We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

What is AI governance, in plain words?

Give people a clear way to choose, use and check AI at work.

AI governance is how an organisation makes and oversees decisions about AI. It brings together rules, people and checks. For a business, start with who owns the decision and what the tool may do. Then ask what could go wrong and how the work will be reviewed.

Checked 7 October 2026

Contents
  1. In this series
  2. What does AI governance look like at work?
  3. Who is responsible for AI governance?
  4. Does it apply if you only buy AI tools?
  5. Is AI governance the same as a policy or an audit?
  6. What to do
  7. Common questions
  8. Sources

What does AI governance look like at work?

Start with an actual task, not a policy template. Ask what the AI is meant to do, who uses its output and what could happen if it goes wrong. Then decide who can approve the use and who will review it.

The ICO says roles, training and policies need to fit your approach to AI. The amount of oversight should match how you use it. Your organisation keeps responsibility for data protection when it controls the use of personal data.

A practical AI decision loop

  1. Name the use What task will AI help with?
  2. Assess the risk Who could be affected and how?
  3. Set the rules Who can use it, review it and approve changes?
  4. Keep checking What evidence shows that the controls still work?
Return to these questions as the use of AI changes. A signed policy is only part of the work.

Who is responsible for AI governance?

Give the work a named owner and make sure they can get the right help. The ICO expects senior management to have a team with enough skills and resources. It also expects roles and training to fit the organisation’s use of AI.

Use the questions below to turn that into a working plan. These are suggested responsibilities, not a legal requirement to create these job titles.

Questions to assign to named people
ResponsibilityQuestion to answer
Business ownerWhat should the AI do, and who is affected by the result?
Technical supportHow will the tool be set up, checked and maintained?
Risk and data protection reviewWhat could harm people, and what safeguards are needed?
People using the toolWhat must staff check, and when should they ask for help?
Senior oversightWho can approve a change or stop the use if needed?

Does it apply if you only buy AI tools?

Yes, there are still decisions to make about how the tool is used. The ICO’s risk guidance covers decisions to design or use AI. Buying a tool does not remove your organisation’s data protection responsibility as controller.

For a tool you buy, ask the supplier what evidence supports its intended use and limits. For a system you build, ask your own team for that evidence. AI assurance is the work of measuring, evaluating and explaining how trustworthy the system is.

Is AI governance the same as a policy or an audit?

A policy records rules. Governance also covers the people and decisions that put them into practice. Assurance supplies evidence about whether the system works as intended, its limits and how risks are managed.

Where AI uses personal data, assess whether a data protection impact assessment, or DPIA, is needed. This is a review of risks to people. The ICO says to assess the need case by case and record a decision that the use is not high risk too.

Keep meaningful human review where it forms part of the safeguards. The ICO says that this review should be able to overturn a decision.

What to do

  1. List the AI uses you want to review.
  2. Name who approves each use and who supports that decision.
  3. Record the risks to people and the steps chosen to address them.
  4. Check whether a DPIA is needed and record the decision.
  5. Keep reviewing the controls as part of ongoing data protection work.

Common questions

Is AI governance only about data protection?

No. AI governance includes rules and processes for AI decisions more widely. Where personal data is used, data protection responsibilities form part of that work.

Does every AI use need the same controls?

No. The ICO says governance and risk management should be proportionate to the use of AI. Assess the circumstances and the risks to people.

What does AI assurance mean?

It means measuring, evaluating and communicating how trustworthy an AI system is, including its capabilities, limits and risks.

Where next

Sources

  1. ICO, What are the accountability and governance implications of AI?, checked 7 October 2026
  2. GOV.UK, Introduction to AI assurance, checked 7 October 2026

This is an independent editorial guide, not legal advice.