Is AI governance the same as AI ethics?

No, though they overlap. Ethics asks whether a use is right. Governance asks whether anybody could tell you what is being used, under what rule, and who decided. An organization can have thoughtful views on the first and no ability to answer the second, and the second is what a customer questionnaire or an audit asks about.

Do we need AI governance if we only use off-the-shelf tools?

The questions are the same and some of the answers are easier. You are not assessing a model you trained, but you still need to know which tools are in use, what data may go into them, what each vendor retains, and who decided any of that. Buying instead of building moves the work from model documentation to inventory and vendor questions. It does not remove it.

Who should own AI governance?

A named individual who knows they hold it. Naming a function instead, such as IT or Legal, is the most common answer and it is not an owner, because a team cannot be asked a question or held to the answer. In a small company this is usually the founder, and writing that down is worth doing even when it is obvious.

Where do you start if none of this exists?

With the list, because everything else is a claim about a set of tools. A policy written before you know what is in use governs the tools you thought of. Once the list exists, the rule and the owner are decisions you can make in an afternoon, and the harder artifacts have something to attach to.

What is AI governance?

AI governance is the arrangement that lets an organization answer for the AI it uses. In practice it comes down to three things: a list of what is actually in use, a written rule for what it may and may not be used for, and a named person accountable for each decision the technology takes part in. Everything else in the field, from risk registers to model cards to vendor registers, is built on those three and is worth very little without them.

Why the definition is short

Most descriptions of AI governance are long because they are describing a mature program. That is a useful picture of the destination and a poor guide to where you are, because it makes an organization with two of the three basics look identical to one with none.

The three-part version is short enough to check against yourself in a minute, and the recognized frameworks are built on top of all three. The NIST AI RMF's MAP function asks you to characterize the AI systems in scope, which presupposes a list of them. ISO/IEC 42001 asks for an AI policy kept as documented information, which presupposes it is written. The obligations arrive later. The substrate comes first.

Governance is not the same as compliance

Compliance is measured against a named instrument. Somebody picks a framework or a regulation, and the question becomes whether you meet what it asks for. Change the instrument and the answer changes, which is why a compliance answer is only ever useful once you know which instrument you are being held to.

Governance is what is true regardless. An organization can be short of ISO 42001 and still able to say what AI it runs, under what rule, owned by whom. It cannot be strong on any framework while unable to say those things. So the governance question is the one worth answering first, and it is the only one you can answer before anybody has told you which standard applies.

The practical difference shows up in what each is good for. A compliance answer prepares you for a specific audit. A governance answer tells you whether an audit of any kind would find something to look at.

What good looks like at different sizes

Good governance in a company of six is not a smaller version of good governance in a company of six thousand. There is nobody independent of the people building and using AI, so an independent review is not a thing that can happen, and demanding one produces a policy that says something untrue about how decisions are made.

What does not change with size is the three preconditions, and at the small end they carry more weight, not less. A large organization with a patchy inventory is partly covered by procurement, a security function and a joiners process that between them know what is in use. A company of six has the list or it has nothing.

Common questions

Is AI governance the same as AI ethics?: No, though they overlap. Ethics asks whether a use is right. Governance asks whether anybody could tell you what is being used, under what rule, and who decided. An organization can have thoughtful views on the first and no ability to answer the second, and the second is what a customer questionnaire or an audit asks about.
Do we need AI governance if we only use off-the-shelf tools?: The questions are the same and some of the answers are easier. You are not assessing a model you trained, but you still need to know which tools are in use, what data may go into them, what each vendor retains, and who decided any of that. Buying instead of building moves the work from model documentation to inventory and vendor questions. It does not remove it.
Who should own AI governance?: A named individual who knows they hold it. Naming a function instead, such as IT or Legal, is the most common answer and it is not an owner, because a team cannot be asked a question or held to the answer. In a small company this is usually the founder, and writing that down is worth doing even when it is obvious.
Where do you start if none of this exists?: With the list, because everything else is a claim about a set of tools. A policy written before you know what is in use governs the tools you thought of. Once the list exists, the rule and the owner are decisions you can make in an afternoon, and the harder artifacts have something to attach to.

Find out where you stand

The assessment on this site asks 22 questions about what AI is in use, what rule governs it and who is accountable, and returns a score, a verdict and, where a control is short, the one thing to fix first. It names no framework, and it takes about ten minutes.

It is a self-assessment of what you could show today, not an audit, not a certification, not a conformity assessment and not legal advice.

Run the assessment