Why AI Policy isn't Governance

Your AI Governance Starts Where Your Policy Stops

AI policies are appearing everywhere.

They set expectations for:

• How employees should use AI
• What information can be entered into AI tools
• Where approval might be required

That's a sensible place to start.

But there's a risk that publishing an AI policy creates a false sense that AI is now governed, when it isn't.

While a policy tells people how they should use AI, effective AI governance requires an organisation to understand how AI is actually being used in practice across daily operations.

Which systems and tools are in use? What decisions are they influencing? What data do they process? Who owns them? What risks have been identified? And who is responsible for reviewing those risks as the technology changes?

If you can't answer those questions, you don't have AI governance.

You have an AI policy.

The visibility gap comes first

Before an organisation can manage AI risk, it needs to know where that risk exists. And that's becoming increasingly difficult.

AI adoption isn't necessarily happening through one central transformation programme anymore. AI capabilities are being introduced into software businesses already use. Teams are experimenting with new tools. Suppliers are embedding AI into their products. Employees can adopt generative AI applications without waiting for an organisation-wide rollout.

That creates an AI visibility gap.

Leadership may have approved a handful of AI systems while the reality of AI usage across the organisation is considerably broader.

And you can't meaningfully assess, manage or demonstrate control over something you don't know exists.

That's why the first step towards mature AI governance isn't necessarily another policy - it's visibility.

An AI inventory is only the beginning

Knowing which AI systems are being used gives you a starting point, but a list of tools isn't an AI risk management programme either.

For each use case, organisations need enough context to understand the risk it introduces.

• What is the AI being used for?
• What data does it interact with?
• Does it influence decisions about customers or employees?
• Is there a human reviewing its outputs?
• Is the system internally developed or supplied by a third party?
• What would happen if it produced an inaccurate, biased or inappropriate result?

The answers won't be the same for every system, and that's precisely the point.

AI governance shouldn't treat every use of AI as equally risky. It should give organisations a structured way to identify where greater scrutiny, controls and oversight are required.

AI risk needs an owner

This is where AI governance starts to look less like a technology project and much more like an operational governance challenge.

IT might understand the technology.

Legal might interpret regulatory requirements.

Information Security might assess security and data risks.

HR might own AI use within recruitment or employee processes.

Procurement might be responsible for assessing an AI-enabled supplier.

Leadership ultimately needs confidence that appropriate governance exists across all of them.

Without clear ownership, it's very easy for AI risk to fall between teams.

Everyone is involved.

Nobody is accountable.

A mature AI compliance framework needs to establish who owns individual risks and systems, who is responsible for reviews and who has the authority to make decisions when something requires action.

Of course, technology can support that process. But, it shouldn't make those decisions for you.

Compliance can't move at the speed of regulation alone

There's another problem with treating AI governance as a regulatory exercise: AI is moving faster than the rules surrounding it.

The EU AI Act has created a significant regulatory framework for organisations operating in or serving the European market. ISO 42001 provides a structured management-system approach for governing AI responsibly.

Both are important.

But organisations shouldn't wait until a particular regulatory deadline applies before understanding how AI is being used across their business.

Customers are already asking questions about AI.

Boards want greater visibility of emerging risk.

Procurement teams are scrutinising suppliers.

Employees are already using the technology in their day-to-day.

The governance challenge exists regardless of where an organisation currently sits on its AI compliance journey.

The question isn't simply: "What do we need to do to comply with the EU AI Act?"

It's: "Can we demonstrate that we understand where AI is being used, the risks it introduces and how those risks are being managed?"

That's a much more durable starting point.

ISO 42001 can provide the structure

This is also where ISO 42001 becomes particularly relevant.

Much like ISO 27001 provides a management-system approach to information security, ISO 42001 provides a framework for establishing, implementing, maintaining and continually improving an AI management system.

The important words there are 'management system'.

It's not simply a collection of documents created to demonstrate compliance.

It introduces the governance structures required to manage AI over time: policies, responsibilities, risk assessments, objectives, controls, monitoring and continual improvement.

For organisations already operating an established ISMS or other ISO management systems, that approach should feel familiar.

And it reinforces an important principle - good AI governance isn't something you write. It's something you operate.

From policy to operational AI governance

An AI policy still matters.

It can establish acceptable use, set expectations and give employees important guardrails.

But it needs an operating model behind it.

That means knowing which AI systems and use cases exist across the business. Understanding and assessing their risks. Assigning ownership. Recording decisions. Implementing appropriate controls. Reviewing changes. Maintaining evidence. And giving leadership visibility of the organisation's overall AI risk posture.

As requirements evolve, organisations also need to understand how that work maps across standards and regulations such as ISO 42001 and the EU AI Act, rather than creating separate governance programmes for each.

That's where the conversation around AI governance software needs to go too.

The objective shouldn't be to automate AI governance or remove people from the decision-making process.

It should be to give those people the structure, information and visibility they need to make better decisions – while removing the administrative work surrounding them.

AI risk isn't static, so your governance can't be either.

A starting point, not the destination

There's a temptation with any emerging area of compliance to start by creating the documents.

They're tangible. They're relatively easy to demonstrate. And they show that the organisation has started thinking about the issue.

But a policy can only tell you what should happen.

Governance, on the other hand, tells you whether it is happening.

As AI becomes embedded across more systems, suppliers, teams and business processes, that distinction will become increasingly important.

The organisations best prepared for what comes next won't necessarily be those with the longest AI policies or the biggest collection of controls.

They'll be the ones that can answer some fairly simple questions:

• Where are we using AI?
• What risks does that create?
• Who owns them?
• Can we demonstrate that they're being managed?

Your AI policy is where your real AI governance begins.