← Back to White Papers

Best Practices for Implementing Commonly Available AI Governance Frameworks

July 1, 2025

Written by: Todd Henley

Search engines were wonderful inventions, and we can all be excused for the illusion that all the world’s information was at our fingertips when we first started using them. Afterall, I’m sure I’m not the only one who began the day searching for vital information on transfer rates for the latest network storage protocol, only to find myself at 2:00AM with Ph.D.-level knowledge of Ornithology. At best, following linked documents helped us to piece information together that others had pioneered. At worst, search engines led us down multiple rabbit holes, becoming unintentional “experts” on unrelated topics.

The linking of Artificial Intelligence to search engines output has been of great help in summarizing query responses. These summaries have led to fewer rabbit hole excursions but often have their own limitations. As a convenient example, if you were to type a simple query into your favorite search engine such as “Best Practices for Implementing Commonly Available AI Governance Frameworks” the result would be less than satisfying. Responses to the above search query include “Establishing clear policies and guidelines, engaging stakeholders, implement continuous monitoring and auditing, training and awareness, prioritization of risk management, ensuring transparency and explainability, regulatory compliance, and model management”. All these responses are great topics in-and-of themselves but only amount to what are essentially components of program frameworks, not best practices regarding implementing governance program frameworks. AI supported search engines return these examples because that’s what is available to the large language model used to power the summary. AI can be forgiven for this kind of error propagation. After all, at some point a human established these framework components as “best practices” and that’s what has been used for every article generated by AI ever since.

This begs the question; if what is summarized in search returns are merely components of AI Governance Frameworks, then what exactly are best practices for framework implementation?

The Basics – Understanding AI Governance and Program Frameworks:

Just as Data Governance has had to contend with for many years multiple definitions of AI Governance exist. This paper will not delve deeply into the many definitions, but will summarize that AI Governance programs include policies, standards, guidelines, procedures, practices, designed to guide the responsible conceptualization, development, deployment, use, and deprecation of AI systems. The goal of AI Governance programs is to ensure AI systems are developed and used ethically, safely, and in alignment with organizational goals, objectives, as well as norms and values. AI Governance programs also aim to mitigate potential risks that AI systems present, such as bias, privacy incidents, and security threats.

In essence, frameworks are structures or systems of principles that serve as a foundation for building something. In this instance, AI Governance frameworks provide a structured approach to AI Governance program implementation, guiding the conceptualization, development, deployment, maintenance and use of AI systems. AI Management and Governance systems ensure safe, fair, and ethical use of AI while balancing associated risks and benefits by adding controls throughout the AI lifecycle to ensure responsible execution and use of AI products.

Many frameworks for the responsible execution of AI systems exist:

  • EU AI Act - The European Union has developed a comprehensive, risk-based approach to ensure the safe, ethical, and trustworthy execution of AI initiatives within the Union.
  • ISO/IEC- 42001 (AI Management Systems)/5 (AI System Impact Assessments)/6 (AI System Audit and Certification) and associated ISO/IEC standards regarding AI System lifecycle processes (5338), guidance for AI Applications (5339), as well as bias (24027), risk management (23894), and even data quality (5259) \. Where the EU AI Act establishes risk categorization associated with the execution of AI system, the family of ISO/IEC standards provides a framework for compliance with the EU AI Act's risk-based approach.
  • NIST AI Risk Management Framework (AI RMF) - The National Institute of Standards and Technology (NIST) has provided a guidance document designed to help organizations manage risk associated with the use of AI
  • OECD Principles on AI - The Organization for Economic Co Operation and Development (OECD) has provided guidance on effective AI policies, including principles for AI Governance.
  • Company, Vendor, and Industry Oriented Frameworks - Many private and not-for-profit organizations have thrown their "framework hats" into the ring, with the most notable being the Microsoft Responsible AI Framework, and the Gartner TRiSM (Trust, Risk, and Security Management) Framework. These frameworks have formed the foundations of AI Governance frameworks for many program implementations, and each company has based their own framework from them.

While there are many frameworks to choose from, they all share common elements, and may overlap in scope, terminology, and goals, though they may be implemented for different purposes, based on your organization’s AI Governance program requirements. As an AI Governance program implementer, let best practices guide you in not only selecting the correct framework, but to understand how to take the best of each commonly available framework and make them your own.

Framework Best Practices:

Following best practices for AI governance program framework implementation is essential to ensure that AI systems are deployed responsibly, ethically, and in alignment with organizational goals. These practices provide a structured approach to managing the complexities and risks associated with AI and ensure the best fit-and-finish for your organizational needs.

By adhering to best practices in implementing AI Governance program frameworks, organizations can foster stakeholder trust, enhance operational resilience, and avoid legal or reputational fallout. Moreover, implementing a robust governance framework positions the organization to adapt more effectively to evolving technologies and regulations, while also promoting innovation through safe and trustworthy AI use.

The following constitute what can be considered best practices for selection and implementation of AI Governance program frameworks. This list isn’t all inclusive, but should serve to start the discussion in your organization.

  • Everything, everywhere, all at once!

The wave of frameworks has become part of the broader hype associated with AI. Frameworks are released not necessarily out of necessity but as a bit of a marketing gimmick to boost the framework sponsoring organization’s position as an industry thought leader. By introducing new and potentially overlapping terms and diagrams framework developers attempt to position themselves as frontrunners in the AI revolution.

Unfortunately, frameworks don’t solve the hardest problems facing enterprises in AI adoption, as most organizations still struggle with the fundamentals like maintaining clean, actionable data, or even knowing what data they have, where it resides, or how it's being used. Another unfortunate factor, the disciplines that represent the cornerstones of successful AI integration, like Security, Privacy, and Data and Information Governance, are far too often afterthoughts rather than core organizational priorities.

However, trying to do everything, everywhere, all at once, much like hope, is not a sound strategy. Obsessing over WHICH AI Governance framework you should implement or which components much be implemented first may not be what’s most needed by the organization. In short, a little less theory, and a lot more practical guidance will help solve some of your organizations most persistent problems. The first in the list of best practices is the understanding that you can’t do everything, everywhere, all at once. Like everything else in life, the road to AI maturity starts and ends with the basics; start with well defined, solid use cases, and build your framework development efforts from there. The sections, below, contain additional practical, best practices.

  • Who are you?

This isn’t an existential question but is no less important. A best practice for selecting and implementing an AI Governance framework is to take into consideration who you are in the corporate sense. A few things to take into consideration from an organizational perspective are Culture, Change Management Capacity, and Collaborative Capacity.

Culture – in an academic sense, an organization’s culture contains shared beliefs, values, and practices that support mission achievement. However, there are more practical indicators of an organization’s culture that impact AI Governance framework selection and implementation. How does your organization make and execute decisions, fund initiatives, perceive, adopt, and integrate AI technologies into daily operations? How does your organization handle ethical considerations and cultural barriers, as well as improvements in overall literacy? Depending on your responses to these questions, as a best practices you may want to consider selecting one or more AI Governance framework core components to build upon, or adopt a commonly available framework, wholesale.

Change Management Capacity – As an adjunct to overall cultural considerations, the capacity for change management is critical to successful AI Governance programs as it ensures updates to policies, process, practices, or systems (either directly related to AI or support AI system execution) are effectively adopted and sustained. Based on your organization’s culture, as a best practice, consider selecting and implement the right combination of AI Governance framework elements that minimizes disruption and ensures successful outcomes of AI initiatives, as well as facilitates stakeholder engagement and trust.

Collaborative Capacity – An organization’s collaborative capacity is defined as its ability to effectively coordinate across departments, hierarchies, and stakeholder groups, and plays a pivotal role in selecting and implementing AI governance frameworks. Most widely recognized frameworks emphasize cross-functional alignment, transparency, and iterative feedback. These principles demand input and cooperation from legal, IT, compliance, data science, human resources, and executive leadership. If collaboration is weak or siloed, the framework's requirements may be implemented unevenly or misunderstood, resulting in fragmented governance practices that fail to manage risk or uphold organizational values.

Effective implementation of AI governance frameworks also relies on the organization's ability to embed shared decision-making and continuous learning into its culture. Collaborative capacity enables smoother integration of ethical guidelines, risk assessments, and accountability mechanisms into daily workflows. For example, a strong collaborative environment ensures that teams can jointly evaluate AI use cases, weigh trade-offs between innovation and compliance, and resolve tensions between privacy and performance. Without this capacity, AI initiatives may stall due to misalignment or be driven forward with blind spots that increase risk exposure.

Furthermore, frameworks often call for transparency, stakeholder engagement, and cross-functional review boards—all of which are impractical without a robust collaboration infrastructure. Organizations with mature collaborative processes are better equipped to tailor governance frameworks to their specific operational context, scale them across business units, and ensure long-term sustainability. In contrast, organizations lacking collaborative mechanisms may struggle to move beyond checkbox compliance, missing the opportunity to cultivate trustworthy, responsible AI systems. In this way, collaborative capacity is not only a success factor—it is a prerequisite for meaningful and adaptive AI governance.

  • Where are you?

An organization’s industry and regulatory status significantly influence the selection and implementation of AI governance frameworks. Highly regulated sectors such as healthcare, finance, energy, and aviation face strict legal obligations regarding data privacy, explainability, fairness, and accountability. For these industries, frameworks that emphasize traceability, auditability, and compliance—such as the NIST AI Risk Management Framework or ISO/IEC 42001—are often favored because they align with existing regulatory structures. In contrast, organizations in less regulated sectors may adopt more flexible, principle-based frameworks that emphasize innovation and ethical alignment over strict procedural controls.

Regulatory obligations can also dictate the depth and pace of framework implementation. For example, a financial institution subject to stringent oversight by national or international regulatory bodies must integrate AI governance deeply into its risk management and compliance infrastructure, often with mandated documentation and third-party audits. This necessitates selecting a framework that is both robust and specific in addressing regulatory themes such as anti-discrimination, algorithmic transparency, and data provenance. In contrast, a technology start-up in a lightly regulated industry might prioritize agility, adopting a lighter governance model that supports iterative AI development while still adhering to ethical best practices.

Moreover, industry norms and maturity levels influence how frameworks are operationalized. In mature industries with well-established risk and compliance cultures, AI governance can be seamlessly layered into existing structures. These organizations are more likely to customize governance frameworks to integrate with their enterprise risk management systems, internal controls, and audit functions. Meanwhile, emerging industries may face challenges due to limited precedent or evolving regulations, requiring a proactive and adaptive approach. In such cases, selecting a framework that supports scalability and anticipates regulatory evolution becomes critical. Thus, the intersection of industry context and regulatory status is a key determinant in crafting an AI governance approach that is both compliant and future-proof.

  • Live Off the Land

The start of any journey, such as building an AI Governance program, is to begin with the first step. However, no one ever said that the first step had to be your own. If you are starting the AI Governance program in a relatively mature organization chances are many have taken that first step for you. Start with an inventory of the functions that currently exist or may have existed in the past but were abandoned due to organizational strategic ambivalence. The odds are better-than-even that some levers have already been installed for you. Is there a Data Governance program already in place, or was the program abandoned and segments of the program, such as governing bodies, still exist? If any of those bodies still exist, you may be able to co-opt them into your AI Governance program. The same can be said for any Security or Privacy program elements that may exist, either in nascent or degraded form.

  • Engage the Core!

When implementing an AI Governance program framework consider what your immediate needs are. Implementing an entire framework at once is like doing everything, everywhere, all at once, which as mentioned earlier, is not a best practice but a recipe for organizational friction. A best practice is to start with core elements of a framework, and work your way, outward.

Many of the commonly available AI Governance program frameworks have common elements at the core of their framework. Start with these common core framework components, such as Program Strategy, Communication, Roles and Responsibilities, Change Management, etc. Focusing on the framework core components gives you structure and a way to start building your program in alignment with organizational needs. Starting with elements such as compliance requirements can only resolve questions from one part of your organization, like Enterprise Risk, which is important, but does not address the needs of the AI Governance program in its entirety. Start slow, start with what meets your needs, and …

  • Peel the Onion

The last best practice is to build off what you started with the core components. However, when building out the rest of the AI Governance program framework, take into consideration other program frameworks that may impact the execution of the overall AI System Development process, such as Data Architecture, Data Governance, Data Protection and Privacy, Information Governance, and Security.

It may be helpful to think of each of these frameworks as layers of an onion, each layer being integral to the structure of both associated inner and outer layers. For example, components of an AI Governance program framework related to the availability of trustworthy data hinges upon the execution of robust Data and Information Governance programs, built upon well-defined frameworks.

Implementing best practices for AI governance frameworks is essential to ensure that organizations develop trustworthy, responsible, and sustainable AI capabilities. These best practices emphasize the importance of tailoring framework adoption to the organization’s existing culture, change management maturity, and collaborative capacity. A strong cultural foundation that values ethical decision-making and cross-functional collaboration enables smoother integration of governance principles and fosters buy-in across departments. Organizations with high change management capacity can more effectively navigate the disruptions and adaptations required by AI implementation. By recognizing and leveraging collaborative strengths, such as interdisciplinary teams or stakeholder engagement processes, implementers can embed governance principles more seamlessly into the organization’s operational and strategic workflows.

Moreover, best practices highlight the value of building on existing governance structures rather than starting from scratch. Many organizations already have established risk management, compliance, data governance, or ethics processes that can serve as foundational elements for an AI governance framework. Starting with these core governance components—such as clear accountability, transparency standards, and performance monitoring—and gradually layering in AI-specific practices enables a scalable and pragmatic approach. This iterative build-out supports long-term sustainability and adaptability of the governance framework while minimizing disruption. Ultimately, best practices ensure that AI governance frameworks are not only compliant and robust but also contextually relevant and aligned with the organization’s capacity for change and growth.