Establish AI governance policies, roles and accountability (Govern)

Practical action

Adopt an AI policy, assign owners, and set a risk-tolerance statement approved by leadership.

Who does it apply to?

Voluntary; any organisation adopting the framework.

Actors

Provider / developerDeployer / user organisation

Sectors

Cross-sector / all sectors

Use cases

AI in hiring and employmentGenerative AI and foundation models

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesPolicyExecutive sponsor for AI · annual
  AI governance policy and accountability structure

  Serves 16 recorded duties · evidence: AI policy, Board or executive approval of the AI policy, AI governance forum minutes

  Policy, roles, risk tolerance and culture map to the Govern outcomes.

• supportsTraining programmeLearning and development lead · annual
  AI literacy and role-based training programme

  Serves 4 recorded duties · evidence: AI training completion records, Role-to-curriculum training matrix, AI training curriculum and materials

  Workforce training outcomes.

• supportsProcessProcurement or vendor risk lead · once per ai system
  Vendor and third-party AI due diligence

  Serves 6 recorded duties · evidence: AI supplier due-diligence assessment, AI supplier and component register, Supplier onboarding decision

  Third-party risk management outcomes.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• AI System Inventory

  Register · XLSX and DOCX · v6

• AI Acceptable Use Policy

  Policy · DOCX · v1

• AI Governance Policy and RACI

  Policy · DOCX and XLSX · v5

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

All 9 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every United States duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Establish AI governance policies, roles and accountability (Govern) (NIST AI RMF)” [AIPT-OBL-0112, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0112 (accessed 27 October 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0112: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Artificial Intelligence Risk Management Framework (AI RMF 1.0), National Institute of Standards and Technology, https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf.

@misc{aipolicytracker2026_establishaigovernancepol,
  author       = {{AIPolicyTracker}},
  title        = {{Establish AI governance policies, roles and accountability (Govern) (NIST AI RMF)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/us-nist-ai-rmf-govern}},
  url          = {https://aipolicytracker.org/obligations/us-nist-ai-rmf-govern},
  urldate      = {2026-10-27},
  note         = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}

Change history

Similar obligations in other instruments

• Use high-risk AI as instructed, monitor it and inform affected people — EU AI Act, European Union
• Providers must meet the full set of provider duties for high-risk AI — EU AI Act, European Union
• Providers must supply conformity evidence and log access to authorities on request — EU AI Act, European Union
• Non-EU providers must appoint an EU authorised representative for high-risk AI — EU AI Act, European Union
• Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI — EU AI Act, European Union
• Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually — EU AI Act, European Union
• Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-risk threshold — EU AI Act, European Union
• Non-EU providers of GPAI models must appoint an EU authorised representative — EU AI Act, European Union