As AI moves into decisions that affect customers, employees, and safety, the question is no longer only can we build it but should we, and under what controls. Governance and responsible-AI practices exist to manage risk, meet emerging regulation, and preserve trust. Done well, governance is an enabler: it lets an organisation deploy higher-impact use cases with confidence, rather than a brake that stops everything.

Two widely referenced frameworks anchor practice. The NIST AI Risk Management Framework (AI RMF) is a voluntary, risk-based framework organised around four functions, commonly summarised as Govern, Map, Measure, and Manage, helping organisations identify and manage AI risks across the lifecycle. ISO/IEC 42001 is an international standard for an AI management system (AIMS), providing a certifiable, auditable management-system approach (similar in spirit to other ISO management standards) for governing AI responsibly.

Around these sit recurring responsible-AI principles: risk tiering (higher-impact uses get stricter controls), human oversight (a person can review, override, or halt consequential decisions), transparency (people know when AI is used and can get meaningful explanations), and accountability (clear ownership for outcomes). Regulation is tightening: the EU AI Act takes a risk-based approach, imposing stricter obligations on higher-risk AI systems and prohibiting certain uses; executives should be aware of it even outside the EU because it can apply extraterritorially and shapes global norms.

A bank plans an AI tool that influences credit decisions, a clearly high-impact use. Under a risk-tiered approach it receives the strongest controls: documented data and model evaluation for bias, a human able to review and override adverse decisions, clear notice and explanations to applicants, logging for audit, and a named accountable owner. A lower-impact internal use, such as summarising meeting notes, receives lighter controls.

The organisation maps this to frameworks: it uses the NIST AI RMF functions to structure how it governs, maps, measures, and manages the risk, and pursues an ISO/IEC 42001-style management system so the approach is repeatable and auditable. Controls are proportionate to impact, not uniform.

Governance constrains strategy by ruling some use cases out and shaping how others must be built. It applies most sharply to the agentic landscape, where higher autonomy means higher-risk systems needing oversight, transparency, and accountability. It is a core dimension of maturity and is frequently the one that most limits scaling. And it is operationalised through the operating model, which assigns who owns risk decisions and enforces the controls day to day.