How do you implement an AI governance framework?
By Nick Jang, founder of MINERVA Studio ·
The short answer
Pick one framework to anchor on, then put six things in place in this order: an accountable owner, an inventory of every AI system including vendor tools, a risk rating for each, controls whose depth follows the rating, monitoring with named people who act, and reporting to the board. NIST's AI RMF or ISO/IEC 42001 can give the structure; in Canadian banking, OSFI's E-23 sets the floor.
Choose the frame before you write anything
There are more AI governance frameworks than any team needs. Choose one to structure the work and map the others to it, rather than trying to satisfy five at once.
| Framework | What it is | Best when |
|---|---|---|
| NIST AI RMF 1.0 (January 2023) | A voluntary framework built on four functions: Govern, Map, Measure, Manage | You want a free, well-known structure with a large playbook |
| ISO/IEC 42001:2023 | A certifiable management system standard for AI | Customers or partners will ask for a certificate |
| OSFI E-23 (from 1 May 2027) | OSFI's model risk guideline, AI and machine learning included | You're a federally regulated bank or insurer in Canada |
| EU AI Act | Law, with duties by risk category, phased in from 2025 | You place AI on the EU market or its output is used there |
For a Canadian bank or insurer the practical answer is to treat E-23 as the floor for any AI that's a model, and use NIST or ISO 42001 for the wider questions E-23 doesn't cover, such as acceptable use of AI tools by staff. See AI governance for how the frameworks differ.
A 90-day plan
- Weeks 1–2: name the owner. One senior executive accountable for AI risk, and a small working group drawn from risk, technology, legal, privacy and the business. Agree a working definition of an AI system and what's out of scope.
- Weeks 2–6: build the inventory. Ask every team what AI they use: models they've built, AI features inside vendor software, generative AI tools staff use, agents. Record owner, purpose, data, vendor and whether customers are affected. Expect to find more than anyone guessed; shadow AI is the norm. See AI use case inventory.
- Weeks 4–8: rate the risk. Score each system on impact (customers, money, decisions), autonomy, data sensitivity and complexity, and place it in three or four tiers. Use the same tiers as model risk if you have them. The tier calculator shows one approach.
- Weeks 6–10: set the controls by tier. For the top tier: an impact assessment, independent testing before use, a named approver who isn't the builder, human oversight of key decisions, and contract terms for vendors. Lighter steps lower down. Write an acceptable use policy for staff tools.
- Weeks 8–12: monitor and report. Thresholds for performance, drift and incidents, each with a person who acts on a breach. A one-page report to senior management and the board: the inventory by tier, what's overdue, open issues, incidents.
Ninety days gets a working first version, not a finished one. The inventory and the ratings are what make everything after them possible, so don't let policy drafting delay them.
What regulators expect to see in financial services
OSFI and the FCAC's joint report on AI uses and risks, published on 24 September 2024, found AI use at federally regulated institutions rising fast, from roughly 30% in 2019 to about 50% in 2023, with around 70% expected by 2026. Its suggested practices read like a checklist: assess AI risks across the whole lifecycle and revisit them; manage AI risk in an integrated way rather than only inside separate model or cyber frameworks; monitor customer-facing models for bias; train staff and restrict confidential data in generative AI prompts; apply the same standards to open-source components as to in-house or vendor models; and keep the board engaged.
E-23 then makes much of it concrete for anything that counts as a model: an inventory with set fields, a risk rating, independent review, approval and monitoring. For AI bought from vendors, B-10 adds the third-party side.
Where implementations go wrong
- Starting with a principles statement and stopping there. Fairness and transparency matter, but a principle no control enforces changes nothing.
- Governing only the models the data science team built. Most AI in a typical company arrives inside vendor software and staff tools.
- One process for everything. If a chatbot that drafts internal emails gets the same review as a credit decision model, people route around the process.
- No evidence trail. When someone asks who approved a system and on what basis, the answer has to be on record, not in someone's inbox.
Where MINERVA fits
MINERVA keeps the AI governance record for Canadian banks and insurers: the inventory of models, AI systems, vendors and agents, each one's rating and owner, independent review and approval, and monitoring, with every decision on a time-stamped trail. AI agents run under written policies checked before each tool call. See AI governance software.
Related questions
What is an AI governance framework?
The policies, roles and processes an organisation uses to make sure its AI is used safely, lawfully and as intended, from the inventory and risk rating through approval, monitoring and reporting.
Which AI governance framework is best?
There isn't one best. NIST's AI RMF is free and widely used, ISO/IEC 42001 can be certified, and in Canadian banking OSFI's E-23 sets the expectations for AI models.
How long does it take to implement AI governance?
A working first version, with an owner, an inventory, ratings and basic controls, can be in place in about three months. Maturing it takes longer.
Do small companies need an AI governance framework?
A light one, yes: an owner, a list of AI tools in use, an acceptable use policy and a closer look at anything that affects customers. It can grow with the company.
Who should own AI governance?
A named senior executive, often the chief risk officer or a chief data or AI officer, with the board overseeing. Day-to-day work sits with system owners and a second-line risk function.
Sources
- OSFI and FCAC — Risk report: AI uses and risks at federally regulated financial institutions (24 September 2024)
- NIST — AI Risk Management Framework (AI RMF 1.0)
- ISO — ISO/IEC 42001:2023 Artificial intelligence management system
- OSFI — Guideline E-23, Model Risk Management (2027)
- EUR-Lex — Regulation (EU) 2024/1689, the AI Act
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.