AI governance that actually works
Nov 26th, 2025 by Jesper Kråkhede
We are approaching the end of the year, and many organisations have spent it writing AI policies and setting up committees. Here is what I think separates AI governance that works from AI governance that only looks good.
It starts with an inventory. You need to know where AI is used: tools, features in products you already have, agents built by the business, models in your own development. Without the inventory, everything else is guesswork.
It has clear ownership. Not a committee that meets four times a year, but named owners for each AI use, with responsibility for its risk and its outcome, and a central function that sets the rules and follows up.
It is risk based. Not every chatbot needs a full assessment. A tool that writes drafts of internal mails isn´t the same as an agent that makes decisions about customers. Spend the effort where the risk is.
It is integrated. AI governance should use the same processes as the rest of the organisation: risk management, procurement, information security, data protection. A separate AI process that nobody connects to will be bypassed.
It is measured. How many AI systems do we have? How many have been assessed? How many incidents? How many people have been trained?
Standards like ISO 42001 can give you the structure. But the standard won´t do the work.
Good AI governance isn´t a brake. It is what lets you go faster without crashing.