How to build an AI governance framework: five layers, and the standards underneath

This is general information and does not constitute legal advice for any jurisdiction.

Our view is that an organisation does not need to invent its AI governance from nothing. The published frameworks agree on most of the parts, two international standards supply most of the structure, and in many organisations legal and privacy teams already hold much of the work. We tested that view against the main frameworks and standards, from NIST and ISO/IEC 42001 to the EU, Singapore, Australia, ASEAN, Thailand, Hong Kong and South Korea, and against the surveys on who owns AI governance in practice.

Our earlier article, AI governance basics for legal teams, covers what a legal team should settle before it uses an AI tool on its own work. This one covers the next level up: how an organisation governs AI across every team, and how the published standards fit together.

What questions does a framework answer?

A framework answers five questions, and each layer below answers one of them. Organisations draw their frameworks differently, but many settle on layers like these.

Exhibit 1

An AI governance framework in five layers

Our synthesis of the frameworks and standards cited below.

What is it for?Use AI widely, with the risks known and controlledValue from AI, trust from clients and regulators, readiness for new rules

Who decides?A named owner and a small decision groupLegal, privacy, security, IT and the business, with authority to approve, pause or stop a use

What path does every AI use follow?

1. Register
2. Assess
3. Approve
4. Launch
5. Watch
6. Change or retire

Which controls apply?

• Ownership and policyWho answers for each use; a short policy on acceptable use
• Data and securityWhat data may go in; access limits; vendor data terms
• Human checksWhere a person must review; fairness and transparency
• Risk tiersProhibited, high, standard and low; unapproved tools found and dealt with
• Law and recordsPrivacy law, IP, sector rules; logs and audit
• People and incidentsTraining by role; how to report and handle a failure

What does it build on?

• NIST AI Risk Management Framework
• ISO/IEC 42001
• Local law and guidance

Layers and wording are ours. The building blocks appear across the NIST, ISO, EU, Singapore, Australian and ASEAN sources listed below.

What do the published frameworks share?

The published frameworks use different words for much the same set of parts. Each part below appears in several of them.

• A named owner. NIST's framework starts with a "Govern" function that assigns roles [1]. Australia's guidance starts with "decide who is accountable" [6].
• A register of AI in use. Australia's guidance includes a template for one [6]. Without a list, nothing else in the framework can be applied.
• Risk tiers. The EU AI Act bans some uses, sets heavier duties for high-risk ones and lighter ones for the rest [3]. Singapore's framework for AI agents asks organisations to set limits first, based on what an agent can do and whether its actions can be undone [4].
• Human checks. Organisations using high-risk systems under the EU AI Act must give oversight to people with the competence, training and authority to do it [3]. Australia's sixth practice is to maintain human control [6]. Lawyers already do this when they review a junior's draft before it goes out.
• Approval for a specific use. An approval covers the use it describes and nothing more, much as a letter of engagement covers the matter it names. A tool approved after a security review has not been tested for legal research, and one tested on summaries has not been tested for choosing authorities. Record what each approval covers: the task, the data allowed, the checks a person must make, and what was tested. When the model, the data or the task changes, test again before relying on the approval. In one study, a model's accuracy on an unchanged task fell by more than 30 percentage points between two versions released three months apart [14].
• Vendor review, monitoring and incident handling. Each of NIST, ISO/IEC 42001 and the EU AI Act covers these in some form [1][2][3].
• Training. Since 27 July 2026, the EU AI Act asks organisations within its reach to take measures to support AI literacy among their staff [3].

Which standards should it build on?

Two international standards provide most of the structure, and local law and guidance add the rest. Lawyers work this way with precedents: start from a tested form, then adapt it to the jurisdiction.

Exhibit 2

The main frameworks differ mostly in whether they bind you

Selected frameworks and standards, status as of October 2026.

Framework	From	Status	How it is organised
AI Risk Management Framework, with a generative AI profile	NIST, United States (2023, 2024)	Voluntary	Four functions: govern, map, measure, manage
ISO/IEC 42001	ISO and IEC (2023)	Certifiable	A management system, audited like ISO 27001 for security
AI Act	European Union (2024, amended 2026)	Binding	Duties scaled by risk; reaches organisations outside the EU whose AI output is used in the EU
Model AI Governance Frameworks, including generative AI (2024) and AI agents (2026)	IMDA, Singapore	Voluntary	Accountability, human involvement, testing, security and more
Guidance for AI Adoption	National AI Centre, Australia (2025)	Voluntary	Six practices, with policy and register templates
Guide on AI Governance and Ethics, expanded for generative AI	ASEAN (2024, 2025)	Voluntary	Nine recommendations, mirroring Singapore's
AI governance guidelines; draft AI Act	ETDA, Thailand (2023, 2024; draft 2026)	Voluntary; law in draft	Structure, strategy, operation; the draft Act is risk-based
Model Personal Data Protection Framework for AI	Privacy Commissioner, Hong Kong (2024)	Voluntary	Governance, risk assessment, implementation, communication
AI Basic Act	South Korea (in force January 2026)	Binding	Duties for high-impact AI; a grace period on fines

Sources: [1] to [10].

Most of the regional guides follow the same parts as NIST or ISO/IEC 42001, so an organisation that builds on one of the two can usually show how it meets the local guidance as well [6][7]. ISO/IEC 42001 is the one to choose if the organisation wants an external certificate. Certification under it does not by itself show compliance with the EU AI Act.

Dates under the EU AI Act have moved. An amending regulation in force since 27 July 2026 put back the main obligations for high-risk systems listed in Annex III to 2 December 2027, and for high-risk systems built into regulated products to 2 August 2028 [3]. Check current dates before relying on them.

Who usually owns it?

In many organisations, AI governance is led by privacy and legal teams rather than IT.

Exhibit 3

Privacy and legal teams lead AI governance more often than IT

Function with primary responsibility for AI governance, share of organisations, %.

• Privacy22%
• Legal and compliance22%
• IT17%
• Data governance10%
• Ethics and compliance6%
• Security5%

671 respondents in 45 countries, surveyed in 2024. Source: IAPP and Credo AI [11].

The last figure is the gap a framework closes. Legal teams are often asked to own AI risk without the authority to approve or stop a use. A clear decision layer puts that authority where the responsibility sits.

Where the skeptics are right

Some caution about governance frameworks is sound. In our view, a framework that sends every use through full review slows the low-risk work as much as the high-risk work, and people then go around it with tools they buy themselves. That is why the risk tiers include a light path for low-risk uses.

The evidence also has limits we want to state plainly. We found no reliable recent figure for how many organisations have a governance committee, a complete register of their AI or a risk-tiering process. Several widely shared figures on these points have no traceable source. The survey figures above are self-reported, and the IAPP figures are from 2024. Some primary texts, including the official text of the 2026 EU amending regulation, could not be opened when this article was written, so the dates come from the European Commission and published legal commentary.

What we'd ask

If you lead a legal team or own AI governance in your organisation, start with three steps:

1. Name an owner and list what is in useOne accountable person or a small group, a one-page policy, and a register of the AI tools already in use, including the ones staff bought themselves.
2. Sort uses by riskA few intake questions that send low-risk uses (drafting help with no client data) down a light path and keep full review for the rest.
3. Build on a standard, and train peopleMap the framework to NIST or ISO/IEC 42001, and give each role the training it needs to use AI well.

The framework then grows as uses do. Most organisations do not need every layer in full on the first day.

If you work in a legal team:

• Before you rely on an approved tool, check what the approval covers: the task, the data allowed and the checks you must make. If the model, the data or the task has changed, ask for it to be tested again.
• Check the current EU AI Act dates before you advise on them. They have moved before.
• Offer to help build the register, the policy and the intake questions. That work is legal work, and it gives you a say in how your organisation uses AI.

Why we built the course

A framework sets the rules for using AI, and the people who write it decide what the rules cover. We built AI Women in Law so that more of those people are women lawyers who have used the tools themselves. Over five weeks, participants redesign one piece of their team's work and build a first version of a tool for it. See the course.

References

1. NIST, AI Risk Management Framework 1.0 (NIST AI 100-1), 26 January 2023, and Generative AI Profile (NIST AI 600-1), 26 July 2024.
2. ISO/IEC 42001:2023, Information technology: Artificial intelligence: Management system, December 2023. Summary read at the Standards Council of Canada catalogue and related catalogue entries.
3. Regulation (EU) 2024/1689 (AI Act), as amended by Regulation (EU) 2026/1744. Article 26 read at artificialintelligenceact.eu; amendments summarised at nicfab.eu; European Commission, AI Act: regulatory framework for AI.
4. IMDA, Model AI Governance Framework for Agentic AI, version 1.5, 20 May 2026.
5. IMDA and AI Verify Foundation, Model AI Governance Framework for Generative AI, 2024; Model AI Governance Framework, second edition, 2020.
6. National AI Centre, Department of Industry, Science and Resources (Australia), Guidance for AI Adoption, 21 October 2025.
7. ASEAN, Expanded ASEAN Guide on AI Governance and Ethics: Generative AI, January 2025.
8. ETDA (Thailand), AI Governance Guideline for Executives (2023) and Generative AI Governance Guideline for Organisations (30 October 2024); draft Act on Artificial Intelligence, public hearing July 2026, summarised at tilleke.com.
9. Office of the Privacy Commissioner for Personal Data (Hong Kong), Artificial Intelligence: Model Personal Data Protection Framework, 11 June 2024.
10. US International Trade Administration, South Korea AI Basic Act, 29 May 2026.
11. IAPP and Credo AI, AI Governance Profession Report 2025, 16 April 2025. 671 respondents in 45 countries.
12. Deloitte AI Institute, State of AI in the Enterprise, 2026 edition. 3,235 leaders in 24 countries.
13. ACC, The In-house Legal AI Landscape: Adoption, Governance, and the Future of Legal Talent, 2026. 576 respondents. Reported by Lexpert, 1 October 2026.
14. Chen, Zaharia and Zou, How is ChatGPT's behavior changing over time?, 2023.