Why AI governance can't just be about AI governance

An AI agent with access to the customer database answers a question it shouldn’t, and personal information ends up in front of the wrong person. The security team treats it as an access control failure. The privacy officer treats it as a possible notifiable breach. Whoever looks after AI treats it as a model behaviour problem. Three teams, three incident records, three sets of fixes, and nobody owns the whole thing.

AI does need its own focus, which is why it has its own standard. It brings risks that didn’t exist before: outputs nobody can fully predict, models that drift, agents that act on their own. But much of what AI does is accelerate risks organisations already have. Fraud gets cheaper to commit and harder to spot. Personal information can leak through a conversation rather than a breach. A quality problem can repeat thousands of times before anyone notices. Controls, incidents, impacts and risks have a way of being about more than AI at once.

The shape of ISO 42001 reflects this. It shares its clause structure with ISO 27001, ISO 9001 and the other management system standards, and its Annex D, which is guidance rather than requirement, discusses using the AI management system alongside them. Nothing makes you integrate. But the structure gives you every reason to. Leadership commitment, risk assessment, incident management, internal audit, document control and management review all have the same shape, so the machinery of an existing information security management system can carry AI too.

That doesn’t mean AI governance belongs to IT. Many organisations hand it there by default, because AI looks like technology. But the impacts fall on customers, staff and communities, the decisions belong to the business, and the risks cut across legal, operations, product and the board. IT runs some of the controls. It shouldn’t own the questions.

Anyone who has built AI into a working business knows it rarely sits on its own. It’s wired into the CRM, the support desk, the data platform and the payment flow. Its governance has to be wired in the same way, or it ends up governing a system that doesn’t exist on its own.

The practical payoff is that an integrated system costs less and works better. One risk register with one set of rating scales, one incident process, one internal audit programme, and one management review where the board sees AI next to everything else. For a small organisation that already holds ISO 27001, it’s the cheapest route to AI governance it will find. For one starting from nothing, it’s a reason to build the machinery once.

If you’d like to know how your AI governance fits with what you already run, a readiness assessment looks at both.