6.1 Building an AI governance program & maturity models

IAPP Artificial Intelligence Governance Professional AIGP

Track your progress as you read

Finished sections get a check mark.

1 Overview & AI Governance Foundations

1.1 AIGP exam facts & study strategy 1.2 What AI is: ML, deep learning & generative AI 1.3 Responsible AI principles 1.4 Stakeholders, roles & the AI lifecycle

2 Laws & Regulations Applying to AI

2.1 Existing law applied to AI: privacy, data protection & IP 2.2 Discrimination, consumer protection & liability 2.3 AI-specific laws: the EU AI Act & the US landscape

3 Standards & Frameworks

3.1 The OECD AI Principles 3.2 The NIST AI Risk Management Framework 3.3 ISO/IEC standards & assurance/audit

4 Governing AI Development

4.1 Use-case definition & impact/risk assessment 4.2 Design & build controls 4.3 Data governance: quality, bias & provenance 4.4 Training, testing & release readiness

5 Governing AI Deployment & Use

5.1 Deployment decisions & human oversight 5.2 Vendor & third-party risk review 5.3 Post-market monitoring & incident response 5.4 User controls, transparency & downstream-harm mitigation

6 Operationalizing AI Governance

6.1 Building an AI governance program & maturity models 6.2 Documentation, traceability & continuous improvement

6.1 Building an AI governance program & maturity models

Key Takeaways Explain This Topic AI

A cross-functional AI governance committee spanning legal, privacy, security, data science, and business units, backed by an executive sponsor such as a Chief AI Officer, gives an AI program the authority to set and enforce policy.

In a RACI matrix the single "Accountable" party for an AI outcome cannot delegate that ownership, which stops accountability from dissolving across a committee.

An AI use-case inventory (registry) that records each system's purpose, data, owner, and risk tier is the foundational asset enabling per-system obligations such as those in the EU AI Act, and it also surfaces unsanctioned shadow AI.

Risk-tiering drives proportionate, gated review workflows so high-risk systems get deeper assessment—bias testing, DPIA, committee sign-off—than minimal-risk ones.

Maturity models such as the NIST AI RMF and ISO/IEC 42001, often scored on a five-level scale from ad hoc to optimizing, let organizations benchmark current state and build an improvement roadmap through recurring re-assessment.

Last updated: July 2026

Standing up an enterprise AI governance program

An AI governance program translates high-level principles—fairness, transparency, accountability, safety—into repeatable organizational practice. The AIGP exam expects you to know the building blocks and the rough order in which a maturing program assembles them: leadership and structure first, then policies, an inventory, risk-tiering, review workflows, training, and finally integration with the controls the organization already runs.

Governance structure and RACI

Effective governance begins with a clear operating structure. Most organizations establish a cross-functional AI governance committee (sometimes an AI council or review board) that reports to senior leadership and, ultimately, the board. Membership spans legal, privacy, information security, data science, compliance, ethics, procurement, human resources, and affected business units, because AI risk is inherently multidisciplinary. An executive sponsor—often a Chief AI Officer, Chief Privacy Officer, or Chief Data Officer—supplies authority and budget so decisions stick. Many mature firms overlay a three-lines-of-defense model: business owners own the risk (first line), governance and compliance set policy and challenge it (second line), and internal audit independently assures it (third line).

Because many people touch an AI system, roles must be explicit. A RACI matrix (Responsible, Accountable, Consulted, Informed) assigns each lifecycle activity—data sourcing, model development, validation, deployment approval, monitoring—to named owners. Critically, the Accountable party for an outcome is a single individual who cannot delegate ownership, which prevents accountability from evaporating across a committee.

• Role Typical responsibility
• AI governance committee Sets policy, approves high-risk use cases
• Executive sponsor / CAIO Accountable for the program, secures resources
• Model / product owner Accountable for a specific system's outcomes
• Risk & compliance Independent review, control testing
• Data science / ML engineering Responsible for building and documenting models
• Internal audit Independent assurance over the program
• Policies, standards, and the use-case inventory

Policies express organizational intent; standards make them operational. A program typically defines an acceptable-use policy , ethical AI principles, model-development and documentation standards, human-oversight requirements, a generative-AI and third-party/procurement standard governing vendor and foundation-model use, and data-governance rules covering quality, provenance, and retention.

None of this can be governed without visibility. An AI use-case inventory (registry) is the foundational asset: a living catalog of every AI system with metadata such as purpose, data sources, model type, business owner, deployment status, and assigned risk tier. The inventory is what lets an organization answer regulator and board questions—"How many high-risk systems do we operate?"—and it is a practical prerequisite for EU AI Act obligations, which attach per system rather than to the organization as a whole. A live inventory also surfaces shadow AI , the unsanctioned tools employees adopt on their own, which are a fast-growing source of unmanaged risk.

Risk-tiering and review workflows

Not every system warrants the same scrutiny, so programs apply risk-tiering . Many map their tiers to the EU AI Act's categories—prohibited, high-risk, limited-risk (transparency), and minimal-risk—or define internal tiers by impact on individuals, degree of autonomy, and scale of use. Tiering drives a gated review workflow : an intake form triggers triage, higher tiers demand deeper assessment (bias testing, a data protection impact assessment, human-oversight design, and committee sign-off), and lower tiers follow a lightweight path. This proportionate model concentrates scarce review effort where potential harm is greatest, and it lets low-risk innovation proceed without bottlenecking on a single committee. A tier is not permanent: a system's classification should be revisited when its purpose, data, autonomy, or user base changes, because a low-risk internal pilot can become high-risk once it is scaled to decisions about people.

Training, culture, and program integration

Governance fails if only specialists understand it. Role-based training builds AI literacy for developers, procurement staff, and business users, plus general awareness for the wider workforce. Notably, EU AI Act Article 4 obliges providers and deployers to ensure a sufficient level of AI literacy among their staff, applicable from February 2025—an exam-relevant hook that ties culture directly to a hard legal requirement. Culture also means safe channels to raise concerns and a clear tone from the top that speed to market is never a reason to skip review.

An AI program should not be built in isolation. Mature organizations integrate AI governance with existing privacy, security, and GRC programs , reusing DPIA processes, security controls, third-party risk management, and, in regulated sectors, model risk management practices such as U.S. banking guidance SR 11-7. Reuse reduces duplication and embeds AI oversight into workflows people already follow, rather than bolting on a parallel bureaucracy that teams route around.

Maturity models

Maturity models let an organization assess where it stands and plan improvement. Reference frameworks such as the NIST AI Risk Management Framework (with its Govern, Map, Measure, and Manage functions) and the certifiable management-system standard ISO/IEC 42001 describe target practices. Capability maturity is often expressed on a five-level scale— Initial/ad hoc → Repeatable → Defined → Managed/measured → Optimizing —where lower levels depend on individual heroics and higher levels feature standardized, measured, continuously improving processes. Scoring current maturity against a target state produces a prioritized roadmap; a maturity assessment is a recurring exercise, not a one-time grade, and re-assessing periodically demonstrates progress to leadership and regulators.