AI governance explained

AI governance is the web of laws, standards, institutions and norms that decide how AI may be built and used, and who is answerable when it goes wrong. This article maps the main instruments and actors and shows what they mean for a school, a hospital or a city office.

Four layers, not one rulebook

Governance is often pictured as a single law. In practice it works through several layers that reinforce one another, and a gap in one is usually filled, well or badly, by another.

• Binding law: obligations backed by enforcement, such as the EU AI Act or data protection law.
• Standards and frameworks: shared methods that translate legal duties into testable practice.
• Institutions: regulators, oversight bodies and courts that interpret, supervise and enforce.
• Norms: professional ethics, internal policies and public expectations that shape behavior before any inspector arrives.

Binding law: the EU AI Act and its neighbors

The EU AI Act, Regulation (EU) 2024/1689, in force since 1 August 2024, is the first comprehensive binding law on AI and applies in stages according to risk. A small set of practices has been prohibited since 2 February 2025, and providers of general-purpose AI models have had their own obligations since 2 August 2025. Systems used for listed purposes in areas such as employment, education, credit scoring, public benefits and law enforcement are high-risk and must meet requirements on risk management, data quality, documentation, human oversight and robustness. Those requirements were due from 2 August 2026, and from 2 August 2027 for high-risk AI in products already covered by EU product legislation, such as medical devices; in July 2026 an amending regulation, the digital omnibus on AI (Regulation (EU) 2026/1744), postponed them to 2 December 2027 and 2 August 2028 respectively.

GDPR Article 22 adds the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, with exceptions and safeguards such as human intervention. Beyond the EU, the Council of Europe Framework Convention on AI, opened for signature in September 2024, is the first legally binding international treaty on AI, committing the states that ratify it to protect human rights, democracy and the rule of law.

Standards: turning obligations into evidence

Laws mostly state outcomes, not methods; standards translate a duty such as risk management into tests, records and evidence. ISO/IEC 42001 (2023) is a management system standard for AI: an organization defines policies, assigns roles, assesses risks and keeps improving. The NIST AI Risk Management Framework 1.0 (January 2023) is a voluntary US framework built around four functions: govern, map, measure and manage. In the EU, harmonized standards requested by the Commission give providers a presumption of conformity once published in the Official Journal, and the General-Purpose AI Code of Practice (2025), facilitated by the EU AI Office, offers model providers a comparable route to showing compliance.

Detecting bias in a hiring or credit model, for example, usually requires sensitive attributes such as ethnicity or health status. Article 4a of the AI Act, added in 2026, allows such data to be processed for bias detection and correction only under safeguards and only where synthetic or anonymized data would not do the job. The Foundation’s technical report on bias detection under Article 4a of the EU AI Act examines when synthetic, anonymized or differentially private data is enough, and where it falls short.

Institutions: who interprets, supervises and enforces

In the EU, the AI Office within the European Commission supervises general-purpose AI models and coordinates implementation; national market surveillance authorities oversee high-risk systems; notified bodies check certain high-risk systems before market entry; data protection authorities enforce the GDPR; courts decide contested cases.

International institutions mostly coordinate rather than enforce. The OECD AI Principles (2019, updated 2024) were the first intergovernmental standard on AI, and the UNESCO Recommendation on the Ethics of AI (2021) broadened that consensus. The AI summits at Bletchley Park (2023) and Seoul (2024) brought governments and developers together around frontier model risks, and several countries set up AI safety institutes. The AI Action Summit in Paris (2025) then shifted the emphasis to inclusive and sustainable AI. None of them can fine a company; they work through commitments, peer pressure and technical groundwork that can later feed into law.

The trade-offs no framework escapes

Every design balances competing goods. Detailed rules give certainty but age quickly; broad principles adapt but leave organizations guessing. Pre-market checks catch problems early but cost time and tend to favor larger firms; liability after harm is cheaper up front but repairs damage late. Under the AI Act most obligations fall on providers, yet deployers must still use a system as instructed, assign human oversight to trained staff and monitor it in use, often with small teams.

A city office using a scoring tool to rank social benefit applications operates in an area the AI Act treats as high-risk; if decisions are made without meaningful human involvement, GDPR Article 22 applies already. A hospital buying diagnostic software that is itself a medical device, or built into one, faces the longer transition to 2028, because the device is already subject to EU product rules. A school adopting an AI tutoring service is usually a deployer, not a provider, which changes its duties and what it should ask its supplier.

What to take from this

For anyone who buys, builds or oversees an AI system, governance largely comes down to three things.

• Role: whether the organization is a provider, a deployer, or both.
• Risk category: which one applies, and which obligations follow from it.
• Evidence: what it could show tomorrow to prove the system works as claimed.

Writing those answers down and revisiting them as the rules change is a habit any organization can start now. The Foundation studies how the EU AI Act works in practice and what technical evidence it asks of providers, and publishes its findings in Research & Insights.

In short

AI governance is the web of laws, standards, institutions and norms that decide how AI may be built and used, and who is answerable when it goes wrong. It works through four layers: binding law such as the EU AI Act, standards and frameworks, institutions such as regulators and courts, and norms such as professional ethics and internal policies.

Frequently asked questions

What is the EU AI Act and when does it apply?

The EU AI Act, Regulation (EU) 2024/1689, is the first comprehensive binding law on AI and has been in force since 1 August 2024. It applies in stages according to risk. A small set of practices has been prohibited since 2 February 2025, and providers of general-purpose AI models have had their own obligations since 2 August 2025.

Has the EU postponed the high-risk requirements of the AI Act?

Yes. The high-risk requirements were due from 2 August 2026, and from 2 August 2027 for high-risk AI in products already covered by EU product legislation, such as medical devices. In July 2026 the digital omnibus on AI (Regulation (EU) 2026/1744) postponed them to 2 December 2027 and 2 August 2028 respectively.

What is the difference between ISO/IEC 42001 and the NIST AI Risk Management Framework?

ISO/IEC 42001 (2023) is a management system standard for AI, in which an organization defines policies, assigns roles, assesses risks and keeps improving. The NIST AI Risk Management Framework 1.0 (January 2023) is a voluntary US framework built around four functions: govern, map, measure and manage.

Who enforces AI rules in the EU?

In the EU, the AI Office within the European Commission supervises general-purpose AI models and coordinates implementation. National market surveillance authorities oversee high-risk systems, notified bodies check certain high-risk systems before market entry, data protection authorities enforce the GDPR, and courts decide contested cases.

Is a school that uses an AI tutoring service a provider or a deployer?

A school adopting an AI tutoring service is usually a deployer, not a provider, which changes its duties and what it should ask its supplier. Under the AI Act most obligations fall on providers, yet deployers must still use a system as instructed, assign human oversight to trained staff and monitor it in use.

How to cite LASTHUMAN Foundation. (2026, August 12). AI governance explained. https://lasthuman.today/insights/ai-governance-explained.html