A framework is what closes both gaps. It assigns decision rights before the rules are written, and it defines what record each decision leaves behind. That is unglamorous work — it looks like a table of owners rather than a strategy — but it is the difference between governance that survives an audit and governance that survives only until someone tests it.
GUIDE · GOVERNANCE
AI Governance Framework
What a working framework actually contains, how the public standards fit, and how to get a defensible first version in place in weeks rather than quarters.
The short answer
An AI governance framework is the structure of decisions, owners, rules and records through which an organization controls its use of artificial intelligence. If you cannot say who authorized a given use, who reviews its output and where that is written down, you do not yet have a framework — you have a document.
Why most frameworks fail
The document is the easy part.
Organizations rarely fail at writing an AI policy. They fail at the step before it: deciding who holds the authority to say yes and no, and the step after it: producing evidence that the rule was followed. A policy suspended between those two gaps changes nothing, and in a review it reads worse than silence, because it documents a standard the organization did not meet.
The structure
Seven components of a working framework.
Each one needs a named owner. A component without an owner is an aspiration.
01
Scope
Which systems, functions and data the framework covers, and what it deliberately excludes. Vague scope is the most common reason a framework cannot be enforced.
Evidence it produces
A written scope statement, reviewed when new tools arrive.
02
Decision rights
Who approves a new tool, who authorizes a new use, who grants exceptions, who accepts residual risk. In most organizations this map does not exist, which is why approvals happen by default.
Evidence it produces
A decision owner matrix, accepted by the named owners.
03
Authorized and prohibited uses
Specific, current and written in the language of the work: which tasks may use AI, which may not, and which require approval first. Lists of principles do not survive contact with a deadline.
Evidence it produces
A use schedule staff can read in two minutes.
04
Data handling
What information may be entered into which class of tool, where retention and training settings must be configured, and how confidential, personal and privileged material is treated.
Evidence it produces
Data rules plus the configuration record for each approved tool.
05
Human review and accountability
Where a human must review before output leaves the organization, what that review consists of, and who remains accountable for the result. Accountability does not transfer to a model.
Evidence it produces
Review requirements by output type, with sign-off.
06
Disclosure
What clients, staff, funders, regulators and counterparties are told about AI involvement, and when. Increasingly this is contractual rather than optional.
Evidence it produces
Disclosure language, and where it appears.
07
Records and review
What is logged, for how long, and on what cycle the framework itself is reviewed. A framework reviewed annually in a field that moves quarterly is already out of date.
Evidence it produces
A records schedule and a dated review cycle.
The public standards
NIST, ISO 42001 and the EU AI Act, in proportion.
These are references, not operating models. Adopting one wholesale is how a twenty-person organization ends up with a hundred-page management system nobody follows.
The NIST AI Risk Management Framework gives a shared vocabulary — govern, map, measure, manage — and is useful when a board wants its risk language to match something external. ISO/IEC 42001 is a certifiable management system, and the right choice when a client, funder or insurer asks for certification; it brings audit overhead that only pays for itself when someone is requiring it. The EU AI Act is binding law where it applies, and matters for organizations with European users or customers regardless of where they are based. Sector rules — health privacy, financial supervision, professional conduct, accreditation standards — usually bite before any of the three.
The practical sequence is the reverse of how it is usually attempted: write the seven components for your own operation first, then map them to whichever external framework you are required to satisfy. The mapping takes a day when the components exist, and is impossible when they do not.
Start here
A template that forces the decisions.
The SAGAZ AI governance policy template covers fourteen sections and includes the decision owner matrix most templates omit. Every bracketed field is a decision your organization has to make — which is the point.
Download the free policy template
If those decisions keep getting deferred, the $1,500 Executive AI Governance Session makes them in 90 minutes and puts them in writing. Where the organization needs an evidence base first, the AI governance assessment establishes what is actually in use before any framework is adopted.
Questions leaders ask
What is an AI governance framework?
The set of decisions, owners, rules and records through which an organization controls how artificial intelligence is used. A framework is not a document; it is the structure that makes the document true — who decides, who reviews, what is disclosed and what evidence is kept.
What should an AI governance framework include?
Seven components: a scope statement, a decision rights map, authorized and prohibited uses, data handling rules, human review and accountability, disclosure duties, and a records and review cycle. Each component should name an owner; a component without an owner is an aspiration.
Which AI governance framework should we adopt — NIST, ISO 42001 or the EU AI Act?
Use them as references, not as an operating model. The NIST AI Risk Management Framework is a useful vocabulary for risk, ISO/IEC 42001 is a certifiable management system for organizations that need the certificate, and the EU AI Act is law where it applies. Most mid-sized organizations need the seven components above written for their own operation, mapped to whichever of those frameworks their sector, funders or clients require.
How long does it take to put a framework in place?
The first defensible version takes weeks, not quarters: a session to take the core decisions, a policy that reflects them, and a review cycle. What takes longer is making it true — training, tool approval and the evidence trail.
Do small organizations need a framework?
A proportionate one, yes. For a twenty-person organization it can be three pages: what is allowed, what is forbidden, who approves exceptions and what gets recorded. The free template on this page is written to be cut down rather than filled in.
Put a defensible framework in place.
Independent guidance from an attorney and executive advisor who sells no software.
Ask about governanceEmail about frameworks