Setting up AI governance for ISO 42001

AI governance is the structure within which your organisation makes decisions about AI. Who may deploy which AI systems? Who is responsible when things go wrong? How do you assess new AI applications before they go live? ISO 42001 requires you to answer these questions and record the answers. The EU AI Act makes governance even more urgent, because board members can be held personally liable for AI failures.

On the page AI management system we explain what an AIMS is. On this page we go deeper into the governance part: the people, the roles, the structures and the decision-making. On the page AI ethics principles you can read about the principles that underpin responsible AI governance.

Why AI governance is more than an org chart

For information security, you know the CISO. For privacy, you know the Data Protection Officer (DPO, Functionaris Gegevensbescherming). With AI there is no legally required role, but in practice organisations that take AI governance seriously need a comparable function.

Without an explicit governance structure, problems arise that will cost you later:

Nobody knows which AI systems exist (shadow AI)
Each team makes its own decisions about using AI without any review
There is no escalation path when an AI system goes wrong
Auditors cannot establish who is responsible for what
The board is liable but has no visibility of AI risks

ISO 42001 asks for documented roles and responsibilities. That is more than filling in names on an org chart. It means that people are actually authorised, actively involved and know what is expected of them.

The core roles

Board and top management

ISO 42001 requires demonstrable commitment from the board. Not as a paper statement, but in concrete actions: freeing up resources, setting the AI policy, and taking part in the management review.

The board carries ultimate responsibility. This is not a formality. Under the AI Act, board members can be held personally liable if an organisation knowingly or negligently deploys high-risk AI without adequate control.

AI officer (or equivalent)

This is the central coordinating function for AI governance. The title varies between organisations: AI officer, AI lead, Head of Responsible AI, AI compliance officer. The tasks are the same:

Maintaining the AI register
Coordinating risk assessments and impact assessments
Monitoring compliance with the AI policy
Reporting to the board
Acting as the point of contact for external parties (supervisors, certification bodies)
Following developments in legislation and regulation (AI Act, ISO standards)

The AI officer does not have to be a full-time role. In smaller organisations this can be a combined role with the CISO or compliance officer. But someone must drive it.

AI system owners

Each AI system has a named owner. That person is responsible for:

The correct and responsible functioning of the system
Carrying out, or having carried out, the impact assessment
Reporting incidents or significant changes
Keeping the documentation for that system up to date

The owner is not necessarily the technical builder. It is the person who is accountable for the business use. For a CV ranking tool, that is the HR director, not the data scientist.

Operational roles

Alongside the coordinating roles, there are operational roles:

AI developers and data scientists: Responsible for technically sound build (documentation, bias detection, test procedures)
Privacy officer / DPO: Point of contact for AI applications that process personal data
Internal auditors: Independently check that the AIMS works
Legal / compliance: Assess AI applications against legislation

AI governance is not only an IT matter. Legal, HR, compliance and the business must all have a say. AI affects everyone in the organisation.

The AI policy

The AI policy is the foundation of governance. ISO 42001 requires a documented policy that has been approved by the board and communicated to the whole organisation.

A good AI policy contains:

The intentions and scope. For which purposes does the organisation use AI? Which applications are explicitly excluded? Example: “We do not use AI for automated decisions about employees without human control.”

The principles. How does AI work in your organisation? Think of: transparency towards users, no discriminatory outcomes, human oversight for high-risk systems.

The governance structure. Who is the AI officer? How are new AI systems assessed? Who decides?

The commitments. A commitment to comply with ISO 42001, the AI Act and other relevant legislation. A commitment to continual improvement.

Validity and ownership. Who approved the policy? When is it reviewed?

An AI policy is not a document you write and then forget. Plan an annual review, linked to the management review of the AIMS.

The AI committee: when and how

Larger organisations set up an AI committee. This is a multidisciplinary body that decides on AI-related matters that go beyond the authority of a single officer.

A typical AI committee includes:

AI officer (chair)
Board representative
CISO or security lead
Privacy officer / DPO
Legal / compliance
Business representative (rotating by department)

The committee meets periodically (quarterly or when major decisions arise) to discuss:

Approval of new high-risk AI systems
Review of impact assessments
Policy updates
AI incidents
Changes in legislation and regulation with consequences for the AIMS

A committee is not necessary for smaller organisations. If the AI officer has direct access to the board and the other functions, this can also work informally. ISO 42001 does not require a committee. It asks for demonstrable governance.

Example structure: three organisation types

Small organisation (5 to 50 employees, 1 to 5 AI systems)

A simple structure with combined roles.

Role	Who
Ultimate responsibility	Director
AI officer	Director or senior employee (part-time)
AI system owners	Head of the department that uses the system
Internal auditor	External party or employee from another department

Medium-sized organisation (50 to 500 employees, 5 to 20 AI systems)

A dedicated AI officer, no formal committee but regular consultation.

Role	Who
Ultimate responsibility	CTO or COO
AI officer	Compliance officer or senior IT employee (combined role)
AI system owners	Heads of department
Privacy alignment	DPO
Internal auditor	Compliance officer from another department or external

Large organisation (500+ employees, 20+ AI systems)

A formal structure with a dedicated AI officer and an AI committee.

Role	Who
Ultimate responsibility	Executive board (via CTO)
AI officer	Dedicated Head of Responsible AI
AI committee	AI officer, CISO, DPO, Legal, business representatives
AI system owners	Business owners per domain
Internal audit team	Dedicated internal audit function

Decision-making: how do you assess new AI applications?

Good governance requires a clear decision-making process for new AI systems. Without one, systems are introduced ad hoc without assessment, which is exactly what feeds shadow AI.

A workable decision-making process:

Notification. The department that wants to use a new AI application reports it to the AI officer before it is put into use.
Quick screening. The AI officer assesses: does the system fall under prohibited AI? Is it high-risk? Are there privacy implications?
Deeper assessment for high-risk systems. Impact assessment, risk analysis, supplier assessment. This goes through the committee (or the board in smaller organisations).
Decision. Approval, approval with conditions, or rejection.
Registration. The system is added to the AI register.
Periodic reassessments. Every year (or after significant changes) you reassess active systems.

This does not have to be a bureaucratic monster. For a small organisation, a simple half-page request procedure is enough. What matters is that the assessment actually takes place.