AI governance is the set of policies, decision rights, technical controls and legal obligations that determine how an organisation develops, buys, deploys and monitors artificial intelligence (AI) systems, and who answers for the results. It exists because AI systems produce probabilistic outputs that are hard to explain and capable of harming people at scale, while the departments adopting them - marketing, HR, finance, engineering - rarely share a single owner. Governance puts a name, a process and a record behind every model in use.

The term works on two levels. Inside a company, it is a management discipline: an inventory, a risk classification, approval gates, documentation and monitoring. Outside, it is the public frameworks that shape those programmes - binding law such as the European Union's AI Act, the voluntary AI Risk Management Framework from the US National Institute of Standards and Technology (NIST), and the certifiable standard ISO/IEC 42001. Most corporate programmes are built by mapping the second level onto the first.

How a governance programme works

Inventory. The first step is listing every AI system an organisation builds, buys or accesses through a software-as-a-service (SaaS) vendor, with its purpose, data inputs and owner. Many programmes stall here. A DigiCert survey of 1,001 IT and security decision makers, fielded in May 2026, found only 64% had inventoried their AI systems, while 78% had already experienced an AI-related security incident or vulnerability. Unsanctioned tools used by staff, known as shadow AI, sit outside the inventory by definition.

Risk classification. Each system is sorted by potential harm. The AI Act supplies the best-known taxonomy: prohibited practices, high-risk systems, systems with transparency duties and minimal-risk systems. Internal programmes often add tiers for commercial risk, such as a chatbot that could misstate prices.

Decision rights. A committee, a chief AI officer or a function such as legal or privacy sets rules on approved uses, data handling and human review. Ownership is often unsettled. In a WSJ Intelligence and Code and Theory survey of 801 executives at US firms with at least $500 million in revenue, 25% said no one was accountable for AI orchestration, against an average of 183 AI tools per organisation. Both figures are self-reported.

Assessment and documentation. Under the AI Act, providers of high-risk systems must run a risk management system (Article 9) and a quality management system (Article 17), while certain deployers must carry out a fundamental rights impact assessment (Article 27). Outside regulation, documentation usually means model cards, data sheets and vendor questionnaires.

Controls and monitoring. Human oversight, logging, access restrictions and approval workflows make policy enforceable, and post-deployment monitoring catches drift and silent vendor updates. Ad tech supplies examples. Fluency, which says it manages $3 billion in annual media spend, keeps large language models away from live budget actions, letting only deterministic agents that follow advertiser-set rules execute spend. The same coverage records PubMatic adding execution-point guardrails and Yahoo DSP shipping agents with audit trails and human approval.

The three reference frameworks

NIST AI RMF 1.0, released on January 26, 2023, is voluntary. Its core has four functions - Govern, Map, Measure and Manage - split into 19 categories and 72 subcategories, according to Modulos's analysis of the NIST text. Govern is cross-cutting, covering culture, accountability and policy. A Generative AI Profile, NIST AI 600-1, followed on July 26, 2024. As of October 2026, NIST says the framework "is being revised as part of the White House AI Action Plan", but no revision has been published.

ISO/IEC 42001:2023, published on December 18, 2023 by the joint ISO and International Electrotechnical Commission (IEC) committee JTC 1/SC 42, is the first certifiable management system standard for AI. It uses the Plan-Do-Check-Act structure of ISO/IEC 27001 for information security, with an annex of reference controls. ISO does not certify organisations itself; independent certification bodies do, according to ISO.

The EU AI Act (Regulation (EU) 2024/1689) is the only one of the three with fines. It entered into force on August 1, 2024, with prohibitions and the AI literacy duty applying from February 2, 2025, general-purpose model rules from August 2, 2025, and general application from August 2, 2026. Penalties reach €35 million or 7% of worldwide turnover for prohibited practices, €15 million or 3% for most other breaches, and €7.5 million or 1% for incorrect information, as set out in PPC Land's reading of the consolidated text.

Origin and evolution

The phrase spread in 2019, when principles documents began giving way to machinery. Singapore's Personal Data Protection Commission published a Model AI Governance Framework in January 2019, the European Commission's expert group issued Ethics Guidelines for Trustworthy AI in April, and the Organisation for Economic Co-operation and Development (OECD) adopted its AI Principles in May. Revised in May 2024, the OECD principles now have 47 adherents, according to the OECD.

Obligations followed. The Commission proposed the AI Act in April 2021. US Executive Order 14110 of October 30, 2023 set federal AI safety directions; it was revoked in January 2025. The Council of Europe's Framework Convention on AI opened for signature on September 5, 2024 and had 21 signatories by September 2026, with the EU ratifying in May 2026, according to the Council of Europe.

Since 2025, regions have diverged. The EU published a final General-Purpose AI Code of Practice in July 2025. Meta declined to sign it, with Joel Kaplan, its chief global affairs officer, stating that "Europe is heading down the wrong path on AI." China released a 13-point Global AI Governance Action Plan on July 26, 2025. In Washington, Executive Order 14365 of December 11, 2025 targeted state AI laws, and the White House issued a framework in March 2026 asking Congress to pre-empt state rules.

The EU then trimmed its own law. Regulation (EU) 2026/1744, part of the Digital Omnibus, was published on July 24, 2026 and entered into force on July 27, according to White & Case. It moved high-risk deadlines to December 2, 2027 for stand-alone Annex III systems and August 2, 2028 for AI embedded in regulated products.

Why it matters for marketers

Advertising sits closer to the regulated core than many assume. Annex III covers the targeting of job ads and credit and insurance pricing. Article 5's bans on manipulative and exploitative AI raise questions for persuasion optimisation, which PPC Land examined in coverage of where influence becomes manipulation. The amended Act also gives the Commission's AI Office oversight of AI integrated into very large online platforms, including the main ad-selling platforms, with periodic penalties of up to 5% of average daily turnover.

Self-regulation moves in parallel. The Interactive Advertising Bureau (IAB) released an AI Transparency and Disclosure Framework on January 15, 2026, requiring labels where AI could mislead consumers about authenticity or identity, backed by Coalition for Content Provenance and Authenticity (C2PA) metadata.

Limitations and disputes

The persistent criticism is that governance becomes paperwork. Ninety per cent of DigiCert's respondents had discussed AI governance at board level, but only 50% had both dedicated budgets and formal programmes. Fluency cited a Deloitte finding that one in five firms has a mature governance model, without naming the report. Many such numbers come from vendors selling governance tooling, and most are self-reported.

Sources conflict on the literacy duty. PPC Land's May 2026 report on the provisional deal described the obligation shifting to the Commission and member states, which would "encourage and facilitate" providers and deployers. White & Case's reading of the published regulation says Article 4 still requires providers and deployers to "take measures to support" AI literacy, rather than to ensure a sufficient level of it. The published text governs.

Fragmentation is another problem. In the United States, Colorado replaced its 2024 AI Act with SB 26-189, effective January 1, 2027, yet a federal court has barred enforcement pending litigation, and the Federal Trade Commission (FTC) said the revised law still raises "many of the same concerns". Agents strain the model further: OneTrust argued governance must move "from observation to orchestration" as agents hand tasks to one another and drift from their original purpose.

What AI governance is not

Data governance manages data quality, lineage, access and retention. AI governance depends on it but also covers model behaviour, outputs and accountability for decisions.

AI ethics and responsible AI describe principles such as fairness and transparency. Governance is the machinery that turns them into roles, controls and evidence.

AI safety usually means technical research and testing to prevent severe failures, particularly in frontier models. It feeds governance but is not a synonym.

AI regulation is binding law. Governance includes compliance but extends to voluntary standards and internal policy where no law applies.

Recent developments

Regulators are now writing guidance for agents. The UK Information Commissioner's Office (ICO) opened a call for evidence on agentic AI on October 8, 2026, with responses due by November 20, and plans a separate report on agentic AI in adtech. Parliament's Joint Committee on Human Rights called for a dedicated AI Bill and a statutory regulator, and the government must respond by mid-November. Malaysia's data regulator closed comments yesterday on a draft AI and personal data framework.

Today, PPC Land's analysis of new Google and Meta terms placed the AI Act's 3% ceiling alongside GDPR, Digital Markets Act and antitrust exposure. For the largest ad platforms, AI governance is one regime among several. The next fixed dates are December 2, 2026, when new prohibitions and the generative-output marking deadline arrive, and December 2, 2027, when Annex III duties begin.

Timeline

  • January 2019 - Singapore's PDPC publishes the Model AI Governance Framework.
  • April 2019 - EU High-Level Expert Group publishes Ethics Guidelines for Trustworthy AI.
  • May 2019 - OECD adopts its AI Principles.
  • April 2021 - European Commission proposes the AI Act.
  • January 26, 2023 - NIST releases AI RMF 1.0.
  • October 30, 2023 - US Executive Order 14110 on AI is signed.
  • December 18, 2023 - ISO/IEC 42001:2023 is published.
  • May 2024 - OECD revises its AI Principles.
  • July 26, 2024 - NIST publishes the Generative AI Profile (NIST AI 600-1).
  • August 1, 2024 - EU AI Act enters into force.
  • September 5, 2024 - Council of Europe Framework Convention on AI opens for signature.
  • January 2025 - Executive Order 14110 is revoked.
  • February 2, 2025 - AI Act prohibitions and AI literacy duty apply.
  • July 10, 2025 - Commission receives the final General-Purpose AI Code of Practice.
  • July 26, 2025 - China releases its Global AI Governance Action Plan.
  • August 2, 2025 - AI Act obligations for general-purpose AI models apply.
  • December 11, 2025 - US Executive Order 14365 targets state AI laws.
  • January 15, 2026 - IAB releases its AI Transparency and Disclosure Framework.
  • March 2026 - White House issues a National Policy Framework for AI for Congress.
  • May 2026 - EU ratifies the Council of Europe Framework Convention.
  • July 24, 2026 - Regulation (EU) 2026/1744 is published; in force July 27.
  • August 2, 2026 - General application of the AI Act, including Article 50 transparency duties.
  • October 8, 2026 - UK ICO opens its call for evidence on agentic AI.
  • December 2, 2026 - New AI Act prohibitions and generative-output marking deadline apply.
  • January 1, 2027 - Colorado SB 26-189 scheduled to take effect.
  • December 2, 2027 - AI Act high-risk obligations for Annex III systems apply.
  • August 2, 2028 - AI Act high-risk obligations for Annex I systems apply.

Summary

Who: Organisations that build, buy or deploy AI, overseen internally by governance committees, chief AI officers, legal and privacy teams, and externally by regulators such as the European Commission's AI Office, national authorities, the UK ICO and US state attorneys general, with standards set by NIST, ISO/IEC and the OECD.

What: The policies, decision rights, controls and legal obligations that determine how AI systems are inventoried, classified by risk, approved, documented, monitored and held to account.

When: The term spread from 2019 with Singapore's framework and the OECD Principles, gained binding force with the EU AI Act in August 2024, and was amended by Regulation 2026/1744 in July 2026, with high-risk deadlines in December 2027 and August 2028.

Where: Inside every organisation using AI, and across jurisdictions that now diverge sharply: binding law in the EU, pre-emption efforts and state laws in the United States, and voluntary or sector-led approaches in the UK and much of Asia.

Why: AI outputs are probabilistic, hard to explain and capable of harming people at scale, while AI adoption is spread across departments with no single owner. Governance exists to assign responsibility, produce evidence and meet legal duties before harm occurs.