Resources

AI governance in organisations, pillar by pillar

The reference points of the Govern AI assessment: for each pillar, the issues, what we recommend and the documents that help you act.

• Security & trust

  This pillar translates the CSA AI Controls Matrix for an organisation that uses AI services without building them.

  • AI acceptable use
  • AI inventory
  • Data protection in AI use
  • Pre-deployment impact assessment
  • Human oversight
  • Bias and fairness
  • Explainability and transparency
  • Governance and accountability
  • AI literacy and training
  • AI supplier requirements
  • Identity, access and endpoints
  • Logging and monitoring of AI use
  • Guardrails and AI application security
  • Autonomous AI agents
  • AI incidents and resilience
  • Open models and in-house development
  Read — Security & trust

• Regulatory compliance

  This pillar positions your AI uses against the EU AI Act and the GDPR: what is prohibited, what is high-risk, the obligations already in force and those coming next, and what you must be able to prove.

  • AI Act mapping of your uses
  • Obligations already in force
  • High-risk deployer obligations
  • GDPR and AI
  • Sector-specific obligations
  • Documentation and evidence
  Read — Regulatory compliance

• AI cost management (FinOps)

  AI costs are scattered (per-user licences, pay-as-you-go API consumption, AI options charged as extras in existing software, projects), hard to forecast and rarely set against measured value.

  • AI spend visibility
  • Budgeting, forecasting and alerts
  • Value and unit economics
  • Rate and usage optimisation
  • AI procurement and spend governance
  Read — AI cost management (FinOps)

• Responsible use and people

  This pillar covers what neither technology nor contracts can settle: informing and consulting employees, the effect of AI on jobs and skills, the quality of and accountability for content produced in your name, the principles the…

  • Social dialogue and staff information
  • Jobs, skills and support
  • Quality and accountability of generated content
  • Principles and public commitments
  • Environmental footprint
  Read — Responsible use and people