Governance is the system around the policy. Here are five elements, what the 2026 EU and South African rules mean, and a 90-day starting plan.
TL;DR
Governance sounds like a large-organisation word, and it is easy to assume it needs a committee and a consultant. For a mid-sized business it needs less than that: one accountable person, a list of what is in use, and a clear way to decide what happens next.
This guide explains what AI governance covers, what rules apply in 2026, and a five-element framework with a 90-day starting plan.
A community article on the European Commission's Futurium platform describes AI governance as having three components: a strategy and vision that sets goals, a policy that sets rules, and a governance system that turns those rules into processes, such as a central registry of AI use cases. Most organisations stop at the policy. Our guide to writing an AI policy covers that part. This guide covers the system around it.
ISACA's 2026 AI Pulse Poll of more than 3,400 digital trust professionals found that 90% believe employees use AI at work. Only 38% report a formal, comprehensive AI policy, 30% a limited one, and 25% none.
Kiteworks' summary of IBM's 2026 breach research points the same way for organisations that had suffered a breach: 32% had AI policies, down from 37% a year earlier, and 19% coordinated between AI governance and security teams. That is a vendor's summary of a sample of breached organisations, so treat it as indicative.
The EU AI Act. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026. According to the Cloud Security Alliance's analysis, it moves the deadline for standalone high-risk systems from 2 August 2026 to 2 December 2027, and for AI embedded in products under EU safety law to 2 August 2028. It was not a blanket delay. The same analysis says the transparency duties in Article 50 still applied from 2 August 2026, and the prohibited-practices rules and general-purpose model obligations continue as before. The regulation also softens the AI literacy duty in Article 4 to taking measures that support staff AI literacy. The Act can reach organisations outside the EU whose AI systems or outputs are used there, so take legal advice on whether it applies to you.
South Africa. The country has no national AI policy in force. The Information Regulator's chairperson told ITWeb in September 2026 that without one it is "a free for all", with organisations writing their own policies if they have them at all. The Cabinet-approved draft was withdrawn in April after News24 found it cited sources that do not exist. CNBC Africa reports that at least six of its 67 references were fabricated, and the Minister said vigilant human oversight of AI is critical. The lesson applies to any organisation: a policy about AI was undone by unverified AI output. In the meantime, POPIA, enforced by the Information Regulator, is the main binding law that applies to personal information processed by AI.
Frameworks. Two voluntary frameworks help structure the work. The NIST AI Risk Management Framework, released in January 2023, is voluntary, and NIST says it is being revised. ISO/IEC 42001 is a management system standard for establishing and maintaining an AI management system. I could read only a search summary of ISO's page, so check the standard itself before committing to certification.
Add one standard across all tiers: a named person checks and owns any AI output before it leaves the organisation or informs a decision.
Governance that is slow or vague pushes people towards unapproved tools. Gallup's research associates clear strategy and responsible-use guidelines with higher AI use, which suggests good governance supports AI adoption when it is quick and clear. Aim for fast yeses where the risk is low, and careful reviews where it is high.
Governance and risk is one of five dimensions in our AI Readiness Diagnostic, which is free to take and scores strategy, data, people, process, and tooling alongside it.
AI governance is the set of roles, rules, and processes that decide how AI is approved, used, monitored, and reviewed in an organisation. A policy is part of it, alongside ownership, an inventory, and a review rhythm.
A policy sets the rules. Governance is the system that applies them: who owns decisions, how new tools are approved, and how you check the rules are followed.
Not necessarily. It is a management system standard, and adopting it is a choice. Consider it if clients or regulators ask for evidence of a structured AI management system.
It can, where your AI systems or their outputs are used in the EU. The rules differ by role and risk level, so ask your legal counsel to assess your position.
One senior executive with authority across functions, supported by a small group from legal, IT or security, HR, and the business. Mid-sized organisations without that capacity can bring in outside leadership.
Ready to move from reading about AI to getting your organisation ready for it? Start with the diagnostic.
Take the AI Readiness Diagnostic