AI governance: principles, roles and frameworks

By the end of its first year, Larchmont had nine AI systems in use or in pilots: the ticket classifier, suggested replies, the tracking virtual agent, event correlation, a demand forecasting model in transport planning, a fraud score from its payments provider, AI features in its collaboration suite, a résumé screening feature that HR had switched on in a recruiting tool, and an approved staff assistant. Nobody had a complete list until the internal auditor asked for one. That moment, common in many organizations, is where AI governance begins.

AI governance is the system of direction, oversight and accountability that ensures an organization's use of AI is aligned with its objectives and values, complies with law and manages risk. It builds on the governance ideas from ITIL-120 (evaluate, direct and monitor; ISO/IEC 38500) rather than replacing them. This lesson covers principles, structures and roles, the main frameworks and standards, and the legal landscape in Canada, the United States and the European Union. Lesson 9 turns these into risk management and controls.

Why AI needs specific governance

Existing IT governance covers much of what AI needs: strategy, investment, risk, security, suppliers and change. But AI raises some issues that ordinary systems do not, or raises them more sharply. Its behavior is learned from data rather than written in rules, so it can be hard to explain and can change as data changes. It can produce unfair outcomes for groups of people even when nobody intended it. Generative AI can produce false or harmful content. AI can be embedded in products without the buyer realizing. And accountability can blur when decisions are shared between people and machines.

Governance responds by making sure that someone is accountable for each AI system, that uses are deliberate and approved, that risks are assessed before and during use, that people affected are treated fairly and informed where appropriate, and that the board can see what AI the organization uses and how well it is controlled.

Principles

Most AI governance starts from a set of principles. The OECD AI Principles, adopted in 2019 and updated in 2024, have been endorsed by dozens of countries, including Canada and the United States. They call for AI that supports inclusive growth and well-being; respects human rights, democratic values, fairness and privacy; is transparent and explainable; is robust, secure and safe; and is accountable. Many organizations adapt similar principles into their own statement.

Principles alone change little. A widely observed problem in the late 2010s was 'ethics washing': organizations published attractive principles but had no processes to apply them. Principles need to be turned into policies, roles, required steps and evidence, which is what the frameworks below help with.

Structures and roles

AI governance should fit into existing governance rather than float beside it. The board or its risk committee sets risk appetite for AI and receives regular reporting. An executive is accountable for AI governance overall, often the chief information, data, risk or technology officer. Many organizations create a cross-functional AI governance committee or council with technology, data, legal, privacy, security, risk, human resources and business representatives to approve high-risk uses and resolve questions.

At Larchmont, the CIO, Ruth Akinyemi, became the accountable executive, and an AI governance group meeting monthly was set up with the head of digital products, the chief privacy officer, the security lead, HR, legal, internal audit as an observer, and Helen Brandt, the head of risk and compliance, as chair. Its first act was to require every AI system to be registered with a named owner.

The AI inventory

An AI inventory (or register) lists every AI system the organization builds, buys or uses, including AI features embedded in purchased products. For each it records the purpose, owner, supplier, data used, people affected, level of autonomy, risk tier, assessments completed, controls and monitoring, and review date. Without an inventory, governance cannot see what it is governing. Finding embedded AI usually requires asking suppliers directly and reviewing product release notes, because AI features often arrive in routine updates.

# Assign risk tiers to Larchmont's AI inventory with simple rules (illustrative)
systems = [
    # name, affects people's rights/opportunities, customer-facing, autonomy (1-5), personal data
    ("ticket classifier",            False, False, 3, True),
    ("suggested replies",            False, False, 2, True),
    ("tracking virtual agent",       False, True,  4, True),
    ("event correlation",            False, False, 3, False),
    ("transport demand forecast",    False, False, 1, False),
    ("payments fraud score",         True,  True,  4, True),
    ("collaboration suite AI",       False, False, 2, True),
    ("resume screening (HR tool)",   True,  False, 3, True),
    ("staff assistant",              False, False, 2, True),
]
def tier(rights, customer, autonomy, personal):
    if rights:
        return "HIGH"
    if customer and autonomy >= 4:
        return "MEDIUM-HIGH"
    if personal or autonomy >= 3:
        return "MEDIUM"
    return "LOW"
for name, *attrs in systems:
    print(f"{name:<30} {tier(*attrs)}")

ticket classifier              MEDIUM
suggested replies              MEDIUM
tracking virtual agent         MEDIUM-HIGH
event correlation              MEDIUM
transport demand forecast      LOW
payments fraud score           HIGH
collaboration suite AI         MEDIUM
resume screening (HR tool)     HIGH
staff assistant                MEDIUM

The rules are deliberately simple and invented; real tiering schemes use more factors and judgment. Even so, the exercise surfaced a surprise: the résumé screening feature that HR had switched on in its recruiting tool was in the highest tier, because it influences people's job opportunities. Nobody in LTS had known it existed. The AI governance group paused it until an impact assessment and bias testing were done.

Frameworks and standards

Several frameworks and standards help organizations put AI governance into practice. They overlap, and organizations often combine them.

The NIST AI RMF is especially practical. Its govern function covers culture, policies, roles and accountability across the lifecycle; map establishes the context and identifies risks for a specific system; measure analyzes and tracks those risks with appropriate methods; and manage prioritizes and acts on them, including responding to incidents. ISO/IEC 42001 suits organizations that already run ISO management systems, such as ISO/IEC 27001 for information security or ISO/IEC 20000-1 for service management, because it follows the same structure and can be certified by an accredited body.

The legal landscape

AI law is changing quickly and differs by jurisdiction. The European Union's AI Act, which entered into force in August 2024, takes a risk-based approach: a short list of prohibited practices, strict requirements for high-risk systems (such as those used in employment, credit, essential services and critical infrastructure), transparency duties for systems such as chatbots and deepfakes, and obligations for general-purpose AI models. Prohibitions applied from February 2025 and general-purpose AI obligations from August 2025. In 2026 EU lawmakers agreed to delay most high-risk obligations, to December 2027 for standalone high-risk systems and August 2028 for AI built into regulated products. The Act matters to Canadian and US companies that place AI systems on the EU market or whose AI outputs are used in the EU.

The United States had no general federal AI statute as of late 2026. Federal policy shifted with administrations: the 2023 executive order on AI was revoked in January 2025, a 2025 AI action plan emphasized innovation, OMB guidance governs federal agencies' AI use, and a December 2025 executive order sought to challenge state AI laws seen as burdensome. States have been active: Colorado's 2024 AI Act on high-risk systems faced delay, litigation and rewriting; Texas passed a narrower AI law in 2025; California regulators adopted rules on automated decision-making technology; and New York City requires bias audits for automated employment decision tools. Existing laws on consumer protection, civil rights, employment and privacy apply to AI regardless. Larchmont should track the states where it operates and hires.

For a company like Larchmont, the practical lesson is to build governance on stable foundations (principles, inventory, risk assessment, controls and monitoring) that can absorb new legal requirements as they arrive, rather than chasing each law separately. Frameworks such as the NIST AI RMF and ISO/IEC 42001 are designed to be law-neutral for exactly this reason.

Policy

An AI policy sets the organization's rules. A typical policy covers scope and definitions, principles, roles and accountability, the requirement to register AI systems, risk tiering and the assessments each tier needs, prohibited and restricted uses, data and privacy requirements, transparency to people affected, human oversight, testing and monitoring, supplier requirements, incident reporting and training. It is supported by more detailed standards, such as the acceptable use standard for staff described in lesson 7.

Larchmont's policy prohibits a short list of uses outright, including emotion recognition of employees, fully automated decisions to dismiss staff or end customer contracts, and AI-generated content presented to customers as written by a named person. High-risk uses need committee approval, an impact assessment and bias testing before deployment. Medium-risk uses need owner approval and a lighter assessment. Low-risk uses need registration only.

AI governance and the service value system

AI governance works best when it is built into the ITIL value system rather than bolted on. Demand for AI enters through the same channels as other demand and is prioritized in the portfolio. Opportunities are assessed against the AI policy during planning. The product and service lifecycle carries governance steps: discovery includes the impact assessment, acquisition includes AI supplier due diligence, transition includes validation and notices, and operation includes monitoring and periodic review. Continual improvement uses incidents, complaints and monitoring results to improve both AI systems and the governance framework itself.

The service catalog is a useful place to make AI visible. Larchmont added a field to each catalog entry showing whether the service uses AI, at what level of autonomy and with which owner, so that customers, staff and auditors can see where AI is involved. This simple step also helped keep the AI inventory current, because new catalog entries prompted registration.