AI Governance: How not to lose a million on compliance
99% of companies report losses from AI risks. Most of them were avoidable. Here's what you need to know.
According to the EY report, 99% of companies booked losses from AI risks. On average 4.4M USD per organization. Models will always make mistakes. What counts is the structure that catches them before they become a problem.
EU AI Act: What you need to know
Starting in 2026, the EU's AI regulations come into force. Using AI for credit decisions, hiring, or anything health-related? You need to get ready.
HIGH-RISK SYSTEMS (EU AI ACT)
- • Recruitment and workforce management
- • Credit and insurance scoring
- • Education and vocational training
- • Access to public services
- • Biometric systems
The penalties? According to the official text of the EU AI Act: up to 35 million euros or 7% of global turnover. Whichever is higher.
The AI Governance Framework
Compliance is just the start. Governance gives you the structure to scale AI without chaos. It begins with the simplest question: who signs a document before it goes out. What happens when nobody does shows up in a document none of the three parties involved would sign for.
The NIST AI Risk Management Framework defines four key functions:
NIST AI RMF: 4 FUNCTIONS
-
1. Govern
You build a culture of AI risk management and set who owns what
-
2. Map
You map the context and sort AI risks across the organization
-
3. Measure
You measure the risks you found with the right metrics
-
4. Manage
You set priorities and act on the measured risk
How to translate those four functions onto a single agent in production: the Bounded Autonomy framework.
This is what I do hands-on: advising on AI strategy and building agents that survive the demo.
The AI Governance Lead role
Forrester predicts that 60% of the Fortune 100 will appoint a dedicated AI Governance Lead role in 2026. Without it, AI risk gets out of hand.
The AI Governance Lead is the person who:
- • Creates AI policies and standards for the entire organization
- • Assesses the risk of new AI projects
- • Ensures regulatory compliance
- • Builds a culture of responsible AI
I wrote up the twin role separately: AI Ethics Lead. That piece also covers the minimum you can run without a full-time hire.
"AI without governance is like a car without brakes. It can go fast, but sooner or later it'll drive into a wall."
Operating Model: Federated vs Centralized
Two approaches to governance:
Centralized: One team controls all AI projects. Slower, but safer. Good for companies in regulated industries.
Federated: Central standards, local implementation. Faster, but it requires organizational maturity. Good for companies with distributed teams.
Most companies start with centralized and evolve toward federated.
Checklist: Minimum Viable Governance
WHAT YOU NEED FROM DAY ONE
- ✓ An inventory of every AI system in the company
- ✓ Risk classification for each system
- ✓ Clear ownership and accountability
- ✓ An approval process for new AI projects
- ✓ Monitoring and alerting for models in production
- ✓ An incident response plan
Monitoring that doesn't count retries and fallbacks produces silent failures.
First move
Start with one list: every AI system in the company and an owner next to each. It takes a week. You get a starting point before the regulations force you, or before the first incident does. The rest of the framework builds around that list.
