AI governance framework: a practical guide for enterprises (ISO 42001 and EU AI Act)

Why an AI governance framework, now

Enterprise AI rarely fails because of technology: it fails because of missing governance. Who decides which use cases go to production, who is accountable for a wrong output, where the data lives, which models are allowed, how risk and value are measured: if there is no written answer, the incident will provide one.

An AI governance framework is the set of policies, roles, processes and controls that lets an organisation adopt AI safely, in compliance, and aligned with strategy. It is not a document: it is a decision-making infrastructure.

In 2026 the topic moved from optional to mandatory. The EU AI Act sets binding requirements for high-risk systems, ISO/IEC 42001 provides the certifiable standard for an AI Management System, and the NIST AI Risk Management Framework has become the de facto standard in the United States and in multinationals. Without a framework today, you will not pass tomorrow's due diligence.

The seven components of an AI governance framework

An operational, non-theoretical framework rests on seven components.

1. Principles and policies

The starting point is a corporate AI Policy that states what is allowed, what is forbidden, what requires approval. Not an ethical manifesto: enforceable rules. It covers use of generative models, handling of sensitive data, prohibited use cases (employee surveillance, social scoring, fully automated decisions on individuals), transparency obligations toward customers and employees.

2. AI systems inventory

You cannot govern what you do not know. You need a living AI inventory: every AI system in use or in development, with owner, purpose, data processed, models used, EU AI Act risk classification (prohibited, high-risk, limited risk, minimal risk), compliance status. It is the first artefact any auditor will ask for.

3. Risk management

Every system needs a structured risk assessment: technical risks (bias, hallucinations, drift), security risks (prompt injection, data leakage), legal risks (privacy, IP, liability), reputational risks. The NIST AI RMF provides the most used taxonomy: Govern, Map, Measure, Manage.

4. Roles and accountability

A framework without owners is paper. Minimum roles: AI Governance Lead (often the Chief AI Officer or Chief Data Officer), AI Ethics Committee (multidisciplinary), AI Product Owner for each system, Model Risk Officer for high-risk systems. The board holds oversight responsibility: in Italy, Law 132/2025 codifies this explicitly.

5. Model lifecycle

Governance means controls across the full lifecycle: use case approval, design review, pre-deployment testing (bias, robustness, security), production monitoring (performance, drift, incidents), retraining, decommissioning. Each stage with documented evidence.

6. Vendor management

Most models are third-party. You need vendor governance covering: assessment of model and platform providers, contractual clauses (data usage, IP, indemnity), compliance checks (SOC 2, ISO 27001, ISO 42001), AI supply chain management.

7. Monitoring, audit and continuous improvement

Governance KPIs (inventory coverage, average approval time, incidents, audit findings), periodic audits, board reporting, policy updates in response to new risks and regulations.

How the standards align

The reference frameworks are not alternatives: they are complementary.

EU AI Act: what you must do by law in Europe. Defines risk categories, requirements for high-risk systems (risk management, data quality, documentation, transparency, human oversight, accuracy and robustness), obligations for GPAI models, sanctions.

ISO/IEC 42001: how you prove it. The first international certifiable standard for an AI Management System. Provides the organisational structure (context, leadership, planning, support, operations, evaluation, improvement) and AI-specific controls. Certification is the external evidence that the framework works.

NIST AI RMF: how you operate it. Voluntary but widely adopted, particularly useful for the risk management side. The four functions (Govern, Map, Measure, Manage) map well to operational processes.

ISO/IEC 23894 (AI risk management) and ISO/IEC 27001 (information security) complete the technical picture.

The pragmatic approach: ISO 42001 as the architecture of the management system, EU AI Act as the binding requirement to be embedded in controls, NIST AI RMF as the operational methodology for risk management.

A 90-day implementation roadmap

An AI governance framework is not built in a year. The foundations are laid in a quarter.

Days 1 - 30: Assessment and foundations

• Initial AI inventory (workshop with IT, business, legal, security)
• Gap analysis against ISO 42001 and EU AI Act
• Draft AI Policy
• Appointment of the AI Governance Lead and formation of the Ethics Committee

Days 31 - 60: Framework and controls

• AI Policy approved by the board
• Use case classification process (low, medium, high risk)
• Risk assessment and Data Protection Impact Assessment templates
• Vendor governance: standard clauses and evaluation checklist

Days 61 - 90: Operations and reporting

• First review cycle for high-risk systems
• Mandatory training for AI teams and management
• Governance dashboard (KPIs, incidents, findings)
• ISO 42001 certification plan (if relevant) and EU AI Act compliance roadmap

Common mistakes to avoid

Confusing ethics with governance. The AI Ethics Committee produces principles; governance produces controls. You need both, but they are different things.

Governance owned only by IT or only by Legal. AI governance is multidisciplinary by definition: business, IT, legal, security, HR, compliance. A framework driven by one function fails.

Documents without processes. A policy no one reads and no one enforces is worse than no policy: it creates false confidence.

Underestimating GPAI models. ChatGPT, Claude, Copilot in the enterprise are AI systems. They must be inventoried, assessed, governed. Shadow AI is already inside.

Postponing while waiting for regulatory clarifications. The framework is needed before the deadlines, not after. Those who arrive in August 2026 without foundations will not recover in time.

What makes the difference

Frameworks that work share three traits. They are proportionate to actual risk: heavy controls on high-impact systems, light controls on low-impact ones. They are integrated into existing processes (project management, procurement, security, risk) instead of being a parallel bureaucracy. They are measured with KPIs the board understands: how many systems in production, how many incidents, how much value generated, how much residual risk.

AI governance does not slow innovation: it makes it possible at scale. Without a framework, the only AI that reaches production is the one no one sees, and that is the riskiest kind.

How we can help

At ZeroFive we build operational, not documental, AI governance frameworks. We start with the AI Rating to photograph current maturity, we design the framework tailored to your context (sector, size, risk), we implement it with your team, and we connect it to EU AI Act, ISO 42001 and (for Italy) Law 132/2025 obligations.