What counts as AI governance?

Governance Notes
Written by REITA WILLIAMS

There is no single universally agreed definition of AI governance. There is, however, a usable working one that organisations and institutions can actually apply.

The most practical version currently in circulation is this:

AI governance is the system of policies, processes, roles, decision rights, and controls used to direct and oversee the development, deployment, and use of AI systems so that they align with organisational strategy, legal requirements, ethical principles, and acceptable levels of risk — while ensuring clear accountability for outcomes.

This statement serves as an operating requirement that specifies who may approve a use case, what evidence is needed, what must be monitored, and who responds when the system affects people who did not choose it.

Widely cited definitions

These formulations are not identical. They converge on the same operational idea: governance is the machinery that turns principles and rules into consistent, checkable practice.

What it is not

  • AI ethics states what ought to be done (the normative principles).

  • AI safety is the technical work of preventing unintended harm.

  • AI compliance is the narrower task of meeting specific legal or regulatory duties.

  • AI governance is the set of structures that operationalise all three and assign decision rights and accountability.

If ethics is the theory and compliance is the checklist, governance is the operating system.

The UK approach

The UK has deliberately avoided a single statutory definition of AI or of AI governance. Its framework remains principles-based and largely non-statutory. Existing regulators are expected to interpret and apply five cross-sector principles within their existing remits:

  • Safety, security and robustness

  • Appropriate transparency and explainability

  • Fairness

  • Accountability and governance

  • Contestability and redress

These principles, first set out in the 2023 White Paper and carried forward in subsequent guidance, function as the de facto working framework. They do not prescribe detailed technical controls. They require organisations to decide, in their own context, what the principles mean for the systems they use and who is responsible for applying them.

This approach places a greater burden on institutional governance. Without clear internal decision rights, documented risk processes and mechanisms for contestability, the principles remain statements rather than practice. The UK’s emphasis on adaptivity and autonomy as defining characteristics of AI further reinforces the need for ongoing oversight rather than one-off approval.

What a working definition requires in practice

A usable definition of AI governance does not need additional abstract principles. It needs answers to a small set of questions for every system that influences a decision or generates content:

  • What does this system do, and who is affected?

  • Who has the authority to approve its use?

  • What risks have been identified, and what evidence supports the assessment?

  • What controls are in place, and who monitors them?

  • How can an affected person contest an outcome?

  • What happens when the system is retired or changes?

Those questions are governance. The documents (policies, risk registers, model inventories, human-oversight rules, incident procedures) are the evidence that the questions have been answered.

The field continues to evolve, particularly with agentic systems that act across multiple steps with limited real-time human approval. Governance in that context must address authority, bounds, monitoring and named accountability more explicitly than earlier model-centric approaches. The core requirement remains the same: someone must be accountable, and the accountability must be demonstrable

Reference list

REITA WILLIAMS
Next

When does AI quality assurance become surveillance?