A generic AI policy is a weak starting point. It may explain what the company believes, but it does not tell anyone which AI systems are in use, who approved them, what data they process, or what happens when a model fails.
A generic AI policy is a weak starting point.
It may explain what the company believes, but it does not tell anyone which AI systems are in use, who approved them, what data they process, or what happens when a model fails.
AI governance and compliance readiness begins with those operational questions. Organizations need a current AI inventory, named owners, repeatable risk assessments, documented controls, and evidence that those controls work.
This guide covers the core pieces of that program, including an AI governance framework step by step, an ISO 42001 implementation guide, an ISO 42001 gap assessment, an agentic AI risk assessment framework, an AI model risk assessment template, and an EU AI Act compliance checklist.
AI governance and compliance readiness is the ability to show how AI systems are approved, assessed, controlled, monitored, and reviewed.
A company is ready when it can answer questions such as:
ISO/IEC 42001 provides requirements for an Artificial Intelligence Management System, while the NIST AI Risk Management Framework organizes AI risk work around Govern, Map, Measure, and Manage.
Those frameworks are useful, but neither replaces system-level evidence. A policy document alone will not show whether a high-risk model has been validated, whether access controls are enforced, or whether a third-party AI provider has been reviewed.
A useful AI governance framework step by step starts with the systems already being used. It should not begin with abstract principles that cannot be tied to a model, owner, or business process.
The inventory should capture every AI system the organization develops, purchases, configures, or uses through a third party.
That includes embedded AI features inside SaaS applications. These systems are often missed because the business did not build them directly.
For each system, record its purpose, owner, model provider, users, data sources, connected applications, deployment location, lifecycle stage, and applicable jurisdictions.
This inventory becomes the reference point for every later AI risk assessment.
Every AI system needs a business owner and a technical owner. Higher-risk systems may also require a model owner, data owner, security reviewer, privacy reviewer, independent validator, and residual-risk approver.
The ownership model should make authority explicit.
Who can approve deployment? Who can suspend the system? Who accepts the remaining risk? Who decides whether a model change is material?
If those decisions depend on an informal meeting or an email chain, the governance process is not mature enough.
Classification determines how much review a system needs.
A writing assistant used for internal drafts does not carry the same risk as a model used in recruitment, credit, insurance, healthcare, or regulatory reporting.
Useful classification factors include the system’s business importance, data sensitivity, degree of automation, impact on individuals, external exposure, agent capabilities, and ability to execute actions.
The EU AI Act uses a risk-based structure that distinguishes prohibited uses, high-risk systems, transparency obligations, and lower-risk use cases.
Each system should undergo an AI risk assessment before deployment and after material changes.
The assessment should cover data and AI security, privacy, data quality, accuracy, bias, human oversight, third-party dependencies, operational resilience, model drift, and legal impact.
A useful risk statement is specific: A defined weakness affects a named system, creates a measurable outcome, and exposes a particular group, process, or dataset.
Controls should then address that risk directly. Examples include role-based access, model validation, dataset approval, human approval, logging, output review, supplier assessment, and change control.
“Use AI responsibly” is not a control.
AI compliance depends on evidence that can survive an internal review, customer assessment, or audit.
That evidence may include approved policies, inventory records, test results, risk assessments, data lineage, supplier reviews, approval decisions, incident records, model cards, and management-review minutes.
The final part of an AI governance framework step by step is ongoing review. Performance drift, new integrations, user complaints, unexpected outputs, model changes, and regulatory changes should all be treated as reassessment triggers. Many organizations track this progress against an AI governance maturity model, which shows how controls evolve from ad hoc practices to a fully managed program over time.
An ISO 42001 implementation guide should translate the standard into an operating management system.
The aim is not to create a large set of documents that no one uses. The aim is to establish a repeatable method for approving AI systems, assessing risk, selecting controls, monitoring performance, and correcting problems.
The scope of the Artificial Intelligence Management System should identify the business units, AI systems, services, locations, legal entities, development activities, and third-party systems included.
A narrow scope may make the first ISO 42001 implementation easier to manage. It should not exclude systems that create material AI risk simply because they are difficult to assess.
The organization should document the laws, contracts, customer expectations, technology dependencies, stakeholders, and existing management systems that affect AI governance.
The AI policy then sets the decision principles. Objectives make those principles measurable.
Useful objectives may include inventory coverage, risk-assessment completion, supplier-review coverage, validation frequency, incident-response time, training completion, or closure of audit findings.
The organization needs one documented method for scoring AI risk.
That method should explain how risks are identified, which impact categories are used, how likelihood and severity are assessed, how controls are evaluated, and who accepts residual risk.
Teams can use different technical tests, but they should not use entirely different definitions of acceptable risk.
ISO/IEC 42001 Annex A contains reference controls, while Annex B provides implementation guidance.
The organization should document which controls apply, which do not, why each decision was made, who owns implementation, and what evidence proves the control is operating.
This record may form part of the Statement of Applicability.
An internal audit should test whether the AI management system conforms to the selected requirements and operates as documented.
Management review should examine open risks, audit findings, incidents, control performance, regulatory changes, resource needs, and corrective actions.
Where certification is the goal, the ISO 42001 implementation guide should end with evidence review, internal audit, management review, and closure of significant gaps before the external audit.
ISO develops the standard. Independent certification bodies issue certifications.
An EU AI Act compliance checklist should begin with the organization’s role and the intended use of the system.
The Act places different obligations on providers, deployers, importers, distributors, product manufacturers, and providers of general-purpose AI models.
That role affects the required evidence.
Document whether the software meets the Act’s definition of an AI system and identify the organization’s position in the AI value chain.
The same technology may create different obligations for the company that builds it and the company that deploys it.
Determine whether the use is prohibited, high-risk, subject to transparency duties, lower risk, or connected to a general-purpose AI model.
The classification should include written reasoning. A label without supporting analysis is difficult to defend later.
Where the system is high-risk, the review should cover risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, cybersecurity, and resilience.
Articles 8 to 15 of the EU AI Act contain the main requirements for high-risk systems.
Article 27 requires certain deployers of high-risk systems to conduct a Fundamental Rights Impact Assessment.
This may apply to public bodies, private organizations delivering public services, and specified systems used for creditworthiness or life and health insurance risk assessment.
Evidence may include technical documentation, validation results, dataset records, logs, human-oversight procedures, quality-management records, post-market monitoring, and incident reports.
Because implementation is phased, the EU AI Act compliance checklist should always link to the European Commission’s current AI Act information portal rather than relying on a fixed internal deadline list.
An AI model risk assessment template creates a consistent record of the model, its intended use, known limits, controls, and remaining risk.
Assessment area | Information to record |
Model details | Name, version, provider, owner, deployment date |
Intended purpose | Approved outputs, users, decisions, and business process |
Prohibited use | Uses the model must not support |
Data | Training, fine-tuning, validation, retrieval, and input data |
Affected parties | Users, customers, employees, patients, applicants, or the public |
Performance | Accuracy, error rates, subgroup results, and acceptance thresholds |
Validation | Test method, independent review, and approval |
Limitations | Known failure modes and unsupported conditions |
Human oversight | Review, escalation, and override authority |
Security | Access, abuse, prompt injection, leakage, and supply-chain risk |
Monitoring | Drift, incidents, complaints, and control failures |
Residual risk | Remaining risk, approver, and next review date |
The AI model risk assessment template should be completed before deployment and updated after a material change.
It should also separate model limitations from application weaknesses. A model may perform as expected while the application around it has weak access controls, unsafe tool permissions, or poor data handling.
A practical AI compliance checklist should confirm that the organization has:
The checklist itself is not evidence.
Each completed item should point to a policy, approval, assessment, test result, log, review record, or monitoring report.
That distinction matters. A ticked box says the organization believes the control exists. Evidence shows what the control actually did.
Healthcare AI governance should address protected health information, training-data use, clinical impact, patient safety, access controls, and model validation.
The HHS HIPAA Privacy Rule protects medical records and individually identifiable health information. FDA guidance also applies lifecycle risk management to AI-enabled medical device software.
Financial institutions need documented model development, validation, governance, change control, and independent review.
AI use may also create fair-lending, AML, KYC, customer-treatment, and disclosure risks.
The assessment should connect technical model performance with the financial decision or regulatory process the model affects.
Insurance organizations should assess AI used in pricing, underwriting, claims, fraud detection, and customer service.
Relevant issues include model validation, consumer fairness, data governance, explainability, and the effect of algorithmic decisions on policyholders.
AI used in recruitment or workforce decisions should be assessed for discrimination, disability accommodation, transparency, bias-audit requirements, and human review.
The EEOC’s AI and ADA resources address employment-related risks. New York City Local Law 144 may also require bias audits and notices for covered automated employment decision tools.
As an AI governance consulting partner, Folio3 converts governance requirements into an owned control set: named approvers, tested controls, and evidence mapped to each requirement.
Folio3 supports ISO 42001 implementation by defining the AIMS scope, governance structure, AI policy, objectives, risk method, operating procedures, and Statement of Applicability.
Folio3’s ISO 42001 gap assessment reviews organizational context, leadership, planning, AI risk treatment, operations, performance evaluation, internal audit, management review, and continual improvement.
Each finding is tied to a requirement, risk, action, owner, and evidence need.
AIMS development covers policies, roles, risk assessment, impact assessment, AI inventory, risk register, monitoring, and review.
Control implementation addresses AI lifecycle processes, data management, system use, information for interested parties, impact assessment, and third-party relationships.
Folio3 maps governance work to the NIST AI RMF functions:
Folio3 supports role analysis, risk classification, high-risk readiness reviews, transparency requirements, documentation, and fundamental rights impact assessments where applicable.
Folio3's agentic AI risk assessment framework reviews tool permissions, memory, approval gates, external actions, agent-to-agent communication, runtime monitoring, resource limits, and residual risk across AI agent frameworks.
Assessments can be adapted for healthcare, finance, insurance, HR, customer-service systems, internal enterprise AI, AI agents, and general-purpose AI integrations.
A governance and compliance engagement may produce:
These deliverables give leadership, security, legal, compliance, and engineering teams one view of the AI systems, open risks, assigned controls, and next actions.
AI compliance cannot be demonstrated through a policy alone.
Organizations need to show which systems are in use, who owns them, how risk is assessed, which controls apply, and what evidence proves those controls are operating.
Folio3’s AI Governance and Compliance Readiness services combine ISO 42001 implementation, ISO 42001 assessment, NIST AI RMF alignment, AI risk assessment, EU AI Act readiness, and AI model risk assessment within one documented program.
We help organizations identify governance gaps, compliance risks, and control readiness before AI initiatives scale beyond oversight.
Book Your Readiness AssessmentThere is no standard timeline because scope drives the work. The first useful estimate usually comes after the ISO 42001 gap assessment, when the missing controls, documents, owners, and evidence are known.
Start with whatever already exists. That may include an AI inventory, policies, model documentation, risk registers, supplier contracts, approval records, incident logs, test results, or ISO 27001 documents. The assessment should show which gaps are administrative, which affect actual risk control, and which could delay certification readiness.
Usually, yes. Organizations may be able to reuse parts of their document-control process, audit method, management review, corrective-action process, risk governance, and supplier-management structure.
Yes. Support can cover the gap assessment, AIMS scope, policy and objectives, risk methodology, control implementation, Statement of Applicability, internal audit, corrective actions, and management-review preparation.
The certification decision is made by an independent certification body. Folio3 prepares the organization for that review rather than issuing the certificate.
The next output should be a remediation plan, not another broad report.
Each gap should have a risk rating, owner, target date, required evidence, and dependency. Some actions may be completed quickly, such as assigning ownership. Others may require new testing, supplier reviews, technical controls, or formal approval processes.
Folio3 can continue into implementation, internal audit, and pre-certification review.
Yes, provided the framework separates shared controls from framework-specific obligations. One AI inventory, ownership model, risk register, incident process, and monitoring structure can support several requirements. The evidence mapping still needs to be handled carefully because ISO 42001, NIST AI RMF, and the EU AI Act do not ask for the same things.
A single framework reduces duplication. It should not blur legal or certification differences.
The assessment should leave the organization with a documented role analysis, system classification, applicable obligations, evidence gaps, and prioritized actions.
A model assessment focuses on purpose, data, performance, limitations, bias, security, and monitoring. An agentic AI assessment goes further because the system can act. It reviews tool permissions, memory, API access, approval gates, delegated tasks, resource limits, and agent-to-agent communication.
Depending on scope, deliverables may include an AI inventory, governance framework, AI risk register, and AI model risk assessment template. The documents should be usable after the engagement. They should not depend on Folio3’s continued involvement to make sense.
Use both a schedule and event-based triggers. A routine review may happen quarterly or annually, depending on risk. Reassessment should happen sooner when the model changes, a new data source is added, agent permissions expand, the business use changes, a security incident occurs, or a regulator introduces a new requirement.
Note: This article provides operational compliance guidance and is not legal advice. Regulatory obligations should be confirmed with qualified legal counsel.
Explore 100 AI job replacement statistics for 2026, including layoffs, automation risks, exposed roles, and main workforce trends.
Most enterprises get this decision wrong by comparing year-one costs. This guide breaks down the AI build vs buy decision across TCO, data control, talent gaps, and compliance, so you can choose with confidence.
Enterprise AI is no longer a proof-of-concept exercise. This guide covers the use cases across functions and industries that are generating measurable ROI and driving real operational change inside large organizations.
