What Is AI Governance? A Starting Guide for Organisations

Why does AI governance matter for organisations?#

AI governance matters because AI outputs can be wrong, biased or based on data that should not have been used, and the organisation, not the tool, answers for the result. Governance gives you a way to use AI with confidence: decisions are recorded, risks are checked in proportion, and someone owns each system.

Singapore's Model AI Governance Framework sets out two guiding principles, as summarised by the PDPC:

• decisions made by AI should be explainable, transparent and fair
• AI systems should be human-centric

Explainability means people can understand, in suitable terms, how an AI output was reached. Fairness includes checking for bias, where outputs systematically favour or disadvantage some groups. Human-centric means the system serves people and protects them from harm.

Governance is not only for organisations that build AI. If staff use a generative AI tool to draft customer emails, the organisation still needs to know which tool, what data goes in and who checks what comes out.

How does AI governance work in practice?#

AI governance works through a few connected practices. Singapore's Model AI Governance Framework groups them into four areas: internal governance structures and measures, deciding the level of human involvement in AI-augmented decisions, operations management, and stakeholder interaction and communication. Together they turn broad principles into everyday routines.

The PDPC released the first edition on 23 January 2019 and the second edition on 21 January 2020. It describes the framework as detailed and readily implementable guidance for private sector organisations, taking a sector- and technology-agnostic approach. The table summarises the four areas as the PDPC page lists them.

The second area is often described as keeping a human in the loop. The more harm a wrong output could cause, the more human involvement it needs.

The PDPC also publishes a companion Implementation and Self-Assessment Guide for Organisations (ISAGO), to help organisations assess how well their practices align with the framework.

Which frameworks guide AI governance?#

Several public frameworks guide AI governance, and they fit together rather than compete. Singapore's Model AI Governance Framework and its generative AI companion give practical guidance, AI Verify helps organisations test against governance principles, the OECD AI Principles set international values, and the NIST AI Risk Management Framework organises risk work.

The OECD lists its five values-based principles as: inclusive growth, sustainable development and well-being; human rights and democratic values, including fairness and privacy; transparency and explainability; robustness, security and safety; and accountability.

The nine dimensions of the generative AI framework are accountability, data, trusted development and deployment, incident reporting, testing and assurance, security, content provenance, safety and alignment research and development, and AI for public good.

NIST describes Govern as a cross-cutting function that informs the other three, and notes that its actions are not a checklist. In July 2024 it also released a Generative Artificial Intelligence Profile to help organisations identify risks specific to generative AI.

The AI Verify Foundation states that the AI Verify Testing Framework is mapped to other frameworks, including the NIST AI RMF and the international standard ISO/IEC 42001. For who AI Verify suits, read what is AI Verify, and who is it for?.

What does a starting AI governance programme include?#

A starting programme can be small. List where AI is used, name an owner for each use, write a short AI use policy, sort uses by risk, decide where a person must review outputs, test before launch, set up a way to report problems, and review the whole picture on a regular schedule.

1. Make a register. List every AI tool and use, including free tools staff already use.
2. Name owners. Each use has one person accountable for it.
3. Write a short policy. An AI use policy sets out approved tools, what data may go in and who checks outputs. Our guide on how to write an AI use policy includes a template.
4. Sort by risk. A simple AI risk assessment separates low-risk drafting from uses that affect customers or decisions. See our step-by-step AI risk assessment guide.
5. Set human review. Decide where a person must check outputs, starting with the highest-risk uses.
6. Test before launch. Try each use on realistic examples, including awkward ones.
7. Plan for incidents. The generative AI framework includes incident reporting because, in its words, no AI system is foolproof. Give staff a simple way to report errors.
8. Review regularly. Revisit the register and policy when tools, uses or rules change.

Data rules belong in this programme from the start. Under the PDPA, personal data is data about an individual who can be identified from that data, or from that data and other information the organisation has or is likely to have access to.

What does this look like in a Singapore workplace?#

Consider a fictional online homeware retailer in Paya Lebar. Staff use a generative AI tool to write product descriptions, and the owner is considering a chatbot that answers delivery questions. This illustrative example shows how the owner could set up basic AI governance in a few steps, without claiming any outcome.

The owner starts with a one-page register:

Next, the owner writes a short policy: approved tools only, no customer details in unapproved tools, and every published description checked by a person. Before the chatbot goes live, the team tests it on realistic and awkward questions, adds a clear notice that customers are talking to an AI assistant, and offers a way to reach a person. A shared sheet logs any wrong answers. Every few months the owner reviews the register.

None of this requires a certificate or a consultant. It requires knowing what is in use, who owns it and how problems are caught.

Common mistakes#

Common AI governance mistakes include writing a long policy nobody reads, treating governance as a one-off project, governing only the AI you build while ignoring tools staff already use, and copying a framework wholesale without fitting it to your risks. Governance works best when it is proportionate and owned.

• Policy without practice. A document is not governance unless people follow it and someone checks.
• One-off effort. Tools and uses change, so the register and policy need regular review.
• Ignoring everyday tools. Free chatbots used by staff carry real data risks.
• Copying wholesale. Frameworks are guidance to adapt, not forms to fill in.
• Same treatment for every use. Drafting a social post and screening job applicants need different levels of review.
• Overclaiming. Do not say or imply you comply with, or are certified against, a framework or standard unless that is formally true.

What to learn next#

Once you understand what AI governance is, the next steps are practical: write your policy, assess your risks, and learn how testing tools such as AI Verify support assurance. Building and testing a simple AI app yourself is also a good way to see where governance questions arise in practice.

• Browse all governance guides in AI governance.
• See where governance fits among other topics in the AI learning pathway.
• GenAI Builder Sprint is a 2-day classroom course where adults plan, build, test and launch a simple AI app, including responsible use. See the GenAI Builder Sprint course page.

Sources#

1. Singapore’s Approach to AI Governance, Personal Data Protection Commission (PDPC), accessed 8 November 2026
2. MGF for GenAI, AI Verify Foundation, accessed 8 November 2026
3. What is AI Verify Testing Framework, AI Verify Foundation, accessed 8 November 2026
4. AI Principles Overview, OECD.AI, accessed 8 November 2026
5. AI Risk Management Framework, National Institute of Standards and Technology (NIST), accessed 8 November 2026
6. Artificial Intelligence Risk Management Framework (AI RMF 1.0), National Institute of Standards and Technology (NIST), accessed 8 November 2026
7. PDPA Overview, Personal Data Protection Commission (PDPC), accessed 8 November 2026

Frequently asked questions#

What is AI governance?+

The set of roles, rules and checks an organisation uses to decide how AI is chosen, built, used and monitored, so that it stays useful, lawful and trustworthy. In practice it means knowing where AI is used, who is accountable, which risks matter and how people can question or correct outputs.

What is Singapore's Model AI Governance Framework?+

Guidance for private sector organisations on key ethical and governance issues when deploying AI. The first edition was released on 23 January 2019 and the second on 21 January 2020. It groups measures into four areas: internal governance structures and measures, the level of human involvement in AI-augmented decisions, operations management, and stakeholder interaction and communication.

Is there a framework for generative AI?+

Yes. The Model AI Governance Framework for Generative AI, released on 30 May 2024, outlines nine dimensions, from accountability and data to incident reporting, testing and assurance, security and content provenance.

How do the OECD AI Principles and the NIST AI RMF fit in?+

The OECD AI Principles, adopted in 2019 and updated in May 2024, set five values-based principles, and Singapore is listed as an adherent. The NIST AI Risk Management Framework is intended for voluntary use and organises risk work into four functions: Govern, Map, Measure and Manage.

Where should a small organisation start with AI governance?+

List where AI is used, name an owner for each use, write a short AI use policy, sort uses by risk, decide where a person must review outputs, test before launch, set up a way to report problems and review the picture regularly.

What are common AI governance mistakes?+

Writing a long policy nobody reads, treating governance as a one-off project, ignoring AI tools staff already use, copying a framework wholesale without fitting it to your risks, and claiming compliance or certification you do not have.