AI Governance Framework: What to Build Your AI Rules On

An AI governance framework is the written base that a firm’s AI rules are built on and checked against. A mid-size firm has three kinds of base to choose from. The first is a published standard or risk framework. The second is the laws and official guidelines already in force where the firm works, while the third is a short set of principles the firm writes itself. They differ in how much the firm writes, what it still decides and who inside the firm runs the result. Before anyone drafts a rule, the firm picks one. Writing the rules themselves is the subject of the use case on setting rules for how staff use AI.

AI Governance Framework: The Base Under a Firm’s AI Rules

Here, the base means the document, or set of documents, that the firm points to when someone asks why a rule exists. The rules themselves sit on top of it, such as which tools staff may use, which data may go in and who approves. Where staff work with no such rules, what can leave the firm is traced in the exposure at each step of one AI request.

Under a published standard or risk framework, the firm takes the shape of its rules and records from an outside document.

With the laws and official guidelines already in force as its base, the firm starts from the duties it already has where it works.

Under a short set of principles the firm writes itself, the firm’s own page comes first. Outside documents come in later, if at all.

These three appear in no particular order. Whichever one the firm picks, the choice does not decide which AI tools staff use. It decides what the rules answer to.

How the Work Divides Between the Three

Each row below sets out what one base puts on the firm. The rows are a Signisys working description, not a summary of any document’s text.

A Published Standard or Risk Framework

This base is a document from a standards body or a national institute, which a firm adopts as the shape for its own rules. This page names two public examples. The first is ISO/IEC 42001, named only. Before the firm relies on it, the compliance lead reads its scope from its official publisher.

The second is NIST’s Artificial Intelligence Risk Management Framework, AI RMF 1.0. It is an AI risk management framework published by the US National Institute of Standards and Technology. In NIST’s own description of its AI framework, the institute calls it “intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic”. NIST also organises the document around four functions, named Govern, Map, Measure and Manage, and states that its actions are not a checklist. For readers who already follow NIST’s cybersecurity framework, a separate article explains how two NIST frameworks fit together for security leads.

This base suits a firm whose clients or partners ask it to show outside evidence of how it governs AI. It also suits a firm whose compliance lead already keeps a management system for another standard. Under this base the compliance lead writes the records before the first rule is used.

The Laws and Official Guidelines Already in Force

Under this base, the firm starts from the duties it already has through data protection law and any sector rules. It then adds the official AI guidance published where it works. As a result, each AI rule traces back to a duty or a piece of guidance.

In India, the legal adviser’s list starts with the Digital Personal Data Protection Act, 2023. India’s AI Governance Guidelines, drafted by a committee that the Ministry of Electronics and Information Technology set up, are guidance for firms rather than law. For the GCC, a firm working in more than one country asks its legal adviser to list, country by country, the data protection law and any official AI guidance that apply. Keeping the data those laws cover safe is its own task, which the use case on protecting confidential records sets out.

This base suits a firm in a regulated sector, or one whose AI use touches personal data at scale. There, the first question from a client or a regulator may be which law a rule meets. The firm sets aside a legal adviser’s time, and the compliance lead rechecks the list when the law changes. How AI laws vary from country to country is set out in the spread of AI regulation across economies.

A Short Set of Principles the Firm Writes Itself

This base is one page, written inside the firm, that says how the firm will and will not use AI. Under each principle sit the rules that put it into practice. For example, a principle might read “a person checks any AI draft before it reaches a client”. Below it come the rules on who checks and how the check is recorded.

Staff can act on a principle that names a rule and an owner. Each principle here carries both.

This base suits a firm early in its AI use, with a few tools and no client asking for outside evidence yet. The managing director can start with one page; the named owner keeps that page honest. Later, a firm that starts here can add a published standard or legal references without throwing the page away. Once a base and its rules exist, a reader can mark how far they are on record in the evidence a firm can open today for each AI tool in use.

What the Firm Gains and Takes On Under Each Base

Each pair below sets what the firm gains under one base beside the work a person takes on for it. The pairs are reasoning, not a ranking.

AI Governance Framework: One Base, the Others as References

In Signisys’ working method, the firm picks one base as the document its rules answer to. After that, it records which parts of the other two it borrows. A firm on its own principles can still trace a data rule to the law. Similarly, a firm on a published standard still meets the law where it works, and a firm on the law can still use a standard’s structure to keep its records.

One base matters for a plain reason. When two documents disagree, staff and the compliance lead need to know which one the firm follows. Naming one AI governance framework as the base settles that question before it comes up.

A short “Borrowed from” line under the chosen base records the rest. For example, it might read: “Base: the laws and official guidelines where we work. Borrowed from: a published risk framework’s four functions, for our records; our own principles page, for the rule on client drafts.” That line is an example of the format, not a template to copy.

A Recruitment Firm Weighs Its AI Governance Framework

Take an invented recruitment firm in India, unconnected to Signisys, that places candidates with employers in India and the GCC. Its consultants use an AI writing assistant for job adverts. They also use an AI feature in their candidate-tracking software to sort applications.

At first, the managing director considers writing a page of principles. A page would be quick to start, and the consultants could read it in a few minutes.

Then the compliance lead raises two points. Sorting applications touches candidates’ personal data in India and in GCC countries. In addition, two GCC employers have asked how candidates are screened.

In the end, the firm chooses the laws and official guidelines as its base. The legal adviser lists the duties country by country. The compliance lead borrows a published risk framework’s structure to keep the records. Its reason is plain: the first question from employers and candidates is which rules the screening meets, and the firm starts from the rules that question is about. Turning that base into staff rules, starting from the AI already in use, follows the order in a five-step plan with an owner and a review date.

The Choice, Signed and Dated

The managing director records the choice in one short note. It names the base, the references borrowed, the person who owns it and the next review date. A review may come sooner, for example if the firm starts using AI on customer or candidate data for the first time, or if a law changes where it works. The note sits with the firm’s AI rules, so that staff can read why each rule exists. Drafting the rules on top of the chosen base is separate work that follows. Signisys can set out the three bases against the firm’s own AI use for the leader who has to choose.

Readers should weigh this page knowing that Signisys provides AI solutions for enterprises and works on clients’ data, analytics and AI projects. The box below books a conversation, not a result.

AI Governance Framework FAQ: Points Leaders Raise