The Two Gaps in AI Governance, and They Are Big Ones
Many organizations are now standing up AI governance. Most are doing it the way compliance has always been done. They adopt ISO 42001 or prepare for the EU AI Act, write a policy, form a committee, inventory their AI, and build a register of controls. That work has its place.
But if you want to keep AI within your governance where it is actually used, there are two big gaps to close.
Consider how quality works. No one believes an ISO 9001 certificate produces quality. Quality comes from a function that spans the whole of the work. Engineering designs quality in. Operations delivers it through the people who do the work. And quality managers, inspectors, and engineers regulate that work, correct it, and improve it. ISO 9001 directs the whole. Safety and security work the same way.
Put AI beside quality, safety, and security, and the two gaps appear.
The first is the missing AI compliance function. AI has a management system and nothing underneath it. When we build or buy AI, no one makes sure it is designed to meet our obligations: the legal, safety, quality, and ethical commitments the organization has made. No one designs how AI is brought into the business so the work stays within those commitments. And no one monitors, corrects, and improves how AI performs. Governance stays in committees and registers, away from the work.
The second is the AI inside every other program. AI now helps deliver quality, safety, security, and regulatory outcomes. It adjusts processes, schedules maintenance, controls access, and makes decisions that determine whether those outcomes are achieved. Those programs were built before AI arrived, and few of them govern the AI their outcomes now depend on.
The two gaps are connected.
Closing the first gap takes an AI compliance function, built the way quality is. One that:
ensures the AI we build and buy is designed to meet our obligations
designs how AI is brought into the business, so the work it changes stays within governance
keeps AI operating within governance as the technology and governance change
places accountability for each obligation with the right owner
gives leaders forward assurance: confidence that AI will stay within governance
Closing the second gap means each program takes responsibility for the AI its outcomes depend on. Quality governs the AI in production. Safety governs the AI in operations. Security governs the AI in access control. The AI compliance function keeps that work aligned, so AI is governed the same way across every program and stays within the organization's governance as a whole.
So the question for every organization adopting AI is a simple one.
Who keeps your AI within your governance?
If you want to keep your AI within your governance, we would be glad to talk about where to start:
