AI Governance Practices

The Irish Government has just announced plans to introduce the Regulation of Artificial Intelligence Bill in its Spring 2025 legislative programme, a pivotal piece of legislation aimed at giving full effect to the European Union’s Artificial Intelligence Act (EU Regulation 2024/1689). Even though the AI Act as a regulation has direct effect, this move is set to shape the national regulatory framework for AI governance in Ireland and establish national enforcement mechanisms in line with the EU’s approach. At the heart of the bill is the designation of Ireland’s National Competent Authorities: the entities that will be responsible for enforcing compliance with the AI Act. These authorities will oversee risk classification, conduct market surveillance, and impose penalties for violations. Given Ireland’s role as the EU base for major technology firms including Google, Anthropic, Meta, and TikTok, the effectiveness of its enforcement regime will be closely scrutinised across the EU and beyond. The Irish Government’s approach will be particularly significant due to the country’s track record in regulating the digital sector. Ireland’s Data Protection Commission (DPC) has wielded considerable influence over EU-wide enforcement of the GDPR, given the presence of multinational tech firms within the state. The DPC was designated as one of ireland’s nine fundamental rights authorities under the AI Act in November 2024. The bill will include provisions for penalties, though details remain unspecified. Under the EU AI Act, non-compliance can result in fines of up to €35 million or 7% of a company’s global annual turnover, whichever is higher. For Ireland, the challenge will be ensuring its enforcement framework has sufficient resources and expertise to oversee AI systems deployed within its jurisdiction. Tech industry leaders and legal experts will be closely monitoring how Ireland structures its national framework. The AI Act imposes strict obligations on high-risk AI applications, including those used in healthcare, banking, and recruitment. Companies will be required to maintain transparency, conduct impact assessments, and ensure that their AI systems do not lead to unlawful discrimination or harm. Ireland’s legislative initiative comes at a time of growing regulatory scrutiny over AI’s impact on society, innovation, and human rights. The AI Act represents the world’s most comprehensive attempt to regulate artificial intelligence, at a time other jurisdictions such as the USA are moving in the opposite regulatory direction. The Regulation of Artificial Intelligence Bill is still in its early stages, at the “Heads in Preparation” point. In the Irish legislative process, the Heads of a Bill serve as a blueprint for the eventual legislation. As Ireland moves toward full implementation of the AI Act, the government’s decisions on AI oversight will have significant implications for businesses, consumers, and the broader EU regulatory landscape.

AI governance isn't a policy document. It's 6 layers, and most skip the first 5: Teams rush to write a policy and call it governance. But a policy you can't enforce is just a PDF. And you can't audit what you never inventoried in the first place. I've spent the last 8 years building AI products... And governance is the part nobody puts on the roadmap. Here's the full 6-layer stack 👇 (See the visual for all 30 components) 1️⃣ AI Inventory ↳ You can't govern what you can't see. Run a shadow AI pass and list every AI tool in use that nobody officially approved. ↳ Then tag each system with an owner and a risk tier. 2️⃣ Data Foundation ↳ Track where every training input comes from, and screen it for bias before it touches a model. ↳ Stale data is its own failure mode. Monitor freshness. 3️⃣ Data Security & Access ↳ Encryption, anonymization, role-based access. ↳ Least privilege by default. Not everyone needs the model keys. 4️⃣ Model Assurance ↳ Write a model card for everything in production: what it does, what it trained on, where it breaks. ↳ Then red-team it and watch for drift. 5️⃣ Human Oversight ↳ Name who can override the model, and who's accountable when it's wrong. In writing, before you need it. 6️⃣ Compliance & Audit ↳ EU AI Act mapping, GDPR alignment, audit trails. ↳ This is the layer everyone starts with. It only holds if the 5 below it exist. Most teams have a governance policy. Almost none have governance. The difference is the 5 layers nobody sees. And the EU AI Act won't wait for you to build them. Which layer is your org already implementing? Drop a comment below. ♻️ Repost to help the builders and PMs in your network. And follow Basia Kubicka for more on building AI responsibly.

OpenAI 𝗷𝘂𝘀𝘁 𝗿𝗲𝗹𝗲𝗮𝘀𝗲𝗱 𝘁𝗵𝗲𝗶𝗿 𝗹𝗲𝗮𝗱𝗲𝗿𝘀𝗵𝗶𝗽 𝗽𝗹𝗮𝘆𝗯𝗼𝗼𝗸 𝗼𝗻 𝗵𝗼𝘄 𝘁𝗼 𝘀𝘁𝗮𝘆 𝗮𝗵𝗲𝗮𝗱 𝗶𝗻 𝘁𝗵𝗲 𝗮𝗴𝗲 𝗼𝗳 𝗔𝗜 — 𝗮𝗻𝗱 𝘁𝗵𝗲 𝗺𝗲𝘀𝘀𝗮𝗴𝗲 𝗶𝘀 𝗯𝗹𝘂𝗻𝘁: ⬇️ "𝖳𝗁𝖾 𝖼𝗈𝗆𝗉𝖺𝗇𝗂𝖾𝗌 𝗍𝗁𝖺𝗍 𝗐𝗂𝗅𝗅 𝗍𝗁𝗋𝗂𝗏𝖾 𝖺𝗋𝖾 𝗍𝗁𝖾 𝗈𝗇𝖾𝗌 𝗍𝗁𝖺𝗍 𝗍𝗋𝖾𝖺𝗍 𝖠𝖨 𝗇𝗈𝗍 𝗃𝗎𝗌𝗍 𝖺𝗌 𝖺 𝗍𝗈𝗈𝗅, 𝖻𝗎𝗍 𝖺𝗌 𝖺 𝗇𝖾𝗐 𝗐𝖺𝗒 𝗈𝖿 𝗐𝗈𝗋𝗄𝗂𝗇𝗀." AI adoption is moving faster than most leaders ever imagined. Staying ahead is about creating the right conditions for your people and teams to adapt with confidence. The report distills lessons from leaders at Moderna, Notion, BBVA et.al. into practical steps that any company can act on now. 𝗛𝗲𝗿𝗲 𝗮𝗿𝗲 𝘁𝗵𝗲 𝟱 𝗲𝘀𝘀𝗲𝗻𝘁𝗶𝗮𝗹𝘀 𝗢𝗽𝗲𝗻𝗔𝗜 𝗿𝗲𝗰𝗼𝗺𝗺𝗲𝗻𝗱𝘀: ⬇️ 1. 𝗔𝗹𝗶𝗴𝗻  → Start with clarity of purpose. Show your teams why AI matters, set company-wide goals, and role-model adoption at every level. Alignment builds trust and helps employees connect their daily work to your broader AI strategy 2. 𝗔𝗰𝘁𝗶𝘃𝗮𝘁𝗲  → Training > talk. Make learning real and practical. Invest in structured training, create AI champions, and give people room to experiment. When employees see AI as part of their growth and success, adoption becomes natural. 3. 𝗔𝗺𝗽𝗹𝗶𝗳𝘆  → Don’t let wins live in silos. Share success stories widely, build knowledge hubs, and create active communities so everyone can learn from what’s working. Momentum spreads fastest when people see peers succeeding. 4. 𝗔𝗰𝗰𝗲𝗹𝗲𝗿𝗮𝘁𝗲  → Remove friction. Make it easy for teams to access tools, submit ideas, and move projects from pilot to production. Empower decision-making and reward teams who push ideas forward. 5. 𝗚𝗼𝘃𝗲𝗿𝗻  → Balance speed with responsibility. Clear, lightweight guidelines ensure progress without unnecessary bottlenecks. When governance is practical and evolving, it protects the business while keeping innovation alive. This is a surprisingly good read! The recommendations are sharp because they cut right into the real bottlenecks of AI adoption: not the models, but people, processes, and governance. The full guide has only 15 pages: https://lnkd.in/defvM4cj 𝗣.𝗦. 𝗜 𝗿𝗲𝗰𝗲𝗻𝘁𝗹𝘆 𝗹𝗮𝘂𝗻𝗰𝗵𝗲𝗱 𝗮 𝗻𝗲𝘄𝘀𝗹𝗲𝘁𝘁𝗲𝗿 𝘄𝗵𝗲𝗿𝗲 𝗜 𝘀𝗵𝗮𝗿𝗲 𝘁𝗵𝗲 𝗯𝗲𝘀𝘁 𝘄𝗲𝗲𝗸𝗹𝘆 𝗱𝗿𝗼𝗽𝘀 𝗼𝗻 𝗔𝗜 𝗮𝗴𝗲𝗻𝘁𝘀, 𝗲𝗺𝗲𝗿𝗴𝗶𝗻𝗴 𝘄𝗼𝗿𝗸𝗳𝗹𝗼𝘄𝘀, 𝗮𝗻𝗱 𝗵𝗼𝘄 𝘁𝗼 𝘀𝘁𝗮𝘆 𝗮𝗵𝗲𝗮𝗱 𝘄𝗵𝗶𝗹𝗲 𝗼𝘁𝗵𝗲𝗿𝘀 𝘄𝗮𝘁𝗰𝗵 𝗳𝗿𝗼𝗺 𝘁𝗵𝗲 𝘀𝗶𝗱𝗲𝗹𝗶𝗻𝗲𝘀. 𝗜𝘁’𝘀 𝗳𝗿𝗲𝗲 — 𝗮𝗻𝗱 𝗮𝗹𝗿𝗲𝗮𝗱𝘆 𝗿𝗲𝗮𝗱 𝗯𝘆 𝟮𝟬,𝟬𝟬𝟬+ 𝗽𝗲𝗼𝗽𝗹𝗲. 𝗝𝗼𝗶𝗻 𝘁𝗵𝗲𝗺 𝗵𝗲𝗿𝗲: https://lnkd.in/dbf74Y9E

Today the OECD - OCDE launched its new Due Diligence Guidance for Responsible AI - the most comprehensive government-backed AI risk management framework available. AI has the potential to transform society for the better, enhance productivity, and solve complex challenges. But for these benefits to materialise, AI needs to be trustworthy. Whether your company is investing in, developing, or using AI, this guidance provides you with an authoritative, internationally agreed framework to: ➡️Implement and demonstrate due diligence relevant for your company's position in the AI value chain ➡️Support safe and responsible AI innovation, investment and uptake ➡️Navigate and simplify compliance with domestic and industry AI risk management frameworks The new guidance is backed by all the OECD’s member countries, the EU, and 17 partner governments. It is based on and fully consistent with the OECD Guidelines for Multinational Enterprises and the OECD AI Principles. You can find the new guidance here: https://brnw.ch/21x074j And do read the accompanying blog post by the OECD's Barbara Bijelic and Rashad Abelson: The OECD’s new responsible AI guidance: A compass for businesses in a complex terrain - OECD.AI #OECDAI #IndiaAIImpactSummit2026 #ResponsibleAI Sara Rendtorff-Smith Audrey Plonk, Ulrik Vestergaard Knudsen Pam Wood Alan Krill David C. Turnbull Felipe HENRÍQUEZ PALMA Aini Suzana Ariffin John Morrison Caleb Orr Office of the Under Secretary of State for Economic Affairs (E)

Audit, Risk & Compliance (ARC): The Three Pillars of Strong Governance "Let me explain why Audit, Risk, and Compliance aren’t just checkboxes—they’re your governance backbone." I’ve had this conversation many times with peers, clients, and boards. And here’s what I often say when someone asks, “How do you build strong governance?” You start with ARC: - Audit - Risk Management - Compliance Each has its role, but when aligned, they become a strategic force. Let me walk you through it from experience: 🔍 Audit is your independent lens. Think of Audit as the team that tells you what’s happening. Their job is to verify that controls are working not just existing on paper. ▶ Example: I once saw an internal audit uncover a $500K billing discrepancy no one had noticed. That wasn’t just cost savings it was a control failure caught before it became reputational damage. The best audit teams today use data analytics and real-time assurance tools to stay ahead. Traditional static audits no longer suffice. ⚠️ Risk is your radar. Risk Management isn’t about stopping risk, it’s about knowing which risks matter, and how much risk you can take to grow. I’ve seen risk teams run scenario analyses ahead of market expansion that flagged FX volatility. With a solid hedging plan, they avoided a 7% EBITDA hit. That’s what proactive risk management looks like. And right now? The strongest risk programs I’ve seen are integrating AI, ESG risk, and third-party oversight into their frameworks. ✅ Compliance is your moral and legal compass. Compliance isn’t just about avoiding fines. It’s about building trust internally and externally. A solid compliance program is the reason one company I worked with navigated new data privacy regulations across multiple countries without missing a beat or getting penalized. What’s changing? Compliance is becoming more automated, more behavior-driven, and more global. And that means compliance officers need better tech and a seat at the strategy table. Now here’s the key: ARC only works when it's integrated. When Audit, Risk, and Compliance operate in silos, things fall through the cracks. But when they collaborate sharing insights, aligning priorities, and using common platforms governance becomes a value driver. A recent PwC survey backs this up: - 73% of execs say ARC alignment improves decision-making - 65% plan to invest in integrated GRC platforms - Over half say Internal Audit is now a transformation partner If you’re leading or supporting ARC functions, my advice is simple: Don’t build walls, build bridges. The future of governance isn’t in functions. It’s in how those functions work together. Let me know how ARC works in your organization today. Do the functions collaborate, or still operate in silos? #Governance #InternalAudit #RiskManagement #Compliance #GRC #BoardEffectiveness #OperationalResilience #Leadership #3prm #tprm #GovernanceExcellence #RiskStrategy #ComplianceCulture

Europe just defined how AI must be secured On 15 Jan, the European Telecommunications Standards Institute (ETSI) published a standard, EN 304 223, defining baseline cybersecurity requirements for AI models and systems. ➡️ A common set of AI cybersecurity controls, usable across jurisdictions, vendors, supply chains. Why this matters now Traditional cybersecurity was built for software & networks. AI changes the attack surface: ▫️ training data can be poisoned ▫️ models can be manipulated or obfuscated ▫️ prompts can be indirectly injected ▫️ behaviour can drift in invisible ways ➡️ EN 304 223 explicitly names these risks, treating them as security failures. How this takes effect EN 304 223 is already being pulled into procurement processes, security questionnaires, internal audits, vendor due diligence, insurance reviews. With the EU AI Act, high-risk AI systems will need to demonstrate compliance through conformity assessment either via internal control with robust technical documentation, or through assessment by a notified body. ➡️ EN 304 223 is the operational “how” that law and auditors will rely on. The real breakthrough: lifecycle security The standard defines 13 principles and 72 trackable requirements, organised across 5 phases of the AI system lifecycle: 1️⃣ secure design 2️⃣ secure development 3️⃣ secure deployment 4️⃣ secure maintenance 5️⃣ secure end of life ➡️ Retraining a model = redeploying a system from a security standpoint. AI security becomes a continuous operational discipline. Accountability made operational EN 304 223 assigns accountability across 3 technical roles: ✔️ developers ✔️ system operators ✔️ data custodians ➡️ AI risk lives between teams. This standard makes ownership explicit. The target: production AI EN 304 223 applies to deep neural networks and GenAI models already embedded in products, services, and operational decisions. Academic or research environments are excluded. ➡️ This standard is about AI that is live, scaled, and consequential, particularly in finance, healthcare, and critical infrastructure. What “compliance” means Complying with legal, audit, procurement, and insurance expectations using EN 304 223 as evidence: mapping controls across the lifecycle and ownership across roles. What Boards and executives should do now 1️⃣ Mandate an AI inventory: What AI is live, where, doing what, using which data pipelines, supplied by whom. 2️⃣ Assign named accountability across the lifecycle: Align to the standard’s role logic per system. 3️⃣ Require an AI security evidence pack per high-impact system, mapped across its lifecycle. 4️⃣ Decide your assurance route early. For high-risk systems plan for internal control vs notified body assessment. The bigger signal EU is turning AI security into auditable infrastructure. Trustworthy AI is becoming a standard of execution. For companies operating globally, proof of AI security is becoming the baseline. #AI #GenAI #AIGovernance #AISecurity #Boardroom

AI Governance Isn't a Policy Document. It's a System. Most organizations approach AI governance by writing policies. The leaders are building governance into the architecture itself. As AI adoption accelerates, governance can no longer be treated as a compliance checkbox. It needs to be embedded across the entire AI lifecycle. A practical way to think about it is through these 6 layers of AI Governance: 1. AI Inventory You can't govern what you don't know exists. Maintain visibility into AI systems through model registries, risk tiering, ownership assignment, system classification, and shadow AI detection. 2. Data Foundation The quality of AI outcomes depends on the quality of the data behind them. Track data sources, lineage, freshness, quality, and potential bias before they become business risks. 3. Data Security & Access Governance starts with controlling who can access what. Encryption, anonymization, role-based access controls, least-privilege principles, and strong key management form the foundation of trust. 4. Model Assurance Models should be continuously evaluated, not just deployed. Performance benchmarking, fairness testing, red teaming, drift detection, and model documentation help ensure reliability over time. 5. Human Oversight AI should support decisions, not operate without accountability. Decision reviews, escalation paths, override authority, output validation, and accountability mapping keep humans in control when it matters most. 6. Compliance & Audit Regulations are evolving rapidly. Organizations need clear audit trails, policy enforcement mechanisms, incident reporting processes, and alignment with frameworks such as GDPR and the EU AI Act. The biggest challenge in AI governance isn't technology. It's creating a framework where innovation can move fast without compromising security, compliance, accountability, or trust. The organizations that get this right will scale AI confidently. The ones that don't may spend more time managing risk than creating value. Which of these six layers do you think organizations struggle with the most today? #AIGovernance #AI #ResponsibleAI #GenAI 

Shipping AI agents into production without governance is like deploying software without security, logs, or controls. It might work at first. But sooner or later, something breaks - silently. As AI agents move from experiments to real decision-makers, governance becomes infrastructure. This framework breaks AI Governance into the core functions every production-grade agent system needs: - Policy Rules Turn business and regulatory expectations into enforceable agent behavior - defining what agents can do, must avoid, and how they respond in restricted scenarios. - Access Control Limits agents to approved tools, datasets, and systems using identity verification, RBAC, and permission boundaries — preventing accidental or malicious misuse. - Audit Logs Create a full activity trail of agent decisions: what data was accessed, which tools were called, and why actions were taken — making every outcome traceable. - Risk Scoring Evaluates agent actions before execution, assigns risk levels, detects sensitive operations, and blocks unsafe decisions through thresholds and safety scoring. - Data Privacy Protects confidential information using PII detection, encryption, consent management, and retention policies — ensuring agents don’t leak regulated data. - Model Monitoring Tracks real-world agent performance: accuracy, drift, hallucinations, latency, and cost - keeping systems reliable after deployment. - Human Approvals Adds human-in-the-loop controls for high-impact actions, enabling escalation, overrides, and sign-offs when automation alone isn’t enough. - Incident Response Detects failures early and enables rapid containment through alerts, rollbacks, kill switches, and post-incident reporting to prevent repeat issues. The takeaway: AI agents don’t just need intelligence. They need guardrails. Without governance, agents become unpredictable. With governance, they become enterprise-ready. This is how organizations move from experimental AI to trustworthy, compliant, production systems. Save this if you’re building agentic systems. Share it with your platform or ML teams.

Seven firms studied AI adoption.   None found a technology problem. McKinsey. IBM. Bain. BCG. Accenture. Anthropic. OpenAI. Seven organisations. Seven separate research programmes. One consistent finding. The technology isn't the bottleneck.   The operating model is. The gap isn't model capability or compute access. It's the absence of governance infrastructure around the agents being deployed. Decision rights aren't defined — so every agent boundary dispute becomes a human escalation. Accountability isn't mapped — so when an agent makes a consequential call, ownership is contested. Data discipline isn't present — so agent outputs can't be verified, audited, or relied upon at scale. The 20% of organisations succeeding with agentic AI didn't move faster. They built the unglamorous infrastructure first. Governance. Decision architecture. Data readiness. The 80% experimenting are running pilots without that foundation. Speed without structure doesn't compound. It accumulates governance debt. Most agentic AI programmes aren't failing because the technology underperformed. They're failing because the operating model was never redesigned to absorb it. Seven reports reached the same conclusion independently. That convergence is the signal worth acting on. —— The full 2026 Agentic AI Strategy Pack: 1️⃣ McKinsey – The Agentic Organisation ↳ 3 governance frameworks that prevent AI initiatives fragmenting across departments 🔗 https://lnkd.in/evEzBQh8 2️⃣ IBM – Agentic AI Operating Model ↳ Why chasing efficiency gains is a trap — the execution systems that create structural advantage 🔗 https://lnkd.in/diWGccJr 3️⃣ Bain – Foundations for Agentic AI (Start here) ↳ How to audit AI readiness before competitors lock in first-mover advantage 🔗 https://lnkd.in/ePgxJBqH 4️⃣ BCG – Leading in the Age of AI Agents ↳ How to solve the accountability crisis when AI agents make decisions that impact the business 🔗 https://lnkd.in/eCV-x6wM 5️⃣ Accenture – Agentic AI Platform Strategy ↳ Why AI agents fundamentally change platform strategy, vendor relationships, and operating models 🔗 https://lnkd.in/e_RWUZfr 6️⃣ Anthropic – State of AI Agents (2026) ↳ How to build guardrails that accelerate deployment instead of constraining it 🔗 https://lnkd.in/e4w3FnRb 7️⃣ OpenAI – State of Enterprise AI ↳ Where measurable enterprise AI value is actually coming from today — beyond demos and proofs of concept 🔗 https://lnkd.in/eqQHwZd8 —— What does the governance architecture for AI agent decisions look like in your organisation today? 🔔 Follow Justin R. for more insights on AI programme delivery ♻️ Save and share this with the transformation lead planning your AI programme 🚀 Subscribe to The Transformation Constant — my newsletter.

AI success isn’t just about innovation - it’s about governance, trust, and accountability. I've seen too many promising AI projects stall because these foundational policies were an afterthought, not a priority. Learn from those mistakes. Here are the 16 foundational AI policies that every enterprise should implement: ➞ 1. Data Privacy: Prevent sensitive data from leaking into prompts or models. Classify data (Public, Internal, Confidential) before AI usage. ➞ 2. Access Control: Stop unauthorized access to AI systems. Use role-based access and least-privilege principles for all AI tools. ➞ 3. Model Usage: Ensure teams use only approved AI models. Maintain an internal “model catalog” with ownership and review logs. ➞ 4. Prompt Handling: Block confidential information from leaking through prompts. Use redaction and filters to sanitize inputs automatically. ➞ 5. Data Retention: Keep your AI logs compliant and secure. Define deletion timelines for logs, outputs, and prompts. ➞ 6. AI Security: Prevent prompt injection and jailbreaks. Run adversarial testing before deploying AI systems. ➞ 7. Human-in-the-Loop: Add human oversight to avoid irreversible AI errors. Set approval steps for critical or sensitive AI actions. ➞ 8. Explainability: Justify AI-driven decisions transparently. Require “why this output” traceability for regulated workflows. ➞ 9. Audit Logging: Without logs, you can’t debug or prove compliance. Log every prompt, model, output, and decision event. ➞ 10. Bias & Fairness: Avoid biased AI outputs that harm users or breach laws. Run fairness testing across diverse user groups and use cases. ➞ 11. Model Evaluation: Don’t let “good-looking” models fail in production. Use pre-defined benchmarks before deployment. ➞ 12. Monitoring & Drift: Models degrade silently over time. Track performance drift metrics weekly to maintain reliability. ➞ 13. Vendor Governance: External AI providers can introduce hidden risks. Perform security and privacy reviews before onboarding vendors. ➞ 14. IP Protection: Protect internal IP from external model exposure. Define what data cannot be shared with third-party AI tools. ➞ 15. Incident Response: Every AI failure needs a containment plan. Create a “kill switch” and escalation playbook for quick action. ➞ 16. Responsible AI: Ensure AI is built and used ethically. Publish internal AI principles and enforce them in reviews. AI without policy is chaos. Strong governance isn’t bureaucracy - it’s your competitive edge in the AI era. 🔁 Repost if you're building for the real world, not just connected demos. ➕ Follow Nick Tudor for more insights on AI + IoT that actually ship.