AI governance
AI governance is the set of rules, roles and controls by which an organization decides how artificial intelligence is built, bought and used, which risks it accepts, and who answers for the results.
What AI governance covers
In practice the term gathers several jobs that used to sit in different departments: knowing which systems exist, assessing their risks, setting usage rules, checking data quality, and keeping the documents an auditor or a regulator will ask for. A governance program is judged by whether those jobs are assigned to named people and actually carried out, far more than by the quality of its policy document.
Three reference texts shape most programs today. The EU AI Act is binding law, built around risk levels. ISO/IEC 42001 is a certifiable management system standard published in 2023. The NIST AI Risk Management Framework, released in January 2023, is a voluntary American framework organized around four functions: govern, map, measure and manage.
Why classic AI governance is not enough for agents
These texts were mostly conceived for systems that produce an output a person then reads and acts on. They look at the system: how it was trained, how it is documented, what risk class it falls into. That lens remains necessary, but it leaves a gap as soon as software starts acting by itself, because the question moves from "is this system well managed?" to "who allowed this action, within which limits, and can we show it?"
That gap is what AI agent governance addresses. ACF takes its place between the two: it does not compete with the AI Act, ISO/IEC 42001 or NIST, and it does not replace them. It adds an operational layer that carries some of their requirements down to the individual decision an agent takes on behalf of the organization.
Where to start
A program that begins with a charter tends to stay a charter. Three moves give it something to hold on to:
- Draw up an AI inventory, including the tools adopted without approval, known as shadow AI.
- Give each system a named owner who can be asked questions and who can say no.
- Keep evidence as you go, because a policy shows what was intended and only a record of decisions shows what happened.
Frequently asked questions
What is the difference between AI governance and AI compliance?
Compliance checks that a legal or contractual requirement is met at a given moment. Governance is the wider organization that decides, assigns and keeps checking over time, including on subjects no law addresses yet. A company can pass a compliance review and still have nobody able to say what its agents did last night.
Which AI governance framework should a company choose?
They answer different needs and combine well. The AI Act is an obligation if you operate in the EU, ISO/IEC 42001 suits organizations that want a certifiable management system, and NIST AI RMF offers a voluntary risk approach. If agents take decisions on your behalf, add a decision-level method such as ACF.
Who should own AI governance in a company?
Executive sponsorship matters more than the job title, and leaving the subject to the technical department alone is a common way to see it stall. Delegated decisions need one more function, carried in ACF by the DDAO, who answers for what agents are allowed to decide.
Where does your organization stand?
ACF Score measures your agentic governance in about 10 minutes, the AI Act checker tells you which obligations apply, and ACF Control applies your rules before an agent acts.
Related terms
Primary sources
Written by Vincent Dorange, creator of the Agentic Commerce Framework®. Last updated .