# AI Governance Operating Model for Teams That Ship | Dexity

> Build operational AI governance on NIST AI RMF: operating model, system registry, risk tiers, and pre-deployment gates that actually control.

AI at Work

# AI Governance for Teams That Ship in 2026: An Operating Model, Not a Policy PDF

Operational AI governance is the set of controls that gate what you deploy, not a policy document. Build it on NIST AI RMF's four functions — Govern, Map, Measure, Manage (NIST.AI.100-1, released Jan 26, 2023) — then wire in a named operating model, an AI system registry, risk tiers, pre-deployment gates, and an incident runbook. This playbook ships all of it plus a single crosswalk mapping each control to NIST AI RMF, ISO/IEC 42001:2023, and dated EU AI Act obligations (Article 50 transparency lands Aug 2, 2026).

17 August 2026

12 min read

Author

[Madhav Sharma](https://www.linkedin.com/in/madhavsharma99/)

Tech Lead - Machine Learning, Dexity

![A governance reviewer with a clipboard checklist clears an AI system robot through a pre-deployment gate marked with a shield, next to a registry board of risk-tiered AI systems.](/assets/intel-govern-the-ai-you-ship-hero-46aa84.webp)

On this page

1.  [What is AI governance for teams that ship — and how do you govern the AI you deploy in 2026?](#what-is-ai-governance-for-teams-that-ship-and-how-do-you-govern-the-ai-you-deploy-in-2026)
2.  [The data: what the frameworks and the market actually say](#the-data-what-the-frameworks-and-the-market-actually-say)
3.  [The operating model: name who owns what](#the-operating-model-name-who-owns-what)
4.  [The AI system registry: the one artifact everyone mentions and no one specs](#the-ai-system-registry-the-one-artifact-everyone-mentions-and-no-one-specs)
5.  [Risk tiering: objective triggers, not vibes](#risk-tiering-objective-triggers-not-vibes)
6.  [Pre-deployment review gates: governance you can enforce in CI/CD](#pre-deployment-review-gates-governance-you-can-enforce-in-ci-cd)
7.  [Incident response: a runbook mapped to NIST Manage and the OWASP LLM Top 10](#incident-response-a-runbook-mapped-to-nist-manage-and-the-owasp-llm-top-10)
8.  [The differentiator: one controls-to-frameworks crosswalk](#the-differentiator-one-controls-to-frameworks-crosswalk)
9.  [The 30-day minimum viable governance rollout](#the-30-day-minimum-viable-governance-rollout)
10.  [Related reading](#related-reading)

## What is AI governance for teams that ship — and how do you govern the AI you deploy in 2026?

AI governance for teams that ship is the set of **controls that gate what you deploy** — an operating model, a system registry, risk tiers, pre-deployment review gates, evals, monitoring, and an incident runbook — not a policy essay. The fastest way to make it real is to build on the **NIST AI Risk Management Framework**, which is organized into four core functions: **Govern, Map, Measure, and Manage** (NIST.AI.100-1, released **January 26, 2023** as voluntary guidance). Govern is cross-cutting; Map sets risk context; Measure assesses risk; Manage covers risk treatment and incident response ([NIST](https://www.nist.gov/itl/ai-risk-management-framework)). Everything below maps every internal control back to one of those four functions, then crosswalks it to **ISO/IEC 42001:2023** and the **EU AI Act**.

Governance you can enforce in CI/CD beats governance that lives in a PDF. If a control cannot block a deploy, it is documentation — not a control.

## The data: what the frameworks and the market actually say

-   **NIST AI RMF 1.0** has **4 functions** — Govern / Map / Measure / Manage — released **Jan 26, 2023** (NIST.AI.100-1) ([NIST](https://www.nist.gov/itl/ai-risk-management-framework)).
-   The **NIST Generative AI Profile** (NIST-AI-600-1) was released **July 26, 2024**, extending the RMF to GenAI-specific risks such as confabulation, prompt injection, and data privacy — same four functions ([NIST](https://www.nist.gov/itl/ai-risk-management-framework)).
-   **ISO/IEC 42001:2023**, published **December 2023**, is the first certifiable international standard for an **AI Management System (AIMS)**: build against clauses **4–10**, select applicable **Annex A** controls, then certify via Stage 1 (documentation) and Stage 2 (operational) audits ([ISO](https://www.iso.org/standard/42001)).
-   The **EU AI Act** entered into force **August 1, 2024**; prohibited-practice bans and AI-literacy duties began **February 2, 2025**; GPAI obligations, governance provisions, and penalties began **August 2, 2025**; general application lands **August 2, 2026** ([artificialintelligenceact.eu](https://artificialintelligenceact.eu/implementation-timeline/); [Gibson Dunn](https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/)).
-   The **OWASP Top 10 for LLM Applications 2025** puts **LLM01 Prompt Injection** in the top spot, with **System Prompt Leakage** and **Vector & Embedding Weaknesses** new to the 2025 edition ([OWASP GenAI Security Project](https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/)).
-   Per secondary reporting of a Deloitte enterprise AI-agent survey, roughly **74%** of enterprises expect moderate-to-extensive AI agent adoption within two years, yet only about **21%** describe their AI governance as mature — a deploy-vs-govern gap. Treat these figures as directional pending Deloitte's primary report ([via PartnerInAI](https://partnerinai.com/blogs/enterprise-ai-agent-governance-statistics-deloittes-warning)).

## The operating model: name who owns what

Most "AI governance framework" pages describe committees; teams that ship need named owners tied to specific artifacts. Assign five roles and make ownership unambiguous. This operationalizes **NIST Govern**, which is the cross-cutting function ([NIST](https://www.nist.gov/itl/ai-risk-management-framework)).

| Artifact / decision | System Owner | Governance / Risk Lead | Security | Legal / Compliance | ML / Engineering |
| --- | --- | --- | --- | --- | --- |
| AI system registry entry | **Accountable** | Consulted | Informed | Informed | Responsible |
| Risk-tier assignment | Responsible | **Accountable** | Consulted | Consulted | Informed |
| Pre-deployment review gate | Responsible | **Accountable** | Consulted | Consulted | Responsible |
| Evals + monitoring thresholds | Consulted | Consulted | Consulted | Informed | **Accountable** |
| Incident response | Responsible | Consulted | **Accountable** | Consulted | Responsible |
| Regulatory mapping (EU AI Act / state law) | Informed | Consulted | Informed | **Accountable** | Informed |

The **System Owner** is the single throat to choke for a given AI system — they own its registry entry and its business purpose. The **Governance/Risk Lead** owns the tiering decision and the gate. This is the "who owns what" layer competitors gesture at but rarely name.

## The AI system registry: the one artifact everyone mentions and no one specs

A registry (or inventory) is how you operationalize **Govern** — you cannot govern systems you cannot enumerate. Every AI system in production gets one row with these fields:

| Field | Example value | Why it matters |
| --- | --- | --- |
| System ID | `svc-support-triage-01` | Stable key for audit trails |
| Owner | Name + team | Accountability (RACI above) |
| Purpose | "Classify inbound support tickets" | Maps to intended use under EU AI Act |
| Data classes | Customer PII, ticket text | Drives risk tier + EU AI Act duties |
| Model + prompt version | `gpt-class-v4 / prompt@a91f` | Reproducibility, drift, rollback |
| Tools / credentials | Zendesk write, CRM read | Excessive Agency exposure (OWASP LLM06) |
| Risk tier | Tier 2 | Determines gate depth |
| Status | Production / staging / retired | Lifecycle state |
| Last review date | 2026-08-18 | Forces periodic re-review |

Version the registry in the same repo as your code so an entry is a merge requirement, not an afterthought. This is the artifact that turns **NIST Map** (set risk context) into something enforceable.

## Risk tiering: objective triggers, not vibes

The **EU AI Act** uses risk tiers — prohibited, high-risk, limited-transparency, and minimal — as its regulatory backbone ([artificialintelligenceact.eu](https://artificialintelligenceact.eu/implementation-timeline/)). Mirror that internally with objective triggers so tiering is repeatable.

| Tier | Objective triggers | Review depth |
| --- | --- | --- |
| **Tier 1 — Low** | Internal-only, no PII, human reviews every output, no external actions | Registry entry + owner sign-off |
| **Tier 2 — Elevated** | Customer-facing, or touches PII, or takes bounded external actions | Registry + eval suite + security review + monitoring |
| **Tier 3 — High** | Consequential decisions (credit, hiring, health, safety), or autonomous actions on production systems | Full gate: evals, red-team, legal review, human-in-the-loop, incident runbook, executive sign-off |

Map each internal tier to its likely **EU AI Act** category and confirm with Legal — a Tier 3 system may fall under high-risk obligations or Article 50 transparency duties depending on use.

Autonomous agents jump tiers fast. Any system that can write to production, move money, or take irreversible actions is Tier 3 by default — regardless of how "simple" the model looks. OWASP flags **Excessive Agency** and **Unbounded Consumption** as 2025 top-10 LLM risks for exactly this reason ([OWASP](https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/)).

## Pre-deployment review gates: governance you can enforce in CI/CD

Tie gates to the lifecycle so each stage transition requires passing controls. This makes **evals and monitoring governance controls**, not just MLOps hygiene.

1.  **Registration gate (Map).** No system reaches staging without a complete registry entry and an assigned risk tier. Enforce as a merge check.
2.  **Staging / eval gate (Measure).** The system must pass a versioned eval suite against your defined thresholds. For LLM systems, fold in the **NIST Generative AI Profile** risk categories (confabulation, prompt injection, data privacy) and run adversarial tests against the **OWASP LLM Top 10** — starting with **LLM01 Prompt Injection** ([NIST](https://www.nist.gov/itl/ai-risk-management-framework); [OWASP](https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/)).
3.  **Production gate (Manage).** Tier 2+ requires security review, defined rollback, and a signed-off monitoring plan before traffic. Tier 3 adds legal review and human-in-the-loop.
4.  **Monitoring gate (Measure + Manage, continuous).** Drift, output-quality regression, cost/latency anomalies, and safety-eval failures page the owner and can auto-rollback. A failed threshold is a governance event, not just an alert.

Evals are your **Measure** function and monitoring is your continuous **Measure + Manage** loop. If your eval suite is versioned and blocks deploys, you have already built most of what an ISO/IEC 42001 auditor wants to see under the operational (Stage 2) audit ([ISO](https://www.iso.org/standard/42001)).

## Incident response: a runbook mapped to NIST Manage and the OWASP LLM Top 10

**Manage** covers risk treatment and incident response ([NIST](https://www.nist.gov/itl/ai-risk-management-framework)). Pre-write the runbook so on-call is not improvising.

-   **Detect.** Monitoring threshold breach, user report, or red-team finding. Classify against the **OWASP LLM Top 10 2025** failure mode — e.g., **Prompt Injection (LLM01)**, **Sensitive Information Disclosure (LLM02)**, **System Prompt Leakage**, **Data & Model Poisoning**, or **Excessive Agency** ([OWASP](https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/)).
-   **Contain.** Roll back to the last known-good model + prompt version from the registry; revoke over-broad tool credentials.
-   **Assess.** Owner + Security determine blast radius; Legal checks for notification/transparency obligations (EU AI Act Article 50 transparency duties apply from **Aug 2, 2026**).
-   **Remediate + learn.** Patch, add an eval that would have caught it, update the registry review date, and record the incident as evidence for your ISO/IEC 42001 management review.

## The differentiator: one controls-to-frameworks crosswalk

This is the table incumbents gesture at but never build cleanly — each internal control mapped to its **NIST AI RMF** function, the relevant **ISO/IEC 42001** layer, and the specific **EU AI Act** obligation with an honest date.

| Internal control | NIST AI RMF function | ISO/IEC 42001:2023 | EU AI Act obligation + date |
| --- | --- | --- | --- |
| Operating model + accountability | **Govern** | Clauses 5 (leadership), 6 (planning) | Governance provisions applying **Aug 2, 2025** ([timeline](https://artificialintelligenceact.eu/implementation-timeline/)) |
| AI system registry / inventory | **Govern → Map** | Clause 8 (operation) + Annex A controls | Underpins provider/deployer duties across the phased timeline |
| Risk tiering | **Map** | Clause 6.1 (risk), Annex A | Mirrors Act risk tiers (prohibited / high-risk / limited / minimal) |
| Prohibited-use screen | **Map** | Clause 8 | Prohibited-practice bans applied **Feb 2, 2025** |
| Evals / testing | **Measure** | Clause 9 (performance evaluation) | Evidence toward high-risk conformity duties |
| Monitoring / drift | **Measure → Manage** | Clause 9.1 (monitoring) | Ongoing post-market monitoring expectation |
| Transparency to users | **Manage** | Annex A | **Article 50** transparency for chatbots + synthetic content, live **Aug 2, 2026** ([Gibson Dunn](https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/)) |
| Incident response | **Manage** | Clause 10 (improvement) | Serious-incident handling under high-risk regime |
| GPAI / model-provider duties | **Govern → Manage** | Clauses 4–10 | GPAI obligations from **Aug 2, 2025**; legacy GPAI grace to **Aug 2, 2027** |

**Honest caveat on high-risk timing.** Under the EU **Digital Omnibus** (Commission proposal published **Nov 19, 2025**; political/provisional agreement reached **May 2026**), high-risk obligations are proposed to be postponed — stand-alone **Annex III** systems to **December 2, 2027**, and AI embedded in regulated products under **Annex I** to **August 2, 2028**. These changes take legal effect only upon formal adoption and publication in the Official Journal (expected before Aug 2, 2026) — **treat as not-yet-final** ([Gibson Dunn](https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/)). Article 50 transparency stays on **Aug 2, 2026** regardless of high-risk postponements.

**US deployers, don't wait for Brussels.** State law is the domestic analogue and it is in flux: Colorado's original AI Act (**SB24-205**) was delayed to **June 30, 2026** (via SB25B-004), then replaced by **SB26-189**, signed **May 14, 2026**, taking effect **January 1, 2027**; Texas **TRAIGA** is the other deployer-facing regime to track ([Seyfarth](https://www.seyfarth.com/news-insights/colorado-enacts-artificial-intelligence-replacement-law.html)). Build to NIST AI RMF and you are largely portable across both.

## The 30-day minimum viable governance rollout

-   **Week 1 — Inventory.** Stand up the registry and log every AI system in production. Assign owners (Govern).
-   **Week 2 — Tier + gate.** Apply the 3-tier model; wire the registration and eval gates into CI/CD (Map + Measure).
-   **Week 3 — Evals + monitoring.** Ship a versioned eval suite for Tier 2+ systems and turn on drift/quality monitoring with paging thresholds (Measure + Manage).
-   **Week 4 — Incident + crosswalk.** Publish the incident runbook and complete the framework crosswalk with Legal, dating each EU AI Act / state-law obligation (Manage + Govern).

## Related reading

-   [AI governance in 2026](/intel/ai-governance-2026)
-   [Streamlining AI evaluation in production with data collection and error analysis](/intel/streamlining-ai-evaluation-in-production-with-data-collection-and-error-analysis)
-   [AI red teaming in 2026](/intel/ai-red-teaming-2026)

* * *

Governance is a skill you build by shipping controls, not by writing policy. If your team already has AI in production and needs an operating model, registry, gates, and an incident runbook you can enforce, work through it hands-on in the Govern the AI You Ship course.

_Sources: [NIST — AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework); [ISO/IEC 42001:2023](https://www.iso.org/standard/42001); [EU AI Act Implementation Timeline (artificialintelligenceact.eu)](https://artificialintelligenceact.eu/implementation-timeline/); [Gibson Dunn — EU AI Act Omnibus Agreement](https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/); [OWASP GenAI Security Project — Top 10 for LLM Applications 2025](https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/); [Seyfarth — Colorado enacts AI replacement law (SB26-189)](https://www.seyfarth.com/news-insights/colorado-enacts-artificial-intelligence-replacement-law.html); Deloitte enterprise AI-agent survey (via [PartnerInAI](https://partnerinai.com/blogs/enterprise-ai-agent-governance-statistics-deloittes-warning), directional)._

## Frequently asked questions

What is the difference between AI governance and an AI policy?

An AI policy is a written statement of intent; AI governance is the set of **controls that enforce it** — registry, risk tiers, pre-deployment gates, evals, monitoring, and incident response. For teams that ship, the test is simple: can the control block a deploy? If not, it is policy, not governance.

Which framework should we start with — NIST AI RMF, ISO 42001, or the EU AI Act?

Start with **NIST AI RMF** as your operating-model backbone — its four functions (Govern, Map, Measure, Manage) map cleanly onto controls and it is voluntary and free ([NIST](https://www.nist.gov/itl/ai-risk-management-framework)). Use **ISO/IEC 42001:2023** when you need a certifiable management system, and treat the **EU AI Act** as the dated obligation layer you map controls to.

When do EU AI Act obligations actually apply?

Phased: prohibited practices and AI-literacy duties from **Feb 2, 2025**; GPAI and governance provisions from **Aug 2, 2025**; general application and Article 50 transparency from **Aug 2, 2026**. Proposed high-risk postponements (Annex III to **Dec 2, 2027**, Annex I to **Aug 2, 2028**) are **not yet final** pending formal adoption ([artificialintelligenceact.eu](https://artificialintelligenceact.eu/implementation-timeline/); [Gibson Dunn](https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/)).

How do evals and monitoring count as governance controls?

They are your **Measure** function under NIST AI RMF. A versioned eval suite that gates deploys and monitoring thresholds that page owners and can auto-rollback turn model quality into an enforceable control — and they double as evidence for an ISO/IEC 42001 Stage 2 operational audit ([ISO](https://www.iso.org/standard/42001)).

What threats should a pre-deployment review gate test for?

For LLM and agent systems, test against the **OWASP Top 10 for LLM Applications 2025**, starting with **LLM01 Prompt Injection**, plus Sensitive Information Disclosure, Excessive Agency, System Prompt Leakage, and Data & Model Poisoning ([OWASP](https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/)). Fold in the NIST Generative AI Profile's GenAI risk categories for confabulation and data privacy.

Do US teams need to care about the EU AI Act?

If you serve EU users you do. Even if you don't, US state law is converging on similar deployer duties — Colorado's **SB26-189** (effective **Jan 1, 2027**) and Texas **TRAIGA** ([Seyfarth](https://www.seyfarth.com/news-insights/colorado-enacts-artificial-intelligence-replacement-law.html)). Building to NIST AI RMF keeps you portable across both regimes.

## More in AI at Work

[All Intel →](/intel)

[AI at Work

### AI Agent Frameworks in 2026: LangGraph vs CrewAI vs AutoGen vs OpenAI Agents SDK, Compared

There's no single "best" AI agent framework — the right pick depends on your stack and how much control you need. In 2026 the main options are LangGraph (graph-based, most control, strongest for production and complex multi-agent), CrewAI (role-based "crews," fastest to prototype), AutoGen/AG2 (conversation-driven multi-agent), and the OpenAI Agents SDK (lightweight, handoff-based, Python + TypeScript), plus LlamaIndex Workflows, Google ADK, Pydantic AI (type-safe), and the Microsoft Agent Framework (the AutoGen + Semantic Kernel successor). Many teams skip frameworks and build agents with the model SDK plus a loop — Anthropic and Microsoft both recommend starting there. This guide compares them on language, abstraction, multi-agent support, state/memory, and best-fit, with version and maturity claims attributed and dated (they drift).

17 September 2026 · 12 min read](/intel/ai-agent-frameworks-2026) [AI at Work

### How to Build an AI Agent in 2026: A Practical Guide for Engineers

You build an AI agent by wrapping a large language model in a loop: the model gets a goal, decides an action, calls a tool, reads the result, and repeats until the task is done. The core pieces are a controller model, tools defined as JSON schemas, a memory system, an orchestration loop, and a termination condition. Tools are exposed through function-calling APIs — the model returns a structured call, your code runs it, and you feed the output back. The hard part isn't the loop; it's knowing when NOT to build an agent. Most production systems are workflows with predefined paths, not autonomous agents — and Gartner projects over 40% of agentic-AI projects will be canceled by end of 2027 on cost and unclear value. This guide walks the architecture, tool calling, memory, patterns, failure modes, and deployment.

17 September 2026 · 12 min read](/intel/how-to-build-an-ai-agent-2026) [AI at Work

### How to Evaluate AI Agents: Trajectories, Tool Use, and Task Success (2026 Guide)

Evaluating an AI agent means judging both what it produced and how it got there. Unlike a single LLM call, an agent plans, calls tools, and takes many steps — so a correct final answer can hide a broken path. Combine outcome evaluation (task success rate, final-answer correctness) with trajectory evaluation (tool selection, tool-argument accuracy, step efficiency, error recovery). Score deterministic things with code and reserve LLM-as-judge for subjective quality — while guarding against its position, verbosity, and self-preference biases. Track cost, latency, and step count in the same traces as quality. Run offline evals on a fixed dataset before shipping, then monitor online in production and convert every failure into a permanent regression test. This guide covers the taxonomy, the real agent benchmarks (τ-bench, WebArena, GAIA, SWE-bench, BrowseComp), the tooling, and the mistakes.

17 September 2026 · 12 min read](/intel/how-to-evaluate-ai-agents-2026)

Canonical: https://stg.dexity.com/intel/govern-the-ai-you-ship-2026