Artificial intelligence has become a common feature of the workplace. McKinsey found that 88% of organisations regularly used AI in at least one business function by the end of 2025. This was up from 78% a year previously.
However, only a third of companies have begun scaling AI across the entire business, despite 64% confirming that it has enabled innovation. One reason for this could be that the rise of AI has been rapid and, although it brings multiple benefits, there are also risks inherent with trusting large language models, machine learning and smart automation platforms with complex and impactful tasks.
With experts predicting that AI development will show exponential growth in the coming years, leading to complex quantum computing in the next couple of decades, companies cannot afford to lag behind. PwC’s Responsible AI survey found that 60% of current adopters say that it has improved ROI and efficiency, giving them a competitive advantage. But, for your company to truly take advantage and embrace the opportunities of AI systems in the future, you need an AI governance model in place to manage its implementation and use in a safe and effective manner.
This article explains what AI governance is, why it matters to boards of directors and how to make it work for your organisation as part of risk management.
Key takeaways
- AI governance matters because AI adoption is now widespread, with McKinsey reporting 88% of organisations using AI systems in at least one business function by late 2025, yet many still struggle to scale it safely.
- AI governance policies set clear rules, owners, approved tools and required testing for risk management so AI delivers value without drifting outside your risk appetite or values.
- From automation to machine learning to large language models, there are a large number of AI developments that companies can use to their advantage.
- Boards must oversee AI because it affects strategy, compliance, cyber and data risk, supplier dependence and major investment decisions. Stakeholders increasingly expect proof of control.
- The EU AI Act is one of the world’s first regulatory frameworks, anchoring governance with a risk-based framework, requiring a trustworthy AI inventory, stronger controls for high-risk use cases, transparency duties and oversight of general-purpose AI models.
- Shadow AI creates hidden exposure by bypassing approvals and logging, increasing the risk of data leakage, biased decisions and a lack of accountability for outcomes.
What is AI governance?
AI governance is the set of rules, roles and controls that makes sure your organisation uses AI safely and in line with its values. It takes into account compliance and ethical matters to keep you in line with your obligations whilst taking advantage of the benefits of artificial intelligence.
Your AI governance framework clarifies who can approve AI use cases within the business, what data and models your teams can use and what testing and human oversight you need to implement before anything goes live.
It also sets ongoing monitoring, incident response and reporting procedures in place so your leaders can be held accountable for their decisions. This means that you remain within your risk appetite and AI delivers real value for the business without causing harm internally or externally.
In this fast-paced world, you need a meeting management solution that is simple, efficient, and incredibly easy to use. With iBabs, you can manage the entire meeting process on a single platform.
Why AI governance is a board-level responsibility
It is essential that boards of directors take ownership of AI governance policies within their organisation. Here are some of the reasons why artificial intelligence should fall under the board’s remit:
- It can change the strategic direction of the organisation, as seen with businesses using AI systems to improve or replace human customer support. The board must set the risk appetite for these uses and decide what the AI can and cannot do. For example, you might restrict it from making final decisions on customer complaints to maintain a satisfactory risk level.
- AI creates exposure to legal and regulatory risk, which falls under the board’s scope of compliance and accountability. In a situation where AI is used to screen job applicants, the board may ask for a discrimination review to ensure it does not do so with bias that contravenes either your diversity policies or local inclusion guidelines.
- There is cyber and data risk when using AI tools. The board should ensure that there is a policy in place to prevent staff from uploading or copying sensitive business documents into AI tools, for example. In addition, if you use AI platforms that require employee or customer data, the board should oversee that it is implemented in accordance with the data handling and management requirements of GDPR.
- AI use depends on third parties, leading to supplier risk and, if you rely on a single tool for multiple business uses, concentration risk. The board of directors must oversee the process of properly auditing AI developers and their tools before rolling them out across the organisation.
- Your use of AI systems might require significant investment, which means that the board will have to scrutinise the value and ROI of using the suggested tools, just like they would do with any other decision on capital allocation.
- Using AI affects the culture of the organisation, with the possibility of a significant impact on your workforce. The board should request an impact report in cases where adopting a new tool will have a significant effect on your team members and the atmosphere of the workplace.
- Regulators and investors increasingly expect the board to oversee AI and its implementation in the business. This means directors need to be able to show evidence of their governance process and how they made relevant decisions. As a result, it is essential to include AI governance in the annual report.
The EU AI Act: Regulatory foundation for AI governance
The European Union has created the first legal framework to address the risks that AI poses and create a platform to support the development of trustworthy artificial intelligence within the union.
The EU AI Act was written into law in June 2024 and sets the baseline for how organisations govern AI, including using a risk-based approach. The AI regulation places responsibilities on leadership figures, requiring them to show that they understand where you use AI, to classify it correctly, approve safeguards and to be able to show evidence of their related decisions and the controls that are in place, if asked by regulators.
Obligations include:
- An AI inventory and classification. You must identify AI systems and decide if they fall into prohibited, high-risk, transparency or lower-risk categories.
- High-risk controls. There should be strong risk management, data quality, technical documentation, human oversight, logs, security and post-market monitoring in place for high-risk AI systems.
- Transparency duties. The company must tell users when they interact with certain AI systems and label some AI-generated content where required.
- General-purpose AI expectations. There are governance requirements that also extend to general-purpose AI models in addition to those built for a single task. This means “multi-use” AI models, like large language models (LLM), and requires the organisations that build or supply them to meet extra duties such as documentation, transparency and risk management. As the end user, the organisation should have measures in place to check suppliers are compliant.
The AI regulation act is phasing in over time, throughout 2027 and it is subject to adjustment over that time. Boards should keep abreast of the latest information on changes to the scope and timeline of implementation to ensure you meet your obligations at the correct time. It is also important to look out for other future regulatory frameworks that could appear to ensure there is trust in AI in the EU and beyond.
Here are the measures that your board will need to take as a result of the EU AI Act:
- Approve a responsible AI policy and risk appetite, including what you will and will not use AI for.
- Require a live register of AI use cases, owners, data sources and relevant third parties.
- Mandate checks and testing for high-risk use cases before deploying AI systems
- Set incident escalation and reporting processes, plus regular monitoring and mandatory re-testing after you make any changes
- Compile evidence that your team followed the correct procedure. Include the details of decisions, controls and the outcomes in your board packs and meeting minutes.
Shadow AI refers to the artificial intelligence tools people use on work devices or when connected to the company’s networks, but which have not been formally approved by the IT department. This means there is no oversight on the platforms and that can lead to negative outcomes for the company.
The user may simply want to make their workflow more efficient by using machine learning, an automation or analysis tool, but the organisation has no control over what data goes into the platform, what comes out and how it affects the operations of the business. If the tool has not been vetted by the company, it could pose a risk and contravene your obligations under the AI Act.
There are three main problems:
- Shadow AI use can leak sensitive information if your staff paste customer data, contracts, board papers or personal data into tools that store prompts or are used to train models.
- It can affect decisions if a manager uses a tool that has not been checked or calibrated for bias or accuracy. This can impact recruitment, pricing, complaint handling and a range of other functions.
- The company cannot prove accountability for controlling the outputs, as it cannot provide evidence of which tools were used, which data they used and what safeguards were in place to make it a compliant process.
| Example In April 2026, hackers gained access to cloud application company Vercel’s network through an employee’s use of a third-party AI tool. The attacker took over the employee’s company Google Workspace, which gave them the opportunity to breach some other internal systems. |
Boards need to lead the way in preventing the use of shadow AI as part of a wider responsible AI governance and risk management approach. This includes setting clear rules on which AI tools are permitted for use, having been reviewed by IT. You should also ban the uploading of confidential data to public AI systems. Keep a register of acceptable AI use cases, along with the solutions to action them.
How to implement AI governance policies
Decision-making
The board needs to treat AI models like any other area of high-risk and high-impact governance. It is not an addition or extension to the business; it is a key source of benefit and challenge. This means that your directors need to route it through your existing decision-making workflow.
Map where AI influences or might influence your outcomes. You could use it for hiring, fraud prevention, safety processes or any other aspect, for example. Have a clear owner who can approve these uses and document the checks that need to take place and the route through which stakeholders escalate issues to the board or a specific AI committee.
| Action item Create a risk management-based threshold for information that you require for each decision: Purpose of the AI systemsWho owns the process?Which data sources does it access?What were the testing results?How was it adapted based on those results? Where does human oversight kick in? |
Only if there are answers to these questions should you put it before the board. Directors can then make a decision, with the discussion, outcome and follow-up actions documented in your meeting minutes.
Documentation and audit trails
Proof is at the heart of good responsible AI governance, which is why documentation and audit trails are the key to managing artificial intelligence effectively. An AI evidence pack is a way of showing how you maintained and controlled the artificial intelligence in each use case in your organisation. A pack for each of your AI models use should include the following.
| What to capture | What that includes | Why it matters |
| AI use case register entry | Owner, purpose, users, systems | Prevents “shadow AI” and helps you manage scope |
| Data and model summary | Inputs, outputs, key limits | Shows what the AI systems can and cannot do |
| Approval record | Who approved it, when and with what conditions | Proves it was used in accordance with the organisation’s governance standards and not adopted informally |
| Testing | Results from analysis of accuracy, bias, security and other key matters | Reduces risk and provides evidence it meets your standards for safety and effectiveness |
| Change log | Updates to AI models, prompt changes, data changes | Ensures that your guardrails are in place for the current version of the tool, reflecting actual risk |
| Incident and override log | Details of issues and when a human had to intervene | Acts as a log of adjustments and proof that you are monitoring effectively |
| Monitoring reports | Ongoing assessment of the tool and its impact | Demonstrates ongoing oversight and a commitment to improvement |
Accountability
It is important to have someone to own the outcomes of your business AI use. There should be a point of contact to ensure sufficient risk management and to correct any errors in a timely manner. They must be able to defend the decisions the board took and provide clarity over when it is acceptable to use AI, when humans should step in and how they should document their AI processes.
As part of your accountability efforts:
- Assign one executive owner for the AI governance programme
- Assign a named business owner for each AI use case
- Define which committee oversees high-impact and high-risk AI systems
- Set escalation routes for incidents, changes and high-risk proposals.
Consider who will be responsible for which aspects of AI governance. This might include:
| Role | Accountability |
| Board | Sets AI risk appetite, demands evidence, challenges high-impact uses, oversees major incidents |
| CEO | Owns the governance programme, ensures resources for it, oversees adoption and reporting |
| Manager (per use case) | Owns outcomes, controls, monitoring and user behaviour in their area |
| Risk / Compliance / Legal functions | Set minimum standards for AI models, review high-risk cases, ensure lawful and fair use |
| IT | Secures systems, manages access, monitors threats and supports incident response to ensure you use only trustworthy AI |
| Chief Information Officer (CIO) / Data lead | Data quality, retention, management, privacy controls and data access protocols. |
How AI governance works in practice
Starting small is the key to success with implementing an AI governance framework. Pick out some regular AI use cases and build a workflow to ensure you meet your obligations and cover all the areas of risk management. Once you have a system in place, this can be the standard by which you run all your AI use cases.
It might look something like this:
- Set out the business use case for using AI models.
- Identify the prospective tool.
- Highlight the risk level and what issue might arise.
- Test the tool and review the findings and understand whether it meets the need.
- Make adjustments if necessary.
- Create a simple approval path, whether that should go to the board or if a committee can make the decision.
- Define your minimum controls for safe use.
- Train teams on use and publish the dos and don’ts in your shared workspace.
- Continually monitor for updates and changes, reacting to maintain safe use.
- Review on a quarterly basis for performance and security.
- Create and track actions to closure to ensure any issues are rectified.
Having a standard workflow that works for the exact requirements of your business means that all AI models you implement go through the necessary stages to ensure you can use them safely, allowing them to deliver the benefits you require without exposing the organisation to unnecessary risk.
FAQ
What is the difference between AI governance and AI ethics?
An AI governance framework focuses on the structures, processes and controls that ensure AI systems are used responsibly, lawfully and in line with organisational objectives. AI ethics informs governance decisions but does not replace the need for formal oversight, accountability and documentation.
Why must boards be involved in AI governance?
AI systems increasingly influence strategic decisions, risk exposure and regulatory compliance. Boards are responsible for overseeing these risks, setting guardrails for acceptable AI use and ensuring accountability for the decisions made with or by AI systems.
How can boards gain visibility into AI use across the organisation?
Boards need structured reporting on AI use, including risk exposure and compliance status. Centralised governance frameworks and tools help highlight where you use AI, who owns it and how you control decisions.
Conclusion
Artificial intelligence is already starting to shape decisions across finance, recruitment, customer service, risk, compliance and beyond. This means that governance has to develop to meet the challenges that AI will bring, as well as to embrace the opportunities that it offers.
Boards must govern how AI influences the outcomes of tasks within the business to ensure you still make decisions based on the best possible information and in the best interests of the organisation. Without the required check and balances, AI can lead to regulatory issues and damage reputation.
When you embed an AI governance framework into your normal oversight, you display accountability, strengthen the quality of your decisions and stay ahead of fast-moving regulation and stakeholder expectations.
How iBabs helps
You can harness the power of AI to make better decisions for your organisation with iBabs’ governance platform. Upload or record your meeting and the built-in, secure AI will help with transcribing the discussion, generating summaries and creating action-ready minutes. iBabs helps you cut hours of manual work, simplify decision-making and provide stakeholders with a single source of truth. Learn more
