Many companies already use AI widely, often without anyone having an overview. AI governance creates that overview and makes use steerable. It is not a bureaucracy project but the prerequisite for using AI quickly and without nasty surprises.
The building blocks
First, responsibilities: who decides on new AI applications, who owns individual systems, who assesses risks? A RACI matrix clarifies this. Second, a policy setting out which tools may be used with which data. Third, an AI inventory of all systems with their role and risk class. Fourth, an approval process for new applications. Fifth, monitoring and regular review in operation.
What feeds into it
Depending on role and risk class, the AI Act requires AI literacy measures, transparency, human oversight and, for high-risk systems, comprehensive risk management. Data protection law requires legal bases, contracts with vendors and impact assessments where needed. For Swiss financial institutions, FINMA set out expectations for governance and risk management in AI use in Guidance 08/2024. And ISO/IEC 42001 offers a certifiable standard for AI management systems. Good governance brings these requirements together in one process rather than building a separate structure for each.
Proportionate, not maximal
An SME does not need an AI committee meeting monthly. It needs a responsible person, a short policy, a current inventory and a clear rule on who approves new tools. A financial institution or a provider of high-risk systems needs more: documented risk processes, independent review and ongoing monitoring. Depth follows risk.
Common mistakes
A policy that bans everything and is therefore ignored. An inventory created once and never maintained. Governance only for in-house developments, while AI features bought into existing software go unnoticed. And approval processes so slow that teams bypass them.
Getting started
Start with inventory and policy; the AI usage policy checklist and the 30-day AI Act readiness plan describe the steps. We support the build-up through our AI governance set-up offer.