AI Governance Resources

Regulatory frameworks and standards provide the authoritative guidance for AI governance. They define what organizations need to do to govern AI responsibly and comply with applicable regulations. Understanding the landscape of frameworks is essential for building a governance program that is both comprehensive and defensible.

NIST AI Risk Management Framework (AI RMF) The NIST AI RMF, published in January 2023, is the foundational U.S. resource for AI risk management. It is voluntary but widely adopted as the de facto standard for AI governance. The framework organizes AI risk management around four functions: - Govern: Establish governance structures, accountability, and culture - Map: Identify AI context, use cases, and risks - Measure: Assess, quantify, and track AI risks - Manage: Deploy risk mitigations and monitor effectiveness

The AI RMF is designed to be adaptable — organizations of any size and in any sector can apply it. NIST also publishes a companion AI RMF Playbook with practical implementation guidance.

ISO/IEC 42001:2023 ISO 42001 is the international standard for AI management systems. It provides a certifiable framework for organizations to establish, implement, maintain, and continually improve AI management. The standard follows the Plan-Do-Check-Act cycle and addresses AI policy, planning, support, operation, performance evaluation, and improvement. ISO 42001 certification provides international recognition of governance maturity.

EU Artificial Intelligence Act The EU AI Act, effective in stages from 2024 to 2026, is the most comprehensive AI-specific regulation globally. It establishes a risk-tiered framework: - Unacceptable risk: Prohibited AI practices - High risk: Strict obligations including risk assessment, documentation, and human oversight - Limited risk: Transparency obligations - Minimal risk: No specific obligations

Organizations deploying AI in the EU market must understand which tier their systems fall into and implement corresponding obligations.

HIPAA and Healthcare AI For healthcare organizations, HIPAA Privacy and Security Rules apply to AI tools processing PHI. Key resources include HHS OCR guidance on business associate agreements, the HIPAA Security Rule, and HHS guidance on AI in healthcare. The American Medical Association also publishes AI policy frameworks for healthcare organizations.

SEC Regulations and Financial AI For financial advisory firms, SEC regulations apply to AI tools used in investment advice and client data processing. Key resources include SEC Regulation S-P, SEC guidance on AI in investment advice, and FINRA guidance on AI in financial services.

Policy templates and checklists accelerate governance program development by providing starting points that can be customized to organizational context. They should not be adopted verbatim — every organization has unique risks, regulatory obligations, and operational contexts that require customization.

AI Acceptable Use Policy Template An AI policy template should cover: - Purpose and scope - Acceptable use cases - Prohibited uses - Data handling requirements - Approval workflow - Vendor review requirements - Training requirements - Enforcement and consequences

Customize the template based on organizational industry, data types, AI use cases, and regulatory obligations. Have legal counsel review the customized policy before approval.

AI Risk Assessment Checklist A risk assessment checklist helps ensure consistent evaluation of AI tools: - Data sensitivity classification (PHI, financial, confidential, public) - Vendor security certification status - BAA status (for healthcare) - Data handling practice review - Output criticality assessment - Regulatory exposure evaluation - Integration depth assessment - Risk level determination

Use the checklist for each new AI tool and review it periodically for existing tools.

Vendor Due Diligence Questionnaire A vendor due diligence questionnaire standardizes vendor evaluation: - Security certifications (SOC 2, ISO 27001, HITRUST) - Data handling practices - BAA willingness and status - Subprocessor disclosure - Model transparency - Incident history - Financial stability - Contract terms and conditions

Send the questionnaire to vendors as part of the onboarding process and review responses before approval.

AI Inventory Template An AI inventory template provides the structure for documenting AI tools: - Tool name and description - Department and owner - Use case - Data type processed - Vendor information - BAA status - Approval status - Risk level - Date added and last reviewed - Notes

Use the template to ensure consistent documentation across all AI tools in the organization.

Beyond regulatory frameworks, industry guides and practitioner resources provide practical guidance for implementing AI governance in specific sectors.

Healthcare AI Governance Resources - American Medical Association (AMA) Augmented Intelligence in Health Care: Policy framework and guidance for physicians and healthcare organizations - World Health Organization (WHO) Ethics and Governance of Artificial Intelligence for Health: Global guidance on AI ethics in healthcare - HHS Office for Civil Rights (OCR): HIPAA guidance and enforcement actions related to AI - College of Healthcare Information Management Executives (CHIME): Healthcare IT governance resources

Financial Services AI Governance Resources - SEC guidance on artificial intelligence in investment advice: Regulatory expectations for AI in financial advisory - FINRA guidance on AI and machine learning in securities: Industry self-regulatory guidance - Financial Industry Regulatory Authority (FINRA): Regulatory resources for AI in financial services - Consumer Financial Protection Bureau (CFPB): Consumer protection guidance related to AI

Legal Services AI Governance Resources - American Bar Association (ABA) guidance on AI in legal practice: Professional responsibility guidance - State bar association AI guidance: State-specific rules for AI use in legal practice - International Bar Association (IBA): Global perspective on AI in legal services

General AI Governance Resources - OECD AI Principles: International principles for responsible AI - Partnership on AI: Multi-stakeholder guidance for AI governance - Future of Privacy Forum: AI and privacy guidance - Electronic Frontier Foundation (EFF): Civil liberties perspective on AI

These resources provide practitioner perspectives that complement regulatory frameworks. They are particularly useful for understanding how other organizations in your industry are approaching AI governance challenges.

Organizations should build a curated resource library that supports their governance program. The library should be organized, accessible, and maintained over time.

Resource Selection Criteria Select resources based on: - Relevance to organizational industry and regulatory context - Authority of the source (government, standards body, recognized industry organization) - Currency (is the resource up to date?) - Practical applicability (can the resource be translated into action?) - Comprehensiveness (does the resource cover the topic adequately?)

Library Organization Organize resources by category: - Regulatory frameworks (NIST AI RMF, ISO 42001, EU AI Act) - Industry-specific guidance (HIPAA, SEC, state laws) - Policy templates and checklists - Vendor due diligence tools - Training resources - Industry guides and best practices

Maintain the library in a centralized, accessible location. Assign a resource library owner who is responsible for adding new resources, updating existing ones, and removing outdated materials.

Resource Maintenance AI governance resources evolve rapidly — new frameworks are published, regulations are updated, and industry guidance shifts. Establish a review cadence: - Review regulatory resources quarterly for updates - Review industry guides semi-annually - Review templates and checklists annually - Add new resources as they become available - Remove resources that are outdated or superseded

Integration with Governance Program The resource library should be integrated with the governance program, not just a collection of documents. Use resources to: - Inform policy development - Guide risk assessment processes - Support vendor due diligence - Provide training content - Demonstrate governance maturity to auditors

When auditors ask, What standards do you follow? the resource library provides the answer.

Training and educational resources help build AI literacy across the organization. Governance is only effective if employees understand it, and understanding requires education.

Executive Education Executives and board members need AI governance education that focuses on: - Strategic implications of AI adoption - Regulatory obligations and risk exposure - Governance framework and organizational roles - Board oversight responsibilities - Metrics for monitoring governance effectiveness

Resources include executive briefings, board education programs, and governance frameworks tailored for leadership audiences.

Employee Training Employees who use AI tools need training that covers: - AI policy content and expectations - Data handling requirements - Approved and prohibited use cases - Reporting procedures for incidents and concerns - Practical scenarios and examples

Resources include online training modules, in-person workshops, quick reference guides, and policy acknowledgment systems. Training should be role-specific — different roles need different knowledge.

Technical Staff Education IT, security, and compliance staff need deeper technical education: - AI system architecture and data flows - Security controls for AI tools - Monitoring and audit capabilities - Incident response procedures - Vendor assessment techniques

Resources include technical certifications, vendor training programs, and professional development courses focused on AI governance.

Continuous Learning AI technology and regulations evolve rapidly. Establish a continuous learning program: - Subscribe to regulatory updates from relevant agencies - Monitor industry publications for developments - Attend conferences and webinars on AI governance - Participate in professional associations - Share learnings across the governance committee

Organizations that invest in continuous learning build stronger governance programs over time. Those that treat training as a one-time event fall behind as technology and regulations evolve.

Having resources is not the same as using them effectively. Organizations should establish practices for translating resources into governance action.

Resource Translation Resources provide frameworks and guidance — they do not provide ready-made governance programs. Translate resources into organizational practice by: - Mapping framework requirements to organizational processes - Customizing templates to reflect organizational context - Adapting checklists to organizational risk profile - Integrating regulatory requirements into operational workflows - Using industry guides to inform governance decisions

This translation requires governance expertise — either internal or through external advisors. The resources provide the raw material; translation creates the governance program.

Resource Gap Assessment Periodically assess whether the resource library covers all necessary topics. Common gaps include: - New regulations that have emerged (e.g., state AI laws) - New AI technologies that require governance (e.g., generative AI) - Industry-specific guidance that has been updated - Training materials that have become outdated

Fill gaps by finding or creating new resources. If a necessary resource does not exist, consider creating it — this contributes to the broader governance community and positions the organization as a governance leader.

External Advisors and Consultants For organizations without internal governance expertise, external advisors and consultants can provide: - Framework implementation guidance - Policy development support - Risk assessment facilitation - Vendor due diligence expertise - Training program development - Audit preparation and response

Select advisors based on their experience with your industry, regulatory context, and organizational size. External advisors can accelerate governance program development but should transfer knowledge to internal staff for long-term sustainability.

Community and Peer Learning Engage with the broader AI governance community: - Join professional associations focused on AI governance - Participate in industry working groups - Attend conferences and events - Share experiences with peer organizations (where appropriate) - Contribute to industry guidance and best practices

Community engagement provides access to collective experience that no single organization possesses. It also helps shape the evolution of AI governance standards and practices.