AI is already in use
Free tools, features switched on inside existing software and supplier AI mean most organisations use more AI than the board has approved.
AI Governance Foundations
AI Governance Foundations: Find It. Govern It. Train for It. Review It.
If you do not know where AI is being used, what data it touches, who approved it and when it was last reviewed, you cannot honestly say it is being governed. Foundations is the practical first layer of AI control, from the boardroom to the shop floor.
Correct as of 28 September 2026. Regulation and guidance change. If you are reading this later, check for updates before relying on it.
The AI governance path: step 3 of 5
Start here if: You have a plan, but no AI register, no AI policy and no training.
See the whole path →What it is
The practical first layer of AI control
AI Governance Foundations puts the basic controls in place: a register of where AI is used, a risk assessment, a clear AI use policy, training for leaders, managers and staff, and a review process that keeps it all current.
It is a fixed-scope programme in its own right, not a document pack. It is also the base that EU AI Act Implementation and ISO/IEC 42001 build on, so nothing done here is wasted.
Why the board should care
Why start with the foundations
Every later step depends on it
EU AI Act classification and ISO 42001 both start from a register, owners and a policy. Without them, the later work cannot be relied on.
People need clear rules
Staff either avoid AI because nobody has said what is allowed, or use it in ways nobody has checked. Both cost money.
Who this is for
- Organisations that cannot yet say where AI is used or who owns it
- Leadership teams whose Strategy Day 90-day plan calls for basic AI controls
- Businesses preparing for the EU AI Act or ISO/IEC 42001 that need the groundwork first
- Boards that want evidence AI is governed, not just a policy on file
What it solves
- No single list of AI tools, supplier AI and AI features inside existing systems
- No agreed view of which uses of AI carry real risk
- No clear AI use policy, or one nobody follows
- Leaders, managers and staff with no training on what good AI use looks like
- Governance written once and never reviewed
What Foundations covers
Four parts, boardroom to shop floor
Find it
An AI register: AI tools, supplier AI, internal use cases and AI features inside existing systems, each with an owner and a purpose.
Govern it
A basic risk assessment for each use, named owners, and a clear AI use policy covering acceptable use, data handling, approval routes and prohibited uses.
Train for it
Different training for executives, managers and staff, so each group knows what they are accountable for and what is allowed.
Review it
An annual review process that keeps the register, risk assessment and policy current, not a one-off document.
Where it sits
The third step on the AI governance path
The Assessment finds the gaps. The Strategy Day sets the priorities. Foundations puts the controls in place. EU AI Act Implementation and ISO 42001 build on it.
Before Foundations
The EU AI Act Readiness Assessment and the Executive AI Strategy Day identify the need. The Strategy Day 90-day plan recommends Foundations where the basics are missing.
Executive AI Strategy Day →After Foundations
EU AI Act Implementation takes the register and policy through classification, supplier checks, evidence and remediation for the December 2027 deadline.
EU AI Act Implementation →Then certification
ISO/IEC 42001 formalises everything into an AI management system that an independent body can certify.
ISO 42001 readiness →What you get
What you have at the end
- An AI register covering tools, supplier AI, internal use cases and AI inside existing systems
- A basic risk assessment for each use of AI, with named owners
- A clear AI use policy, approved at the top and written for the people who use it
- Training delivered to executives, managers and staff, with attendance recorded
- An annual review process with dates and owners
How it works
-
Find
Short interviews and a structured survey across teams to find every use of AI, including AI inside the software you already pay for.
-
Govern
Each use risk-assessed and owned, and the AI use policy drafted, tested with the people who will follow it and approved.
-
Train
Sessions for the board and executives, managers and staff, each matched to what that group decides and does.
-
Review
The review cycle set up and the first review date booked, so the register stays alive.
Free board download
ISO 42001 Readiness Checklist
A 15-minute board self-check of how ready you are to build an AI management system aligned with ISO/IEC 42001: six domains, 24 evidence-based checks and a clear result.
- Six domains with 24 checks, from leadership and AI risk to audit readiness
- A simple result: Ready to plan, Gaps to close or Not yet ready
- The gaps that most often stop a first certification audit
FAQ
Frequently asked questions
What is AI Governance Foundations?
A fixed-scope programme that puts the first layer of AI control in place: an AI register, a basic risk assessment, a clear AI use policy, training for leaders, managers and staff, and an annual review process.
Is this instead of ISO 42001?
No. Foundations is the groundwork ISO/IEC 42001 builds on. Many organisations need the basics in place first, and everything done here carries forward into an AI management system. See ISO 42001 readiness.
How does it relate to the Strategy Day?
The Executive AI Strategy Day decides priorities and identifies governance gaps. Where the basics are missing, its 90-day plan recommends Foundations as the way to close them.
Does it make us EU AI Act compliant?
It puts in place the register, owners, policy and training the Act relies on, but compliance depends on the specific systems you use or supply. EU AI Act Implementation builds on Foundations to take you to the December 2027 deadline. This is governance advice, not legal advice.
Is it included in the Fractional Chief AI Officer service?
Yes. A Fractional Chief AI Officer delivers Foundations within the first 90 days, alongside strategy and operating model work.
What does it cost?
Foundations is a fixed fee, confirmed on the scoping call once we understand the size of your organisation and how widely AI is used.
Next step
Talk to us about AI Governance Foundations
Tell us roughly how many people you have and where you think AI is being used. We will reply personally with how Foundations would work for you, usually within one working day.
Correct as of 28 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 28 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.
AIPEX provides governance and strategy advice, not legal advice. AIPEX is not a certification body and does not certify organisations.