{"slug":"ai-governance-policy-and-accountability","id":"AIPT-CTL-0002","title":"AI governance policy and accountability structure","kind":"policy","kind_label":"Policy","purpose":"Gives the organisation a single approved statement of how it will develop, buy and use AI, and names the people who are answerable for it, so that every other AI control has a mandate and an owner.\n","description":"Senior management approves a short AI policy that sets the organisation's risk appetite, the principles it commits to, the scope of systems covered and the decisions that must be escalated. The policy is backed by a responsibility map: an executive sponsor, a governance lead, system owners and the committee or forum that reviews high-risk cases. Meeting cadence, escalation routes and the relationship to existing risk, privacy and security functions are written down. The policy is reviewed at least once a year and whenever a new law or a material incident changes the picture, and decisions of the governance forum are minuted so that a regulator or auditor can trace who decided what and when.\n","owner_role":"Executive sponsor for AI","frequency":"annual","frequency_label":"Annual","risk_subdomains":["6.5","5.2"],"evidence":[{"type":"policy_document","title":"AI policy","description":"Approved and versioned statement of scope, principles, risk appetite and escalation rules."},{"type":"approval_record","title":"Board or executive approval of the AI policy","description":null},{"type":"meeting_record","title":"AI governance forum minutes","description":"Decisions, attendees and actions from each governance meeting."},{"type":"register_entry","title":"AI responsibility map","description":"Named owner for each AI role and for each system."}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 5.1, 5.2, 5.3, 9.3; Annex A.2, A.3","note":"Editorial mapping to leadership, policy, roles and management review.","confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 1.1, 1.2, 1.3, 2.1, 3.1","note":null,"confidence_level":"high"},{"framework":"oecd_ai_principles","framework_name":"OECD AI Principles","reference":"Principle 1.5 Accountability","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-quality-management-system","title":"Operate a quality management system","relationship":"supports","note":"Accountability and resource allocation.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system"},{"slug":"australia-vaiss-accountability-and-risk-management","title":"Establish accountability processes and a risk-management process (guardrails 1 and 2)","relationship":"satisfies","note":"Guardrail 1: accountable owner, policy and compliance strategy.","confidence_level":"high","is_binding":false,"policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","url":"https://aipolicytracker.org/obligations/australia-vaiss-accountability-and-risk-management"},{"slug":"eu-ai-act-art-16-provider-obligations","title":"Providers must meet the full set of provider duties for high-risk AI","relationship":"satisfies","note":"Assigns each provider duty to a named owner with a reporting line.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations"},{"slug":"eu-ai-act-art-21-cooperation-with-authorities","title":"Providers must supply conformity evidence and log access to authorities on request","relationship":"supports","note":"Names the regulator liaison and escalation path.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-21-cooperation-with-authorities"},{"slug":"eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","title":"Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually","relationship":"supports","note":"Authorisation workflow ownership.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation"},{"slug":"us-california-sb-53-whistleblower-protections","title":"Frontier developers must protect employees who report catastrophic-risk concerns","relationship":"satisfies","note":"Whistleblower policy, anonymous channel and escalation to the board.","confidence_level":"medium","is_binding":true,"policy":"us-california-sb-53","jurisdiction":"us-california","url":"https://aipolicytracker.org/obligations/us-california-sb-53-whistleblower-protections"},{"slug":"us-nist-ai-rmf-govern","title":"Establish AI governance policies, roles and accountability (Govern)","relationship":"satisfies","note":"Policy, roles, risk tolerance and culture map to the Govern outcomes.","confidence_level":"high","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-govern"},{"slug":"nepal-ai-policy-responsible-ai-principles","title":"Government bodies to promote ethical, responsible and inclusive AI (policy commitment)","relationship":"supports","note":"A policy referencing the national principles positions public bodies and vendors for future measures.","confidence_level":"low","is_binding":false,"policy":"nepal-national-ai-policy","jurisdiction":"nepal","url":"https://aipolicytracker.org/obligations/nepal-ai-policy-responsible-ai-principles"},{"slug":"singapore-mgf-internal-governance","title":"Establish internal governance structures and measures for AI","relationship":"satisfies","note":"Roles, board oversight and internal controls for AI.","confidence_level":"high","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-internal-governance"},{"slug":"india-ai-guidelines-principles-and-risk-based-governance","title":"Adopt the guiding principles and risk-based governance (voluntary)","relationship":"satisfies","note":"Embeds the principles and proportionate risk classification in an approved policy.","confidence_level":"medium","is_binding":false,"policy":"india-ai-governance-guidelines","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-ai-guidelines-principles-and-risk-based-governance"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation","title":"Operators of high-impact AI must prepare user-protection measures and keep records of their safety and trust measures","relationship":"supports","note":"User-protection plan and ownership.","confidence_level":"medium","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation"},{"slug":"uae-ai-strategy-ethics-and-governance-commitment","title":"Government commitment to AI ethics, governance and regulation (strategy objective)","relationship":"supports","note":"Referencing the UAE ethics principles and charter in the organisation's own AI policy.","confidence_level":"low","is_binding":false,"policy":"uae-national-ai-strategy-2031","jurisdiction":"uae","url":"https://aipolicytracker.org/obligations/uae-ai-strategy-ethics-and-governance-commitment"},{"slug":"uk-principles-accountability-governance","title":"Establish accountability and governance for AI","relationship":"satisfies","note":"Clear lines of accountability and a governance decision log.","confidence_level":"high","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-accountability-governance"},{"slug":"us-colorado-deployer-risk-management-program","title":"Deployers must implement a risk management policy and programme","relationship":"satisfies","note":"The risk-management policy, principles and personnel the statute expects.","confidence_level":"medium","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-deployer-risk-management-program"},{"slug":"us-colorado-ai-act-deployer-reasonable-care","title":"Deployers must use reasonable care to avoid algorithmic discrimination","relationship":"satisfies","note":"Ownership and the standard of care documented for each system.","confidence_level":"medium","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-reasonable-care"},{"slug":"us-eo-14179-agency-review-of-prior-actions","title":"Federal agencies must review and revise actions inconsistent with the new AI policy","relationship":"supports","note":"Vendors track which agency requirements still apply through their policy review.","confidence_level":"low","is_binding":true,"policy":"us-executive-order-14179","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-eo-14179-agency-review-of-prior-actions"}],"related_controls":["ai-system-inventory","ai-risk-assessment","ai-literacy-and-role-based-training","ai-quality-management-system"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability","context_url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability.md"}