tools, clear data rules and a named owner cover most of the risk for a small team.
Does the EU AI Act apply to an Indian company?
It can. It applies to providers placing AI systems on the EU market and to cases where an AI system's output is used in the EU, wherever the company is based. Check with a lawyer for your specific case.
What is ISO/IEC 42001?
An international standard, published in 2023, for setting up an AI management system: policies, risk assessment, controls and continual improvement, similar in spirit to ISO 27001 for information security.
Last updated