AI governance framework
The structure that ties together the law that binds you, any standard you follow and your own policy. A framework is an organising structure, not a product.
An AI governance framework is the structure an organisation uses to govern its AI: who decides what, which rules apply, how AI risks are managed, and how it stays current. It is a structure, not software you buy.
Search results for this term are mostly platforms selling themselves as "a framework". The honest position is different: a framework is the way you organise your AI governance, and it can be built from decisions and records you already hold.
What is an AI governance framework?
It is the organising structure for governing AI across an organisation: who is accountable, which rules apply, how AI risks are identified and managed, and how the whole thing is reviewed. It is what connects the separate pieces, so a decision made in one place is consistent with the rest.
The key word is structure. A framework is not a single document or a product; it is the arrangement that holds your AI decisions together and keeps them current.
What does a framework contain?
At a minimum: a live list of the AI systems you run and who owns each, a way to manage the risks they carry, a policy that sets the rules for staff, and a review cycle that keeps it all current. Around those sit the roles and accountabilities that say who decides what.
Established structures can inform it. ISO/IEC 42001 offers a management-system shape, and the the NIST Generative AI Profile offers governance and incident-handling structure for generative AI. You can borrow from them without adopting either wholesale. Generative systems need controls of their own, and the generative AI governance guide covers what changes when the output is new every time.
How does it relate to ISO 42001 and the EU AI Act?
They fit inside it. The EU AI Act is a binding law that a framework has to account for where it reaches you; ISO 42001 is a management system standard your framework can be built on or certified against; and your AI policy is the framework's staff-facing output. A framework is where the three meet.
Keeping them straight matters: certifying to the standard is not compliance with the Act, as the standard-versus-Act guide sets out, so a framework holds each in its right place rather than treating one as a substitute for another.
How is a framework different from a policy?
A policy states rules; a framework is the structure those rules sit inside. The policy is one output, alongside the systems inventory, the risk approach, the roles and the review cycle. Writing a policy without the rest is common, and it is why a policy on its own often does not hold.
The what-to-include guide covers the policy itself; the framework is what keeps that policy consistent with the law and the standard, and current as your AI use changes.
How do you build one without buying software?
Start from what you have. List your AI systems and name an owner for each; decide how you will manage their risks; write the policy; set the review cycle; and record who is accountable for the whole. That is a framework, and none of it requires a platform.
The three checks on this site each produce part of it: the EU AI Act check for what binds you, the readiness check for the management system, and the policy generator for the written rules. Software can help you keep a framework; it is not the framework.