What is AI governance?

AI governance is the framework of policies, roles, processes and controls an organisation uses to decide how AI is chosen, built, used and monitored, and who answers for it. It covers risk appetite, use-case approval, data use, testing, staff literacy and board reporting. Its aim is that every AI system in use is known, owned, justified and checked.

Why does AI governance matter once agents act?

Most AI governance frameworks were built for systems that advise: a model that scores a loan application, a tool that drafts a summary. A person stood between the output and any consequence. Agents remove that person for some actions, and governance has to reach further as a result. It must now cover what a system is allowed to do, not only whether its outputs are good.

Regulation is moving the same way. The EU AI Act takes a risk-based approach, with obligations for high-risk systems such as creditworthiness assessment, and its Article 4 requires providers and deployers to ensure staff have sufficient AI literacy. In the UK, the approach is principles-based and regulator-led rather than a single AI law. Either way, a business must show it governs what it uses. How that applies to agents specifically is set out in agent governance is a bound, not a model.

How does AI governance work in practice?

A typical framework includes:

• Policy and risk appetite: what the organisation will and will not use AI for.
• Inventory: a register of every AI system, its owner and its purpose.
• Risk classification: which systems need more scrutiny, and why.
• Approval: who signs off a new use, and on what evidence.
• Testing and monitoring: how systems are checked before and during use.
• Roles and accountability: named owners, and a route to the board.
• Literacy: training so staff understand the systems they use and oversee.

Writing the policy that ties these together is covered in how do you write an AI agent governance policy? Whether it is working is the question in how do you measure AI agent governance?

What does that look like in an example?

An asset manager sets up AI governance. A committee approves an AI policy, every team registers the AI tools it uses, and each tool is classified by risk. A research summarisation tool is low risk and approved with light monitoring. A proposal to let an agent rebalance client portfolios within set bands is high risk. The committee then needs answers it cannot get from policy alone: which rebalancing actions the agent may take, how it was tested on the firm's own portfolios, and what happens when it is wrong. That is where governance of agents takes over from governance of AI in general.

How is AI governance different from AI agent governance and data governance?

AI agent governance is the part of AI governance that deals with systems that act. It works per agent and per capability, enforces limits at the moment of action and records a verdict on each one. AI governance sets the frame; agent governance decides each action within it.

Data governance is a neighbour rather than a part. It covers the quality, ownership, access and lifecycle of data, whether or not AI uses it. AI governance depends on it, but the two have different owners and controls.

A provider's certifications describe its product, not how you use it, which is why vendor assurances are not your governance. Filters and authority are separated in guardrails are not governance.