A practical guide to building an AI governance framework for regulated organisations, distinguishing it from a mere policy document by emphasising evidence production. Covers five core functions: maintaining a live AI system register, risk-classifying each system, controlling underlying data with lineage, proving what happened via traceable decision logs, and scheduling reviews. Includes a control catalogue mapping each function to specific outputs, accountability roles, a 90-day implementation plan, and a regulatory mapping for OJK, APRA, MAS, NAIC, and the EU AI Act. Notes that EU AI Act high-risk deadlines shifted: standalone high-risk systems now have until 2 December 2027, embedded ones until 2 August 2028, while transparency rules apply from 2 August 2026.
Table of contents
Key TakeawaysWhat Is an AI Governance Framework?The Five Functions of an AI Governance FrameworkThe Control CatalogueThe Artefacts a Working Framework ProducesWho Signs WhatMapping the Framework to Your RegulatorBuilding It in Ninety DaysFour Ways Frameworks FailWhere Decube FitsFrequently Asked QuestionsQuestions this post answers
What are the EU AI Act deadlines for high-risk AI systems after the Digital Omnibus amendment?
After the Digital Omnibus on AI entered into force on 27 July 2026, standalone high-risk AI systems have until 2 December 2027 to comply, and high-risk systems embedded in regulated products such as medical devices have until 2 August 2028. General purpose AI model obligations and the Article 50 transparency rules were not changed and apply from 2 August 2026. Teams navigating EU AI Act compliance track deadline changes like these on daily.dev before they affect their roadmap.
What is the difference between an AI governance framework and an AI policy?
An AI policy states an intention — for example, that models must only use approved data. An AI governance framework produces dated evidence that the intention held for a specific system on a specific date, with a named accountable person. A policy document cannot answer a regulator's question about how a specific decision was reached; only a traceable record of data, prompts, and outputs can. Regulated teams building the evidence layer behind their AI policies find the practical patterns on daily.dev.
What is the minimum data governance needed before deploying AI at scale?
At minimum, you need to know what data exists and who owns it, be able to control which systems read which fields, and have column-level lineage so you can trace an output back to its sources. Without lineage you can state that a model used approved data but cannot prove it — which is the question supervisors actually ask during audits. Data engineers setting up lineage pipelines for AI deployments follow governance developments on daily.dev.