AI Governance Engineer
GitHub

AI governance for boards: ask for evidence, not assurances.

For the people who set strategy, approve risk appetite and answer for outcomes: the decisions that are yours, the few numbers to ask for, and what a working governance function can show you.

Who this is for.

You do not need the mechanics. You need to know which decisions only you can take, what to ask for in the board pack, and how to tell a governance function that runs from one that only reports. This route is short on purpose: the argument, the decisions, the oversight.

  • Board members
  • Chief executives and executive committees
  • Chief AI, data and technology officers
  • Audit and risk committees

On the learning path, start at What the discipline is or Maturity self-assessment.

New to the field? Read AI governance explained: the definition, the frameworks and where engineering fits.

Three questions you bring.

Each one answered in brief here, and in full in the Body of Knowledge.

  1. Which decisions are ours to take?

    Whether to use AI for a purpose at all, how much risk the organisation will accept, and what it will not do. A committee takes the exceptions and the risk acceptances against that appetite; the gates in the pipeline enforce everything else.

    The committee decides, the gates enforce

  2. What should we see in the board pack?

    One page generated by a query, not assembled by hand: registry coverage, gate coverage, open exceptions by age, incidents and time to contain, and realised risk reduction, with anything outside appetite flagged for a decision.

    KPIs and KRIs for leadership and the board

  3. What does the law already expect of us?

    In the EU, the AI literacy provision (Art. 4) and the prohibited practices (Art. 5) already apply, with two new prohibitions from 2 Dec 2026; the Annex III high-risk obligations apply from 2 Dec 2027 12. Data protection, consumer, equality and product-liability law apply to AI today.

    The post-Omnibus timeline

Your route through the site.

In reading order: chapters at the section that matters, then the patterns, tools, templates, datasets and figures that turn them into work.

Understand

  1. The Thesis Reference · The argument in one read: governance you can run, not only read.
  2. The three questions Figure · What AI is running, what it may do, and what evidence proves it.
  3. The committee decides, the gates enforce Figure · Who decides, and what enforces the decision.

Decide

  1. Strategy, value and whether to use AI at all Chapter 12 · The use-case decision, taken before any model is chosen.
  2. The committee and its charter Chapter 12 · Authority, membership, escalation, and what stays out of the committee.
  3. Committee charter template Template · Authority, quorum, inputs and outputs, each decision a signed record.
  4. AI policy template Template · One source for the policy people approve and the rules a pipeline runs.
  5. Risk appetite, compiled into gates Chapter 13 · An appetite statement the pipeline can enforce.

Oversee

  1. KPIs and KRIs for the board Chapter 12 · The indicators to ask for, and the one that matters most.
  2. The maturity grid Figure · Where a governance function stands, layer by layer.
  3. Maturity self-check Tool · Ask the team to score the layers and show you the floor.
  4. Who enforces, and the ceilings Figure · Who enforces, and the fine ceilings.
  5. Incident cases Reference · What failed elsewhere, and which control would have caught it.

Start this week.

  1. Ask for the inventory: every AI system in use, with an owner. If it cannot be produced, that is the first finding. AI system register entry
  2. Name one accountable executive and charter the committee that takes exceptions. Committee charter template
  3. Approve a risk-appetite statement that can be compiled into gate thresholds. Risk appetite, compiled into gates
  4. Put six to eight indicators, generated from live systems, on the next board agenda. KPIs and KRIs for the board
  5. Ask which of the next three EU AI Act dates touch your products and services. What applies now

The obligations that matter most.

The duties that land on the organisation as a whole: literacy, prohibitions, classification, the quality management system, deployer duties, and the policy and accountability controls of the management-system standards.

What switches on, and whenThe obligations that matter most on the Executives and boards route, on the dates they first apply and on their later steps, against the register's review date.First appliesIn forceDeferredLater stepReachedAhead2already apply2025-02-022026-07-27As of 2026-09-243still to come2026-12-022027-12-022028-08-022030-08-02EU AI Act Art. 4 · applies from 2025-02-02 · In forceArt. 4EU AI Act Art. 5 · applies from 2025-02-02 · In forceArt. 5Art. 4Art. 5EU AI Act Art. 17 · applies from 2027-12-02 · DeferredArt. 17EU AI Act Art. 26 · applies from 2027-12-02 · DeferredArt. 26EU AI Act Art. 6 · applies from 2027-12-02 · DeferredArt. 6Art. 17Art. 26Art. 6Art. 17Art. 263 without a date (Voluntary)Source: the obligation register(/obligations)As of 2026-09-24
What switches on, and whenThe obligations that matter most on the Executives and boards route, on the dates they first apply and on their later steps, against the register's review date.First appliesIn forceDeferredLater stepReachedAheadDateits place on the time axis2already apply3still to come2026202820302025-02-022026-07-272026-12-022027-12-022028-08-022030-08-02EU AI Act Art. 4 · applies from 2025-02-02 · In forceArt. 4EU AI Act Art. 5 · applies from 2025-02-02 · In forceArt. 5Art. 4Art. 5EU AI Act Art. 17 · applies from 2027-12-02 · DeferredArt. 17EU AI Act Art. 26 · applies from 2027-12-02 · DeferredArt. 26EU AI Act Art. 6 · applies from 2027-12-02 · DeferredArt. 6Art. 17Art. 26Art. 6Art. 17Art. 26As of 2026-09-243 without a date (Voluntary)Source: the obligation register (/obligations)As of 2026-09-24
What switches on, and when The obligations of this route on the date each first applies, drawn by status, and on its later dated steps (a square, filled once reached); the dashed line is the date the rows were last reviewed. Treat what comes before the line as work for now, and read what comes after it as the time left to prepare.
Data table
When the obligations on the Executives and boards route apply
DateObligationStepStatus
2025-02-02EU AI Act Art. 4: AI literacyApplies fromIn force
2025-02-02EU AI Act Art. 5: prohibited practices (incl. new NCII and CSAM bans)Applies fromIn force
2026-07-27EU AI Act Art. 4: AI literacyLater step: Omnibus rewording in force: providers and deployers take measures to support AI literacyIn force
2026-12-02EU AI Act Art. 5: prohibited practices (incl. new NCII and CSAM bans)Later step: New bans on AI-generated NCII and CSAM applyIn force
2027-12-02EU AI Act Art. 17: quality management systemApplies fromDeferred
2027-12-02EU AI Act Art. 26: deployer obligations for high-risk systemsApplies fromDeferred
2027-12-02EU AI Act Art. 6: classification of high-risk AI systems (incl. the Annex III route)Applies fromDeferred
2028-08-02EU AI Act Art. 17: quality management systemLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2028-08-02EU AI Act Art. 26: deployer obligations for high-risk systemsLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2028-08-02EU AI Act Art. 6: classification of high-risk AI systems (incl. the Annex III route)Later step: The Annex I (safety-component) route appliesDeferred
2030-08-02EU AI Act Art. 17: quality management systemLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
2030-08-02EU AI Act Art. 26: deployer obligations for high-risk systemsLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
No dateISO 42001 A.2: Policies related to AIVoluntary
No dateISO 42001 A.3: Internal organizationVoluntary
No dateNIST AI RMF GOVERNVoluntary
Obligation Applies Evidence
EU AI Act Art. 4 AI literacy AIGE-OBL-EUAIA-ART4 In force · Literacy programme as code; role-based training records; onboarding gates
EU AI Act Art. 5 prohibited practices (incl. new NCII and CSAM bans) AIGE-OBL-EUAIA-ART5 In force · Policy-as-code blocklist; input/output guardrails; refusal and abuse detection
EU AI Act Art. 6 classification of high-risk AI systems (incl. the Annex III route) AIGE-OBL-EUAIA-ART6 Deferred · Risk-tiering as code; high-risk classification decision record; register entry flagging Annex III status
EU AI Act Art. 17 quality management system AIGE-OBL-EUAIA-ART17 Deferred · QMS-as-code; versioned policies; pipeline controls and change management
EU AI Act Art. 26 deployer obligations for high-risk systems AIGE-OBL-EUAIA-ART26 Deferred · Deployment registry; monitoring hooks; assigned oversight and logging retention
ISO 42001 · A.2 Policies related to AI AIGE-OBL-ISO42001-A2 Voluntary Policy-as-code library; versioned policy repository
ISO 42001 · A.3 Internal organization AIGE-OBL-ISO42001-A3 Voluntary Operating model; RACI; ownership in the registry
NIST AI RMF · GOVERN AIGE-OBL-NISTRMF-GOVERN Voluntary Policy-as-code; operating model; registry ownership

Every obligation in the register

Sources

  1. [1] Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text of 27 July 2026 (Art. 4 AI literacy, Art. 5 prohibited practices, Art. 113 application dates). Publications Office of the EU (EUR-Lex). 2026-07-27. https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng (verified: primary)
  2. [2] Regulation (EU) 2026/1744 (Digital Omnibus on AI) (Art. 5(1)(ba) and (bb) prohibitions from 2 December 2026; Annex III high-risk obligations from 2 December 2027). Publications Office of the EU (EUR-Lex). 2026-07-24. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng (verified: primary)

Other routes.

  1. For engineers ML, platform, MLOps, application and security engineers who build and run AI systems.
  2. For CISOs and risk leads CISOs, heads of risk, model risk managers, internal audit and third-party risk managers.
  3. For legal counsel and DPOs In-house counsel, data protection officers, privacy and compliance leads, and contract managers.
  4. For the public sector Public bodies and operators of public services: CIOs, service owners, procurement and oversight.
  5. For SMEs and start-ups Small and medium-sized companies and start-ups, most of them buying more AI than they build.
  6. AIGP candidates The public AIGP body of knowledge read against this site. Not affiliated with or endorsed by IAPP.
  7. Certifications Certifications and assessments in AI governance, and what each one evidences.

Start at the top of the route.

Step 01 is The Thesis. Each step after it builds on the one before.

Open step 01 All routes