Govern AI guides
EU AI Act cluster guides and AI governance frameworks from engineering evidence.
AI governance, explained for engineering leaders
AI governance is the set of policies, controls, and evidence that lets an organization use AI — including coding agents and the models shipped inside your product — deliberately rather than by accident. For engineering teams the question is concrete: who is allowed to use which AI tools, on what data, with what review, and how do you prove it after the fact. The emerging reference frameworks converge on the same spine, so building to them once covers most of what a customer or regulator will ask.
The frameworks that actually matter
- NIST AI Risk Management Framework (AI RMF 1.0, 2023) — a voluntary US framework structured around four functions: Govern, Map, Measure, and Manage. Govern is the cross-cutting culture-and-policy function; the other three run per AI system. Its 2024 Generative AI Profile adds concrete actions for LLM-specific risk.
- ISO/IEC 42001:2023 — the first certifiable AI management system (AIMS) standard, structured like ISO 27001: a management system with Annex A controls you can be audited and certified against. This is the one that produces a certificate.
- The EU AI Act — binding law, risk-tiered (unacceptable / high / limited / minimal). Most obligations fall on "high-risk" systems and on providers of general-purpose AI models; timelines phase in through 2025–2027. Unlike the others this one carries penalties, so applicability analysis matters.
These are complementary, not competing: NIST gives you the risk vocabulary, ISO 42001 gives you the auditable management system, and the EU AI Act is the legal floor if you operate in or sell into the EU. Evidence collected for one is largely reusable for the others.
What governing coding agents looks like
For a team using AI to write code, governance is not abstract. The recurring controls are: an acceptable-use policy naming which tools and models are approved and what data may be sent to them; review requirements for agent-generated changes (a human approves every merge, same as any PR); provenance — knowing which changes an agent authored, which is exactly what a change-management control already wants; and monitoring for the defect, revert, and security-finding rates on that code. The through-line is that AI governance rides on controls engineering already owns — change management, access control, logging — rather than inventing a parallel bureaucracy.
Governance is evidence, not a policy PDF
The failure mode is a well-written policy nobody can prove is followed. Every framework above ultimately asks the same thing an auditor asks for SOC 2: show me the population and a sample. Which merges were agent-authored and did each get reviewed? Who has access to the model and the training data? When a model or tool changed, was the risk re-assessed? Governance that lives only in a document fails the first audit; governance derived from systems of record passes it as a byproduct of normal work.
This hub is operational guidance distilled from named public sources — the NIST AI RMF 1.0 and its 2024 Generative AI Profile, ISO/IEC 42001:2023, and the EU AI Act. It is not legal advice, not a determination that a given framework applies to your organization, and not a substitute for counsel on EU AI Act applicability.