← AI Cases · Governance · Responsible AI

AI governance in production: from corporate policy to operation.

A framework is worthless if the team can't apply it on Monday morning. This case describes how policy gets translated into auditable operation — with the NIST AI RMF, ISO/IEC 42001 and the EU AI Act as references.

Institutional AI governance framework — an operable architecture applying the NIST AI RMF, ISO/IEC 42001 and EU AI Act to production
An institutional governance framework — the policy applied on Monday morning, not the document sitting on the intranet.

Problem

Almost every AI policy that reaches a CAIO's desk is inoperable.

They're written by consultancies, approved by the board, and filed on an intranet. Nobody applies them because they don't say what to do on Monday morning with a model that's deciding an actual case. The result is the worst of both worlds: the organization takes on the risk without the discipline that risk demands.

Context

A national media company, with AI already in production.

Once generative and agentic AI systems are already running — NAT, TVOAI, avatars — governance stops being a hypothetical exercise. Every month without a framework is another month of decisions accumulating with no traceability.

Decision

An AI Ethics Framework co-built by the CAIO's office and Legal.

The executive decision was not to outsource the framework to an external consultancy. It was co-built in-house — CAIO + Legal + direct operators — to make sure every clause could be applied in the actual workflow. Signed by the CEO. In force and operating.

Governance

Governance architecture.

  • Level 1 · Policy — principles, scope, definitions, roles and responsibilities. Board-approved.
  • Level 2 · Standards — risk classification by use case; required controls by category (high/medium/low).
  • Level 3 · Procedures — checklists the team can execute, assessment templates, logging formats.
  • Level 4 · Audit — evidence retained; review cycle; escalation path when something falls outside expected range.

External references

NIST AI RMF, ISO/IEC 42001, EU AI Act.

The framework references three standards: the NIST AI RMF (United States, voluntary, organized around map/measure/manage/govern); ISO/IEC 42001 (the international AI management system standard); and the EU AI Act (Europe's legal framework, with risk categories). None is applied verbatim — the framework takes what each one solves best and composes its own, adapted to the operational context.

Human-in-the-loop

An identified human owner per use case — always.

No AI system operates without a named human owner. There's no "the team" — there's a person. That person signs off on the use case, approves changes, and answers when something goes wrong. Without that role, there's no governance — there's a written policy.

Result

A framework applied on Monday morning.

The result isn't a document — it's an operation: the teams deploying AI cases use the framework as their actual workflow. When a board asks "what protects this organization from an incident?", the answer is specific, documented and auditable.

Lesson

Governance that works reduces friction. It doesn't add it.

A well-designed framework accelerates. It gives the team a clear path to deploy; it gives the board confidence to authorize. A poorly designed framework paralyzes — and the team ends up deploying around it in the shadows, which is the worst possible outcome.

Related