An AI governance analyst checks that a company's AI agents do only what they have been approved to do, and that the company can prove it. Day to day, they keep the inventory of agents and capabilities, track certificates and expiry, test controls, read decision records and prepare evidence for auditors and supervisors. They answer "how do you know?".
What does a governance analyst do in a normal week?
- Keep the inventory current. Which agents exist, what each capability may do, at what depth, who owns it and when its certificate lapses.
- Watch expiry and failures. Certificates lapse, and a failed certification run drops an agent to reading only the same day. The analyst makes sure nobody is surprised.
- Review changes. Every change to an agent's brief, sources or the company's own limits should be approved and recorded. The analyst checks that it was.
- Sample the decision record. Every verdict is filed in an append-only record. The analyst samples it to confirm that held items went to named people and that refused actions were refused for the right reason.
- Map controls to requirements. For example, the EU AI Act's Article 12 asks for automatic logs and Article 14 for human oversight of high-risk systems; frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 set out management practices. The analyst shows which control meets which expectation.
- Prepare evidence. When internal audit, a client or a supervisor asks, the analyst assembles the record.
Who does a governance analyst work with?
Agent owners, who answer for each agent. Compliance and risk teams, who interpret the rules. The data protection officer, where personal data is involved. Internal audit, who test the analyst's work in turn. AI operations analysts, who see the day-to-day numbers. In smaller firms the governance analyst may also be the compliance analyst, with agents as one part of the job.
What does a quarterly review look like?
Take an analyst we will call Mei at an insurer. Her quarterly review covers twelve agent capabilities. Two findings stand out.
First, a claims triage capability's certificate lapses in ten days and no certification run is booked. If it lapses, the capability loses its depth, and claims will pile up in the review queue. She raises it with the agent's owner, who books the run. Second, the company's own limit on a refund capability was raised from 500 to 800 three weeks ago, but she finds no recorded approval. The change may have been sensible; it was not governed. She logs it as a finding, the owner records a retrospective approval with reasons, and the change process is tightened so the system will not accept a limit change without one.
Neither finding involved a wrong decision by an agent. Both would have been hard to explain to an auditor.
What skills does the job need?
| Skill | What it looks like in practice |
|---|---|
| Reading rules carefully | Turning a requirement into a control that can be tested |
| Control testing | Sampling records and checking that what should happen did |
| Understanding agents | Knowing what depth, provenance, verdicts and certificates mean |
| Writing findings | Stating what was found, why it matters and what to do, briefly |
| Independence | Raising a finding about a senior colleague's agent calmly and firmly |
| Organisation | Tracking many expiry dates, changes and actions |
You do not need to build agents. You do need to understand them well enough to know what evidence should exist.
How do people get into AI governance?
Most come from compliance, risk, internal audit, quality assurance or data protection. Some come from AI operations, having learnt how agents behave and wanting to move to the control side. A degree in law or a risk qualification can help, but employers can check practical evidence too: findings you have raised, controls you have tested, records you have kept.
The guide to AI agent jobs and careers shows the wider field. For a definition, see what is an AI governance analyst, and for the route in, how do you become an AI governance analyst. The AI governance analyst CV template helps you present your background. Local routes are covered for Australia.
Where the Academy fits
Pryme Intelligence Academy's free Foundations track covers why agents must be governed, the decision chain and certification. Governance analysts usually go on to the Operator track to understand day-to-day review, and those leading regulated, multi-agent deployments to the Architect track, which ends in a board review with two Pryme assessors.
Questions people ask
Is AI governance a legal job?
Not usually. It sits closer to compliance and audit. Legal teams interpret the law; governance analysts make sure controls exist, work and leave evidence.
Do small companies hire governance analysts?
Smaller firms often give the duties to an existing compliance or risk person. Dedicated roles are more common in regulated firms and larger organisations.
Is the role the same in every country?
The method is the same; the rules differ. In Singapore, for example, the MAS FEAT principles shape expectations. See how to become an AI governance analyst in Singapore.