A committee is not governance. Governance is the set of bodies, decision rights, controls, and gates that decide what ships and what gets stopped. This framework gives you the operating model and the policy template to run it.
The common pattern: a review board that meets monthly while product teams deploy without its sign-off, so the board is advisory and the governance is fictional.
The approach that works: decision rights written down and enforced, controls scaled to risk, and an approval gate wired into the deployment pipeline.
Someone has to hold the authority to approve or block a deployment, and that authority has to be written down and respected.
Tier each AI system by two things: the risk if it gets the answer wrong, and how much autonomy it has to act without a human.
A policy that lives in a document is a suggestion. Make the model approval gate a required step to deploy.
Four bodies carry the function: the AI oversight committee that sets policy and holds final decision rights.
Four tiers from minimal to autonomous, scored on stakes and autonomy.
The seven components every system answers to, scaled by tier.
A direct map from this model to the NIST AI RMF Govern, Map, Measure, and Manage functions.
Chief AI Officers and the AI governance function: the people responsible for deciding what an AI system is allowed to do, who signs off, and what stops it when something goes wrong. It also serves CISOs, CDOs, and legal and compliance leads who sit on the oversight bodies.
A committee meets and documents. Governance has three properties a committee usually lacks: decision rights that are written down and enforced, controls tied to risk and autonomy, and an approval gate that is a required step in the pipeline rather than a meeting teams route around.
Every AI system is scored at intake on two axes: the risk if it gets the answer wrong, and how much autonomy it has to act without a human. That score assigns one of four tiers, and the tier sets which body reviews the system, which controls apply, and how hard the approval gate is. If a system's use changes, the tier is reviewed.
Yes. The framework maps directly onto both. The oversight committee and accountability structure align to the NIST AI RMF Govern function and ISO/IEC 42001 leadership and roles clauses. Risk tiering maps to Map, evaluation gates to Measure, and monitoring and incident response to Manage. Build to this model and you build to both standards.
Both. The framework is a usable template, not a read. It gives you the bodies and roles for the operating model, the tiering model with controls per tier, the policy components written so you can adapt them, the standards mapping, and a readiness checklist. Use it to stand up governance, not to study it.
Drop your details and we'll send The AI Governance Policy Framework straight to your inbox - no spam, unsubscribe anytime.
Talk through how this applies to your roadmap with our engineering leads - a working session, not a sales pitch.
Download White Paper