AI Governance Principles: An Enterprise Implementation Guide

AI governance is the set of undertakings that govern an organization's process of building, deploying, and monitoring AI: who is responsible, what should be transparent and explainable, how fairness, privacy, and safety will be protected, and when humans need to remain in control. These make them auditable controls through frameworks such as the NIST AI RMF, ISO 42001, and the EU AI Act.

According to IBM's 2025 Cost of a Data Breach Report, 13 percent of companies experienced security breaches related to their AI models or applications, while 97 percent of companies had no access controls for AI. Sixty-three per cent of those that reported having been breached had no AI governance policy in place or were still in the process of creating one. There are lots of companies that have principles somewhere, a slide on fairness or a page on transparency. Much less have a mechanism that changes what a system can do by altering those words.

This guide uses AI governance principles as the rules to be followed. It discusses the seven principles that appear again and again in NIST, ISO, the OECD, and the EU AI Act, and what each one requires in practice; how these principles differ from AI ethics and AI TRiSM; and how to make them into policies, risk tiers, monitoring, and something that an auditor will accept, even for AI agents that act on their own.

What Are AI Governance Principles?

An AI governance principle is a pledge to the behavior of an organization's AI systems, responsibility, and one that applies to any use case, model, and vendor. A principle is that “Decisions made by our AI about people should be explained to the person involved”. It gives rise to a standard that a credit-limit model should return a reason code for every adverse decision. The control for “Reason codes are checked against a sample of live decisions each quarter” is that a sample of live decisions is checked against reason codes each quarter. Governance is only possible when all three layers are present and connected.

Responsible AI principles are well aligned. The OECD's five values-based principles are inclusive growth; human rights and fairness; transparency and explainability; robustness and safety; and accountability. NIST has identified the following seven attributes of trustworthy AI: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, and fair with harmful bias managed. The EU AI Act makes these same concepts binding.

There is a difference between a governance principle and a value statement, in that somebody can check it:

Why AI Governance Principles Matter for Enterprises

Enterprise AI governance generates revenue in three ways: when decisions have a negative impact on people at scale, when regulators and courts demand evidence, and when customers demand evidence before entrusting your systems with their data.

Managing risk in high-stakes AI decisions

A biased recruiter impacts the candidates they screen. All employers who use a screening model are impacted by a biased screening model. The heart of the case in Mobley v. Workday is a plaintiff's claim that he submitted applications for over 100 positions at companies that used Workday's AI screening tool, but was turned down in each case. On May 16, 2025, a federal court in California ruled that the Age Discrimination in Employment Act had been satisfied by the recommendation system, and agreed that it could be considered a single policy applied to national applicants at various employers. The court also let the claims proceed on the theory that the vendor could be liable as the employers' agent.

Principles raise the question that must be asked in advance of launching: what decisions are sufficiently important to warrant testing for fairness, explanation, and human review? If this doesn't happen, a résumé screener and a meeting summarizer are both treated with the same light reading.

Generative AI is another failure. Confabulation, confidently stated false output, is one of 12 risks identified in NIST's Generative AI Profile (NIST AI 600-1) that are unique to generative models or are worsened by them. If it is this output that invades a domain of decision on a loan or claim, then it is a governance issue.

Meeting regulatory and legal expectations

The EU AI Act's fines range from €35 million or 7% of global annual turnover for prohibited practices, up to €15 million or 3% of global annual turnover for most other violations, including high-risk obligations such as requiring human oversight, and up to €7.5 million or 1% of global annual turnover for violations that involve misleading information or failure to provide it to authorities. The high-risk timeline shifted this year, but classification work is not on hold: High-risk status continues to be determined by Article 6, and on 19 May 2026 the European Commission released draft classification guidelines.

In other parts of the world, pressure comes in other forms. Although the NIST AI RMF is not mandatory, it has come into effect due to federal procurement guidance, sectoral regulators, and incorporation into state AI laws. That's not to say courts are waiting for statutes to be specific to AI, as the Workday case is based on a 1967 employment law. But EU AI Act requirements are separate to the provider and deployer, meaning that purchasing AI does not pass the governance responsibility to the buyer.

Building stakeholder and customer trust

There is a growing need for trust and not taking anything for granted. Shadow AI (using AI tools without authorization) contributed to 20% of breaches and an estimated $670,000 to the average cost of a breach, IBM found. 65% of those incidents involved the compromise of customer PII, compared to 53% of all breaches.

There is a program that can demonstrate an AI inventory, an acceptable use policy, and enforcement, providing customers with something to judge. ISO 42001 certification is a more extensive one, granted by accredited third parties, often lasts three years, and comes with annual surveillance audits, which is an indication that the program is ongoing. On the other side of that coin, the same evidence accelerates the adoption of responsible AI, as when a toolset is approved and has guardrails, employees have options other than unsanctioned tools.

The Core AI Governance Principles

The core principles of AI governance below track NIST's seven trustworthiness characteristics, grouped the way enterprises assign ownership. NIST's warning is universal: no system is worthwhile unless the characteristics can be balanced; a secure system is an unfair system; an accurate system is an uninterpretable system.

Accountability

Accountability entails an identified owner for each AI system responsible for the results of that system and that the organization will not take responsibility for what the AI says. Air Canada tried. After a customer, Jake Moffatt, traveled without a fare, the policy called for a bereavement payment to be made before the trip, but it was actually paid after the customer's trip. In a February 2024 hearing before the Civil Resolution Tribunal in BC, the airline stated that the chatbot was essentially a legal person. No, said the tribunal, treated the chatbot as any other webpage on Air Canada's site, and found negligent misrepresentation. The award was approximately $675, and the precedent was worth a lot more.

There are no shortcuts when it comes to the accountability and transparency of AI in practice, and it begins with the inventory. For the outcomes, a name for a business owner should be on each record, and for the behavior and changes, one for a technical owner should be on each record, and one for the person who is authorized to suspend the system should be on each record. Algorithmic accountability also requires a trail: Who authorized it, which version of the model is being used, and what has changed since it was reviewed.

Agents extend this even further. Each non-human identity should have a human sponsor, a clearly documented purpose, and a clearly defined set of tools and data they can use.

Transparency and explainability

NIST considers these separate entities. Transparency is the answer to "what happened?" in a system and what information about a system is accessible to people who interact with the system. Explainability provides an answer to "how" a decision was made. Interpretability deals with the question of "why," and enables the output to be put into context with respect to the system's intended application. NIST also associates transparency with redress: If people do not know what the system did, they have no way to challenge an output.

There is no one-size-fits-all solution for every audience. The OECD's 2024 text implies that users should be made aware of their encounters with AI, not least at work. System cards have to be provided by operators and should contain a statement on intended use, limitations, and data sources. Auditors require decision-level records.

Explainability for LLM agents does not usually equate to feature attribution. The execution path for a 20-step run that reads a ticket, accesses a knowledge base, and calls three tools is explained: prompt, retrieved context, each tool call and result, and action at the end. The sequence in Akto's Agent Traces is shown as a span waterfall and provides an audit trail where each hit on the guardrails is correlated to the session and policy that triggered it, instead of a collection of logs.

Fairness and non-discrimination

Fairness: A system's errors or benefits are not disproportionately distributed to protected groups. NIST's formulation "fair with harmful bias managed" is intentional; bias is managed throughout the lifecycle, not stated to be nonexistent at launch. Bias mitigation is achieved by ensuring that training data is representative, pre-release testing of data on groups and intersections of groups (age, race, and disability discrimination are claimed together in the Workday plaintiff's action), and monitoring for bias as populations change.

The first decision that is most important is not about testing, but about the metric of fairness, and selecting the one that's best matched to the harm. If a hiring screen rejects candidates for false reasons, why is this acceptable? If a fraud model freezes accounts for false positives, why is a hiring screen acceptable? Write the metric, threshold, and rationale.

Typically, non-discrimination testing requires people to reveal sensitive information, an aspect that conflicts with privacy law. The EU's Digital Omnibus deals with part of this by introducing a new category of processing under the GDPR (legal basis) for some cases of bias detection.

Privacy and data protection

AI data privacy is not limited to the training set. NIST AI 600-1 notes models can be leaky, both because of training data and because of context provided during inference. That context also contains all the data that agents have accessed via the tools, including CRM records, tickets, and emails, just as model selection defines the boundary of privacy.

Four controls come to the fore: scope each agent's retrieval to its task, redact personal data before it gets to third-party models, limit retention of prompt and response logs (logs used for transparency are data too), and ensure contracts with providers grant or deny the ability to train on your inputs. The data for AI systems is covered by a control objective, A.7, in ISO/IEC 42001.

Safety and robustness

AI safety questions whether a system could act harmfully in its intended manner; robustness questions whether the system is robust enough to withstand unexpected or hostile inputs. According to NIST, resilient systems are those that survive unexpected adverse events and/or changes in their environment or use.

The attack surface for LLM applications and agents is language. The traditional scanner considers these as data, as they are all types of injection attacks: direct prompt injection, indirect injection hidden in documents, and tool poisoning, which occurs when a tool connected to the MCP is compromised and poisons the agent. The recommended actions in NIST AI 600-1 range from adversarial testing to detect prompt injection to monitoring to detect an anomalous task sequence.

There is a requirement for governance, which is a test gate before and after a material change, and a defined failure behavior of high-risk agents: fail closed. Akto automates red teaming against that gate, running 4,000+ probes in injection, escalation, data leakage, and tool misuse, and validates agent behavior in CI/CD.

Human oversight and control

This principle is most succinctly stated in Article 14 of the EU AI Act. Overseers need to be able not only to understand the system's capabilities and limits, but also to monitor the system, remain alert to automation bias, be able to interpret the output correctly, have the ability to decide not to use or override the system, and interrupt the system by pressing the stop button or otherwise.

Because nominal oversight slips away without notice, it is called automation bias. When a reviewer says “yes” to almost all recommendations, they are rubber-stamping. Monitor override rates by reviewer and system; use any rate close to zero as an indicator to look into.

For agents, the monitoring changes from reviewing output to gating actions. Ensure that irreversible actions like payments, deletions, permission changes, or external messages only take place upon human approval, and that the stop is performed at the agent's execution location, not a dashboard. Scale oversight to risk: summarizer does not require a reviewer, agent with production write access does.

Reliability and validity

At the foundation of NIST's list of trustworthiness characteristics, NIST puts “valid and reliable.” Validation is the process of providing objective evidence that a system fulfills the requirements for a particular intended use. That is a no-brainer: if it demos for support tickets, it is not necessarily validated for legal intake.

Unlike traditional software, reliability begins to decline in certain ways. AI systems may require more regular maintenance due to data and concept drift, NIST recognizes. Third parties introduce instability: hosted model versions are updated, and the tool backend of an agent can also change behavior during a session, which is called a rug pull.

Held controls: acceptance threshold per use case, pinned model versions if applicable, regression evaluations for any model, prompt or tool change, and measured confabulation rate (CR) for generative systems.

How AI Governance Principles Differ from AI Ethics

AI ethics is a question of what should be done. AI governance principles determine who, what, when, and how. Ethical AI principles, such as "do no harm," are crucial inputs, but they do not prescribe which team is responsible for conducting disparate impact tests or what steps should be taken when a test fails. Between them lie responsible AI principles, selected ethical commitments that are worded to be subject to governance.

They both require each other. Ethics brings up questions to which governance has not thought. Governance makes decisions stick; ethics brings up questions to which governance has not thought. The transition from ethical concerns to banned practices is illustrated in the EU AI Act, where social scoring and subliminal manipulation were shifted from one category to the other in the highest fines section of the Act. The switch from ethical concerns towards prohibited practices is demonstrated in the EU AI Act, as social scoring and subliminal manipulation were transferred from the ethical category to the prohibited category in the highest fine section of the Act.

How AI Governance Principles Differ from AI TRiSM

AI TRiSM, Gartner's AI Trust, Risk and Security Management framework, is a technology stack, not a set of principles. Gartner recognizes four layers: AI governance, AI runtime inspection and enforcement, information governance, and infrastructure and stack. Principles are what must be true; TRiSM is the tooling that makes it true!

The relationship is hierarchical. One layer of TRiSM is governance, which includes inventory, ownership, validation, and compliance of AI. The other layers implement specific principles, with privacy primarily achieved through the use of information governance (classification, access control, lineage), and safety and human oversight through the use of runtime inspection and enforcement. This is done while the system is running rather than after the fact with logs. When it comes to the agentic systems' runtime layer, Gartner's February 2026 Market Guide for Guardian Agents includes guardian agents.

Practical exercise: Name, for each principle, the TRiSM layer, the enforcement mechanism, and the tool, providing evidence. If there is no enforcement layer, it is only a principle. Akto operates in the runtime layer, identifying and blocking employee AI tools (Akto Atlas) and unauthorized tool calls and usage (Akto Argus) from homegrown AI tools in the cloud.

Mapping Governance Principles to Global Frameworks

Most enterprises are applying the AI governance framework principles within each of the major frameworks to a distinct role: the NIST for the risk vocabulary; ISO/IEC 42001 for a certifiable management system; the EU AI Act for the legal obligations; and the OECD for the common baseline.

NIST AI RMF

The NIST AI RMF 1.0 (January 2023) is voluntary and not certifiable. It has 4 core functions: Govern, Map, Measure, and Manage. The seven characteristics are the most similar to common trusted AI principles in practice in the United States and are directly tested in Measure; Measure 2.5, for instance, requires that a system be valid and reliable before deployment.

The Generative AI Profile (NIST AI 600-1, July 2024) introduces a series of new risks, such as confabulation, data privacy, harmful bias and homogenization, human-AI configuration, information security, and value chain integration, with corresponding actions outlined for each of the four functions. The RMF is the logical first step for AI risk management teams before certification.

ISO/IEC 42001

The ISO/IEC 42001:2023 will be the first international standard for an AI management system (AIMS) and the most auditable of the AI governance standards. It adopts ISO's harmonized structure and clauses (4 to 10) as in ISO/IEC 27001, enabling the reuse of document control, internal audit, and management review from an organization certified to ISO/IEC 27001.

There are 38 controls listed under the nine objectives: A.2 to A.10: AI policies, internal organization, resources, impact assessment, AI system life cycle, data, information for interested parties, use of AI systems, and third-party relationships. They do not form a checklist but are identified as a result of risk and impact assessments and are documented in a Statement of Applicability. The AI system impact assessment (clauses 6.1.4 and 8.4) has no 27001 equivalent. The management system is certified to ISO 42001, not the individual models.

EU AI Act

EU AI Act (Regulation (EU) 2024/1689) is mandatory legislation based on risk categories: unacceptable, high, limited, minimal. The high-risk requirements are akin to principles that have a legal binding force: “Risk management” (Article 9); “Data governance” (Article 10); “Transparency to the deployer” (Article 13); “Human oversight” (Article 14); and “The accuracy, robustness and cybersecurity of the data” (Article 15). Article 50 relates to being transparent to people interacting with AI.

The Digital Omnibus, Regulation (EU) 2026/1744, which entered into force on 27 July 2026, significantly delayed the high-risk obligations, due to harmonized standards and national authorities not being ready:

Don't see the deferral as time off, but rather as a time to put in the evidence.

OECD AI Principles

The OECD AI Principles were first adopted in 2019 and revised on May 3, 2024, to take into account generative AI, with greater emphasis on safety, privacy, intellectual property, and integrity of information. They consist of five principles based on values and 5 policy recommendations; 47 jurisdictions adhere to them, including the EU. The EU AI Act's definition of an AI system is based on the OECD-style definition. There's no certification; its value is as a common reference point.

It is a crosswalk to the nearest match and not a one-to-one match:

How to Operationalize AI Governance Principles

So, the best practices for AI governance boil down to making each of these principles into a schedule that leaves a trace. The four practices below cover documents, triage, monitoring, and people.

Policy and standards development

Write Governance (three levels). The policy communicates principles, scope, and authority. Standards are used to convert each principle into measurable requirements for each level of risk. Procedures outline how each requirement is addressed and assessed. The vast majority of programs fail by releasing the first tier and overlook the second tier, allowing engineers to draw their own conclusions about "be fair. A criteria test that can be applied to a control record is a good test:

control_id: FAIR-02
principle: Fairness and non-discrimination
applies_to: risk_tier == "high"
requirement: >
Disparate-impact test across protected groups and intersections
before release and after any model, prompt, or data change
owner: technical-owner
reviewer: ai-risk
evidence: signed test report in the model registry
frequency: per release + quarterly
on_failure: block release; open remediation ticket

control_id: FAIR-02
principle: Fairness and non-discrimination
applies_to: risk_tier == "high"
requirement: >
Disparate-impact test across protected groups and intersections
before release and after any model, prompt, or data change
owner: technical-owner
reviewer: ai-risk
evidence: signed test report in the model registry
frequency: per release + quarterly
on_failure: block release; open remediation ticket

control_id: FAIR-02
principle: Fairness and non-discrimination
applies_to: risk_tier == "high"
requirement: >
Disparate-impact test across protected groups and intersections
before release and after any model, prompt, or data change
owner: technical-owner
reviewer: ai-risk
evidence: signed test report in the model registry
frequency: per release + quarterly
on_failure: block release; open remediation ticket

If there is no owner, evidence artifact, or failure consequence for a requirement, then it is not ready. There is a perfect pairing of system standards and acceptable-use policy for employee AI tools, the beginning of shadow AI.

Risk assessment and classification

The amount of governance that each system receives is determined by classification. Align tiers outside of the scope of the EU AI Act (prohibited, high-risk with full controls, limited-risk with disclosure, and minimal-risk with registration only). ISO 42001 also requires impact assessments for in-scope Systems to be documented.

Use capability AND purpose classification for agents. Questions that help to take a system to a new level:

1. Does it make or inform any decision with regard to employment, credit, insurance, education, or essential services in relation to people?

2. Can it receive input from people or from other systems?

3. What tools, MCP servers, and data sources can it access, and as what?

4. Is it doing personal or regulated data processing?

5. Are there any other third-party components that can change without your release process?

Reconsider if answers change. Emailing a customer is a different system for an assistant to acquire.

Monitoring, auditing, and reporting

The first step to monitoring is an inventory, since if you don't know a system exists, how can you monitor it? IBM discovered that just 34% of organizations that have AI governance policies conduct regular audits to check for unsanctioned AI. Akto's solution is agilely identifying AI agents, MCP servers, LLMs, agent skills, and coding assistants across endpoints and cloud, as well as mapping agents to the models and sensitive data they access, allowing teams to visualize the blast radius of each agent.

Next, monitor a few key metrics that are linked to the principles: Inventory coverage, percentage of high-risk systems that have current validation and bias tests, percentage of systems that require an override, percentage of systems that had incidents requiring guardrail violations, system drift indicators, and open incidents. Plan internal audits and internal management reviews in accordance with ISO 42001, feed them the same metrics, and audits will demonstrate trends and not recreated evidence.

Cross-functional governance committees

A committee is effective when it has decision-making power. Commonly, these members include legal, privacy, security, ML engineering, compliance, HR for workforce-facing systems, and owners of the highest-risk systems. Authorize it to approve deployments that are considered high-risk, grant exceptions for a limited period of time, and temporarily disable systems that do not comply with controls.

There are two options that will avoid bottlenecks. Route tiered, with minimal-risk systems self-attesting, and high-risk systems going to the full committee. Continue to maintain independent oversight, and that is not part of the teams sending the systems. KPMG's AI governance principles for boards at the board level are about asking the right questions and enhancing oversight while avoiding involvement in the management of the AI.

Challenges in Applying AI Governance Principles

Where principles come into contact with weekly systems, most programs come unstuck:

• There are conflicts of principles: NIST recognizes that there are compromises between accuracy and interpretation, and that fairness testing requires sensitive data that privacy wishes to minimize. If there is no documented resolution method, each team resolves it differently.

• Governance for models, agents, and actions. An agent's risk is not just in the tools, permissions, and runs, as pre-deployment review cannot completely capture that risk.

• Reviews can't keep up with employees changing their behavior with AI tools and/or skills.

• Hosted models update, and approved SaaS products gain new features that could invalidate previously validated models.

• Standards are still being caught up to. One reason for the EU's delay of high-risk deadlines is that harmonized standards were not ready.

• Manual evidence goes stale; programs that produce evidence as a result of runtime controls stay current. Manual evidence becomes stale; the programs that compile it before each audit are out of date.

Final Thoughts on AI Governance Principles

The rule of thumb is quite straightforward: an AI governance principle can only count if it has an owner, has a control, and there is evidence showing the control was executed. Do an inventory, categorize systems according to what they can decide, what they can do, and call it into action at runtime where agents act.

This guide's issues directly align with Akto's AI agent security platform. The first step to accountability and shadow AI is continuous discovery of agents, MCP servers, LLMs, and coding assistants across endpoints and cloud. Automated red teaming with 4,000+ probes in CI/CD is used to test for safety and robustness gaps. The runtime guards prevent unauthorized tool calls and agent loops with human oversight. Agent Traces provide transparency and audit evidence, reconstructing all prompts, tool calls, and guardrail decisions.

To see how these controls put your AI governance principles into practice, book a Agentic Security demo with Akto.

FAQs on AI Governance Principles

Which global frameworks define AI governance principles (e.g., NIST, ISO, EU AI Act)?

In addition to NIST AI RMF, ISO/IEC 42001, the EU AI Act, and the OECD AI Principles, internal enterprise programs frequently cite the UNESCO Recommendation on the Ethics of AI and IEEE 7000, which embeds ethics into the design of the system from the outset. They complement each other: many organizations are aligned with OECD, they assess risk using NIST, they get certified using ISO 42001, and they fulfill EU obligations if applicable.

What role does human oversight play in AI governance?

There are 3 common ways of oversight. Human-in-the-loop: human beings are involved in all decision-making steps. Human-on-the-loop means having someone watch and be able to intervene at any time. Human-in-command refers to the situation where humans have control over the use of the system, either in using it at all, or in how they use it. Select per system depending on risk level and the possibility of undoing actions.