AI governance is the set of policies, roles, controls and evidence an organisation uses to make sure its AI systems are approved, monitored, accountable and compliant. Done well, it is built into how AI is developed and run, not kept in a separate policy binder.
Also called: AI governance framework, AI risk management, responsible AI, AI oversight, AI compliance, AI agent governance
For every AI system, governance has to answer the same questions: who owns it, what it is for and how risky that use is, who approved it and which version is running, what data it uses, what it is allowed to do, who can intervene, how it was tested, how it is monitored, and whether what happened on a given day can be reconstructed. An AI inventory listing each system with those answers is the foundation; without it, governance cannot see what it governs.
Several frameworks give the work a structure. The NIST AI Risk Management Framework organises it into four functions — Govern, Map, Measure and Manage. ISO/IEC 42001, published in 2023, defines an AI management system that can be certified. The EU AI Act sets legal obligations by risk level; after the 2026 Digital Omnibus its high-risk obligations apply from 2 December 2027. In financial services, operational-resilience rules such as DORA and existing model-risk practices also apply to AI. The frameworks overlap heavily; most organisations pick one as the backbone and map the others to it.
AI agents raise the stakes because they act, not only answer. That turns governance questions into technical requirements: role-based access to agents, data and credentials; immutable versions with independent approval before production; guardrails on input and output; human-in-the-loop steps for consequential actions; test suites run before every release; budget limits; and complete trace logs of every run.
A worked example: a bank introduces an AI agent that pre-checks documents submitted for customer onboarding. The use is classified and recorded in the AI inventory with a business owner. The agent's instructions, knowledge base and guardrails are versioned; a second person from risk reviews the test results and approves promotion. The agent may flag and summarise, but an analyst approves every decision. Each run is logged with the documents read and the model calls made, and a change to the model or the instructions creates a new version that goes through approval again. When internal audit asks why a case was flagged, the trace answers in minutes.
Governance fails in familiar ways: it exists only as a policy no system enforces; the inventory misses tools teams adopted on their own; the model is approved but the prompts, data and tools around it are not; changes go live without re-approval; and evidence is assembled by hand when an auditor asks. The remedy is the same each time — controls that run as part of the platform, so evidence is a by-product of normal operation.
ATX Agent Hub implements those controls for AI agents: four-eyes promotion of immutable versions, role-based access control, AI Guardians, Fact Checking, Intent Check and Domain Constraint guardrails, human approval steps, an AES-256 encrypted credential vault, immutable audit logs and per-run traces.
Frequently asked questions
What is an AI governance framework?
A structured set of policies, roles, processes and controls for managing AI risk across the life of each AI system. Widely used references include the NIST AI Risk Management Framework, ISO/IEC 42001 and, in the EU, the AI Act.
Who is responsible for AI governance?
Accountability usually sits with senior management, with a named business owner for each AI system, risk and compliance functions setting and checking the controls, and technology teams implementing them.
How is AI governance different for AI agents?
Agents take actions, so governance must also control what they are allowed to do: tool and data permissions, human approval for consequential actions, independent release of each version and a trace of every step.
How do you start with AI governance?
Build the AI inventory first: list every AI system and tool in use, name an owner, classify the risk of each use and record which version is running. Then add independent approval before changes, controls on data and actions, and logging that produces evidence automatically. In the EU, map the inventory to the AI Act risk tiers.
What evidence does AI governance need?
An inventory of AI systems, risk assessments, approval records per version, test results, monitoring data, incident records and logs that show what each system did and who intervened.
This site needs JavaScript for the full experience. Every page above is reachable without it.