All services Every engagement has a fixed, published price. Book a strategy call
The working blueprint for enterprise AI governance in 2026: who does what, how systems move from idea to retirement, the artefacts that must exist, and a first ninety days that produces evidence rather than paperwork.
By 2026 the argument about whether AI needs governing is over. The EU AI Act is law and its heaviest obligations are landing, agentic systems are executing tasks rather than suggesting them, enterprise customers send AI questionnaires as routinely as security ones, and boards have started asking the questions that expose an ungoverned estate. What most organisations still lack is not conviction but a working design: who does what, how a system gets from idea to production, and what evidence exists at the end.
This is that design. It is the blueprint we use to build AI governance inside client organisations, published with the same candour we apply to our prices. It assumes you want control without a bureaucracy, and it can be stood up, in skeleton form, in ninety days.
The short answer. Enterprise AI governance is the operating model that takes every AI system an organisation builds, buys or switches on from proposal to retirement under named ownership, proportionate control and audit ready evidence. It stands on six layers: board oversight, a single accountable owner, a small governance function, an intake and approval path, lifecycle controls, and an evidence layer that can face a regulator, customer or insurer.
Strip away the frameworks and the job is five outcomes. You know the estate: every AI system, built, bought or embedded, is on a register with a named owner. Approval is proportionate: low risk tools clear a fast lane in days, high risk systems earn scrutiny. Legal obligations are met by date rather than discovered in an audit. Failures surface internally, through monitoring, before a customer or a journalist finds them. And evidence exists on demand, because in 2026 the question is rarely whether you govern AI but whether you can prove it this week.
Anything in a governance design that does not serve one of those five outcomes is decoration, and decoration gets bypassed.
| Layer | What it does | Who owns it |
|---|---|---|
| Board oversight | Sets risk appetite for AI, reviews the estate quarterly, asks for evidence rather than assurance. | The board, on a standing agenda item. |
| Accountable owner | One senior executive who answers for AI risk, with budget and a reporting line to the board. | A named individual, never a committee. |
| Governance function | Runs the register, the intake path and the policy. Small by design, often fractions of roles. | AI governance lead, full time or fractional. |
| Intake and approval | Examines every proposed AI use before production, with authority to refuse or set conditions. | Governance function plus domain experts. |
| Lifecycle controls | Testing before release, human oversight, monitoring thresholds, change triggered re-approval. | Each system’s named owner. |
| Evidence layer | Keeps the records that prove all of the above, per system, current and retrievable. | Governance function, populated by owners. |
Six layers, two of which are part time in most organisations. The common failure is not missing layers but missing names: a layer without a named owner is a diagram rather than a control.
The board owns risk appetite and holds the review rhythm. Quarterly is enough if the reporting is honest: estate size and change, high risk systems and their status, incidents, refusals, and obligations falling due. A board pack that has never contained a refusal or an incident is describing a governance system that is not running.
The accountable executive is the single point where AI risk lands. In most organisations this is the CIO, CTO or chief risk officer. What matters is not the title but the singularity: one person, resourced, with the risk written into their objectives.
The governance function is deliberately small: it keeps the register live, runs intake, maintains a policy short enough to be read, and assembles evidence. In a mid size organisation this is a fraction of one role plus called on specialists rather than a department. Committees advise it. They do not replace it. A fifteen person AI ethics committee with no register and no authority is the most common governance artefact we find, and the least useful.
System owners carry each system day to day: its purpose, data, testing, monitoring and review dates. Vendor systems have internal owners too. If a system has no owner, the accountable executive owns it by default, which concentrates minds when the register makes that visible.
Every AI system, whether built in house, bought, or switched on inside software you already run, moves through seven stages.
Propose. A thirty minute intake form: what the system does, what data it touches, who it affects, who owns it. If intake takes three weeks, people will route around it, and the fastest way to create shadow AI is a slow front door.
Classify. The governance function tiers the proposal by potential harm and, where EU customers, staff or data are involved, maps it against the EU AI Act categories. Classification decides the depth of everything that follows: mapping systems for the Act is the same discipline applied to the existing estate.
Approve. A named authority approves, refuses or sets conditions, and the decision is recorded. Refusals are the proof the gate exists. Minimal risk tools should clear this stage in days through a standing fast lane.
Build or buy with controls. High risk systems earn their duties before release: data quality checks, documented testing, human oversight designed in, and for vendor systems, contractual answers about training data, updates and incident notification.
Deploy with thresholds. No material system goes live without someone defining what wrong looks like: accuracy floors, drift limits, escalation triggers, and a human with authority to intervene or switch off.
Operate and re-approve. Monitoring runs against the thresholds, incidents follow a rehearsed route, and material change, a new model version, new data, a new use, sends the system back through approval. Vendor pushed updates count as change: AI features now arrive silently inside SaaS releases, which is why the register review is scheduled rather than triggered by memory.
Retire. Systems leave the estate deliberately: access removed, data handled per retention rules, records kept. An abandoned model still running is an unowned risk.
Eight records, most of them one page or one register. The AI inventory with owners and tiers, which is the artefact that matters most because every other one hangs off it. The risk tiering record showing how each classification was reached. A two page policy people can follow: what needs approval, what is banned, what goes in the fast lane, and what may never be put into a public tool. Intake and approval records, including the refusals. A per system evidence pack for material systems: purpose, data, testing, oversight, monitoring, review date. An incident log with outcomes. Monitoring records against the defined thresholds. And a training record showing people know the rules that apply to them.
If you can produce the inventory and the evidence packs on request, you will satisfy most regulators, customers and insurers before they finish asking. If you can only produce the policy, you have a promise without a memory.
Three shifts make this year different. First, the EU AI Act has moved from timeline to obligation: prohibitions have applied since February 2025, general purpose AI duties since August 2025, and most high risk system obligations phase in through August 2026 with some running to 2027. UK organisations serving EU customers are in scope, and readiness now means evidence rather than intent.
Second, agentic AI changes the control problem. Systems that plan, chain tools and execute transactions cannot be governed by reviewing their outputs after the fact. They need bounded permissions, spend and action limits, kill switches and logs at the level of actions taken, which is a lifecycle question rather than a model question.
Third, the buying side got organised. AI questionnaires from enterprise customers, insurer questions at renewal and diligence questions in deals are now routine. The organisations that answer from a register win time and trust. The ones that answer from recollection lose both.
After ninety days you have a working skeleton, and a choice about how to run it: build the capability in house, have it stood up for you as a working AI Governance Office from £30,000 + VAT, or run it as a retained service through AI Risk-as-a-Service from £8,000 a month. Organisations that want the certificate as well as the capability take the register and lifecycle into an ISO/IEC 42001 implementation, scoped as a fixed fee. The order is deliberate: governance first, certification second.
Starting with the policy instead of the inventory. A policy that applies to an unknown estate governs nothing. A committee instead of an owner. Committees advise. Only named owners answer. Treating it as a project. Governance that ends at go live decays with the first vendor update. Banning instead of routing. Prohibition without an approved alternative creates the shadow estate you were trying to prevent. Certifying theatre. A management system certificate layered over a missing register proves only that the theatre was audited.
Enterprise AI governance is the operating model that keeps every AI system in an organisation, built, bought or embedded, under named ownership, proportionate approval and audit ready evidence, from proposal to retirement. It is a working capability rather than a policy document.
Data governance controls an asset: the quality, ownership and use of data. AI governance controls systems that act on that data, including their decisions, behaviour and change over time. They interlock, because AI built on ungoverned data fails predictably, but they are distinct disciplines with distinct registers. Strong data governance makes AI governance far cheaper.
Fewer than most designs assume. A mid size organisation typically needs one accountable executive, a governance lead who is often fractional, and named owners for each material system, with specialists called on for classification and testing. What it cannot survive without is names against layers.
Not to govern AI, but increasingly to prove it. ISO/IEC 42001 is the certifiable standard for an AI management system, and it is becoming the clean answer to customer and regulator questions. Build the governance first, then certify what exists.
A working skeleton, inventory, tiering, intake, approval authority, first evidence packs and a board report, takes about ninety days. Maturity is ongoing, because the estate changes with every vendor release and every new use case.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with the adviser who wrote this guide. A clear view of your exposure, the sensible first step and its published fee.
Talk to a senior adviser
AI Governance
AI Governance