Building an AI Governance Framework

The legal framework

No law says "you must have an AI governance framework". But several duties in Regulation (EU) 2024/1689 (the AI Act) and in the GDPR can only be met by an organisation that has one. A framework is the set of policies, roles, records and controls that lets you show, system by system, that you know what AI you use, what law applies and who is responsible.

What the law requires that governance has to deliver

• AI literacy (Article 4 AI Act). Providers and deployers must take measures to ensure their staff have an adequate level of AI literacy, taking account of their role and the context. The duty has applied since 2 February 2025. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) amended the wording of Article 4. Check the current text when you design training.
• Prohibited practices (Article 5). Certain uses, such as emotion recognition in the workplace or social scoring, have been banned since 2 February 2025. Governance must stop them from entering the organisation.
• High-risk systems. Providers must have risk management (Article 9), data governance (Article 10), documentation (Article 11), logging (Article 12) and human oversight (Article 14). Deployers must use the system according to its instructions, assign human oversight to competent people, monitor operation, keep logs for at least six months and inform workers' representatives and affected workers (Article 26). The Omnibus moved the application of the high-risk rules for Annex III systems to 2 December 2027 and for systems embedded in regulated products (Annex I) to 2 August 2028. See the AI Act timeline.
• Transparency (Article 50). Users must be told when they interact with an AI system or see AI-generated content, in the cases listed in the Article.
• GDPR. Records of processing (Article 30), data protection impact assessments (Article 35), rules on solely automated decisions (Article 22) and processor contracts (Article 28) apply whenever AI processes personal data. See the AI Act and the GDPR.

Five building blocks

1. Inventory. A register of every AI system in use or development: purpose, data, affected persons, vendor, and the role of the organisation as provider or deployer.
2. Classification and assessment. For each system, the AI Act risk tier, whether a DPIA is needed, and, for the deployers that Article 27 covers, a fundamental rights impact assessment.
3. Accountability. A named owner for each system, a decision-maker for approving, changing and stopping systems, and a route for escalation. Smaller organisations can combine these roles.
4. Controls. A usage policy for employees, human oversight procedures, logging, incident handling and training.
5. Vendor management. Due diligence before purchase, contract terms and periodic review.

In practice

A Leuven logistics company with 300 staff uses an AI tool to rank job applicants, a chatbot on its website, and a generative assistant that employees use for drafting. It has no AI policy.

It starts with an inventory and finds eleven tools, three of which nobody in management had approved. The recruitment tool falls in Annex III and is high-risk; the company is a deployer and must plan for the obligations from the applicable date. The chatbot needs an AI disclosure. The generative assistant is acceptable for general drafting but not for client data, and the policy says so.

The company appoints an AI owner in HR and one in IT, adds AI to the procurement checklist, runs a DPIA for the recruitment tool, and schedules training. The whole framework is a few documents and a register. It is proportionate, and it can be shown to a regulator.

Frequently asked questions

Do we need a framework if we only use ChatGPT-type tools?

You need at least a policy, an inventory and training. The literacy duty and the GDPR apply even to limited use.

Who should own AI governance?

A senior person with authority across legal, IT and HR, often supported by the DPO. The AI Act does not require a specific title.

How is this different from GDPR compliance?

The GDPR concerns personal data. The AI Act concerns AI systems, whether or not they use personal data. The two share tools, such as registers and impact assessments, but not scope.

How often should we update it?

When you adopt or change a system, when the law changes, and at a fixed review interval, for example yearly.

How this connects

Our service AI Act compliance builds this framework with you. Our AI Act register and assessments keep the inventory, classification and assessments, our compliance registers hold the GDPR records, and our DPIA tool supports the impact assessments, with an attorney reviewing the results.