Internal organization
Assign accountability and decision rights for AI governance across leadership, product, engineering, legal, security, privacy, and operations.
How to implement it
- 01Define AI governance roles and RACI
- 02Create an AI review board or equivalent forum
- 03Assign owners for each AI system and risk treatment
- 04Record approval decisions and escalation outcomes
Evidence to keep
- - Governance charter
- - RACI matrix
- - AI system owner list
- - Review board minutes
Metrics to watch
- - Systems with named owners
- - Overdue governance decisions
- - Average approval cycle time
Put this area into the AI Statement of Applicability with a short rationale: included, excluded, or partially included. Tie that decision to the AI risk assessment, impact assessment, and system inventory.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Information security roles and responsibilitiesUse for ISO 27001 A.5.2, A.5.3 and A.5.4, defining security roles, segregation of duties, management responsibilities, and SOC 2 organisational controls.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.
Open the control-to-policy map