Move AI from experimentation to accountable production
A pilot proves that a model can work. Governance proves that the organisation knows where it is used, what could go wrong, who can stop it, and what evidence supports every production decision.
Reviewed 9 October 2026 · 11 minute read · General guidance, not legal advice
One operating model, several external lenses
The frameworks differ in legal effect and scope, but they converge around accountability, risk assessment, lifecycle control, transparency, human oversight, monitoring and improvement. Build these once, then map them honestly.
EU AI Act
A risk-based legal regime covering prohibited practices, high-risk systems, transparency and general-purpose AI. Application is phased; classification depends on role and use case.
ISO/IEC 42001
A certifiable AI management-system standard connecting policy, leadership, risk, impact assessment, operational controls, performance evaluation and improvement.
NIST AI RMF
A practical, rights-preserving and use-case-agnostic framework organised around Govern, Map, Measure and Manage across the AI lifecycle.
Privacy and sector rules
Personal-data, consumer, employment, safety, discrimination, security and sector obligations continue to apply when AI enters the process.
Six controls that make governance operational
The goal is not a larger policy. It is a repeatable decision system that follows every AI use case from idea to retirement and leaves evidence behind.
1. AI inventory and scope
- Record purpose, owner, provider, model/version and deployment status.
- Capture users, affected people, data, integrations and geography.
- Include embedded vendor AI, copilots and shadow experimentation.
2. Classification and impact
- Determine organisational role and applicable regimes.
- Assess rights, safety, privacy, bias, security and misuse impacts.
- Document tier, rationale, assumptions and reassessment triggers.
3. Lifecycle gates
- Set entry and exit criteria for experiment, pilot and production.
- Require evidence proportionate to risk before approval.
- Block releases where critical conditions are unmet.
4. Human oversight
- Define who reviews, intervenes, overrides and stops.
- Give reviewers sufficient information, authority and time.
- Measure whether oversight works in real operation.
5. Testing and monitoring
- Test validity, reliability, safety, security, bias and privacy.
- Set thresholds for quality, drift, incidents and unacceptable use.
- Monitor models, prompts, outputs, dependencies and changes.
6. Change, incident and retirement
- Route material changes back through assessment and approval.
- Connect AI incidents to privacy, security and product response.
- Retire access, data, integrations and monitoring deliberately.
Put the strongest control at the production boundary
Experimentation needs guardrails; production needs accountable approval. Every gate should name the decision, required evidence, approver and conditions that send the system back.
Permission to explore
Approved environment and tools, permitted data, limited users, prohibited uses, expiry date and named owner.
Permission to test with reality
Documented purpose, risk tier, evaluation plan, representative testing, privacy/security review, human oversight and rollback.
Permission to operate
Acceptance criteria met, residual risk approved, disclosures ready, monitoring live, incident route tested and accountable operator assigned.
What level of governance attention does this use case signal?
Tick every statement that applies. This is a prioritisation aid, not an EU AI Act legal classification or substitute for an impact assessment. Nothing is saved or transmitted.
Map the control once; preserve framework-specific detail
A crosswalk reduces duplication, but it does not make different requirements equivalent. Keep traceability to the exact obligation or control statement.
| Operating control | EU AI Act lens | ISO/IEC 42001 lens | NIST AI RMF lens |
|---|---|---|---|
| Inventory and roles | Role, scope and system classification | AIMS scope and AI system resources | Govern and Map |
| Impact and risk assessment | Risk category, impact and applicable duties | AI risk and impact assessment | Map and Measure |
| Production approval | Risk management and conformity evidence where applicable | Operational planning and lifecycle controls | Govern and Manage |
| Human oversight | Oversight duties for relevant systems | Responsible use and human involvement | Govern and Manage |
| Monitoring and incidents | Post-market monitoring and incident duties where applicable | Performance evaluation and improvement | Measure and Manage |
The evidence pack for an operating AI system
Approval is a point in time. Governance is the continuing evidence that assumptions, controls and thresholds remain valid.
- Current inventory record with owner, purpose, model/version, provider and deployment status.
- Role, jurisdiction and risk classification with rationale and review triggers.
- AI impact, privacy, security and domain assessments with accepted residual risk.
- Data provenance, permissions, quality criteria and known limitations.
- Evaluation plan, test set, results, red-team findings and remediation.
- Human-oversight design, training, intervention authority and records.
- Production gate decision, approvers, conditions and release evidence.
- Monitoring thresholds, drift and quality reports, alerts and actions.
- Vendor terms, model-change notification, audit rights and exit plan.
- Incident decisions, disclosures, corrective action and retirement record.
Questions governance teams should settle early
Should every experiment go through the full process?
No. Use lightweight guardrails for controlled experimentation and scale evidence with risk. The production boundary should remain a formal decision.
Is buying a vendor tool lower risk?
Not automatically. Procurement changes your control options, not your accountability for deployment, data, affected people, monitoring and exit.
Can one assessment cover privacy and AI?
One coordinated process can reduce duplication, but it must still address the distinct questions and legal requirements of each assessment.
Does a human reviewer remove AI risk?
No. Oversight is meaningful only if the person has information, competence, authority, time and a realistic ability to challenge or stop the output.
How often should classification be revisited?
At material changes in purpose, model, data, users, geography, integration or autonomy—and periodically according to risk.
Is the interactive result a legal classification?
No. It is a governance-priority signal. Formal classification depends on the applicable law, organisational role, facts and current guidance.