AI governance is not an island

Anyone sitting at the board table today has heard it many times: AI requires governance. That’s true. But the way many organisations go about it misses the point. AI governance is treated as a new, separate discipline, with an AI policy from the IT department, a legal check against the EU AI Act and perhaps an ethics committee. The result is an island alongside existing risk management, while AI risks cut straight through existing processes.

Our position is simple. AI governance is not a new discipline. It is the governance you already know, applied to a technology that changes faster than your controls. Organisations that understand this don’t need to build a new structure. They need to make their existing governance, risk and control framework mature enough to handle AI.

AI is already in your processes, whether you decided so or not

Many executives underestimate how much AI is already running in their organisation. Not just the chatbot that marketing bought, but also the AI functionality that quietly arrived with an update to the ERP package, the CRM system or the accounts payable software. On top of that comes the use nobody approved, such as employees pasting contracts, customer data or draft figures into a public AI tool because it’s faster.

For the CFO and the controller, this is not an abstract risk. When AI is used to match invoices, propose journal entries, prepare forecasts or assess creditworthiness, it directly affects the reliability of financial information. The question “which AI do we actually use, and for what?” is therefore not an IT question but the first step of a risk analysis. Without that inventory, no one can make a credible statement about how it is controlled.

Where it goes wrong in practice

Ownership sits in the wrong place. AI risks are often parked with IT, legal or a specially appointed AI officer. But the risks arise in the business, in the department that deploys a model to make or support decisions. In terms of the Three Lines Model, ownership belongs in the first line. Risk and compliance set frameworks and provide oversight; internal audit provides independent assurance. The principle isn’t new, but with AI it is remarkably often forgotten.

Policy without control. An AI policy stating that employees must use AI “responsibly” is not a control. A mature approach translates policy into concrete controls. Who may put an AI application into use, based on which risk assessment, and with what human review of the output? And how do you establish that the model keeps doing what it is supposed to do? Anyone who works with COSO will recognise the logic: a control without monitoring and evaluation remains an intention.

Compliance as the end goal. The EU AI Act is important and binding. The AI literacy obligation for employees has applied since February 2025, although the Digital Omnibus has softened its wording. The heavier requirements for high-risk systems are being phased in, mostly from December 2027. But organisations that set up AI governance only to comply with the law miss most of their risk profile. Most AI applications in an average organisation fall outside the Act’s high-risk category, yet can still lead to data breaches, wrong decisions, reputational damage or reporting errors. Compliance is a floor, not a strategy.

Accountability without visibility of AI. For boards and supervisors, there is a concrete task here. The Dutch Corporate Governance Code requires the management board to account for the operation of internal risk management. If AI touches a material part of the business, it belongs in that account. A board member doesn’t need technical knowledge of language models, but must be able to ask the right questions. Do we know which AI we use? Who owns the risks? How do we know the controls work?

What a mature approach does involve

Good AI governance doesn’t start with a framework, but with a few down-to-earth questions that controllers and risk managers will immediately recognise:

1. Inventory. Map which AI applications exist, including the AI built into existing software.

2. Classify. Assess for each application its impact on customers, decision-making, financial information and legal obligations.

3. Assign owners. Place ownership in the first line, with a clear role for the second and third lines.

4. Integrate. Include AI risks in the existing risk register, the existing control cycle and the existing reporting to the management board and supervisory board. No parallel system.

5. Keep measuring. AI models change, vendors push updates, legislation evolves. A one-off risk assessment quickly becomes outdated.

   
   

International standards help to do this in a structured way. ISO/IEC 42001 provides a management system for AI that aligns with the familiar Plan-Do-Check-Act cycle and with other ISO management systems many organisations already have. The NIST AI Risk Management Framework is a useful practical guide for identifying, measuring and managing AI risks. But the framework is a tool, not a goal. The value lies in embedding it in your own organisation.

Can you do it yourself?

With AI in particular, dependence on external advisers is risky. The risks change every quarter, not every year, and a governance structure that only works as long as consultants are at the table is not robust. As a board member, you should therefore ask yourself whether, a year from now, your own organisation can independently assess a new AI application, weigh the risks and demonstrate control.

Transferring knowledge, not holding on to it

The Wise Sailor helps organisations set up AI governance as part of their existing governance, risk and control framework, and then take ownership of it themselves. We work from hands-on experience in strategy, governance and control, complemented by risk management, and translate legislation and standards such as the EU AI Act, ISO/IEC 42001 and the NIST AI RMF into workable agreements and controls.

We do this through fractional consulting, in-company training, masterclasses and e-learning. Our starting point is that, once we’re done, you no longer need us for day-to-day execution. Your own people should have the knowledge in-house to use AI responsibly, test it and adjust course.

Ready for the next step?

Want to know how mature your organisation is in controlling AI, or want to prepare your board, business and operations properly? Feel free to get in touch, we’re happy to think along with you.