AI governance has to work beyond the policy document

What the references address

ISO/IEC 42001 addresses the organisation’s AI management system. ISO/IEC 42005 provides guidance on AI-system impact assessment. ISO/IEC 27001 addresses information-security management. These references serve different purposes; one label should not stand in for the others.

NIST’s AI Risk Management Framework organises risk work around Govern, Map, Measure and Manage. Its guidance includes accountability, AI inventory, human–AI responsibilities and lifecycle review. It is a voluntary framework, not a certification scheme.

Execution Clarity’s interpretation

Begin with the decisions governance must support. What AI is being used? Who owns its purpose and outcomes? What risks and impacts need review? What action can the system take, and when must a person intervene?

Connect the answers to the evidence needed in practice: an inventory, accountable owners, assessment records, approved authority, exception handling and review decisions. When the system, supplier or intended use changes, the governance process should be able to revisit the decision.

Readiness support can help organise that work and identify gaps. It should not be presented as certification, independent technical assurance or a guarantee of compliance. Retain the relevant specialist and certification boundaries.

A question for leadership

Could the accountable owner explain what an AI system is permitted to do—and show the evidence behind that authority?