ArticleTechnology & AI1 min read
AI governance for regulated organisations: five first principles
Most AI risk in regulated firms comes from tools they buy, not models they build. A short set of principles to govern both.
By ENKAYT Technology Law Practice
Generative AI arrived in most organisations through browser tabs and productivity suites rather than through a formal programme. Governance therefore has to start with what is already in use.
- Inventory before policy: find out where AI is already used, by whom and with what data.
- Classify by impact: decisions about people, money or safety need more scrutiny than drafting assistance.
- Keep a human accountable: name an owner for each material use case and record their decision.
- Control the data boundary: decide what information may enter external tools, and enforce it technically where possible.
- Review outputs in proportion to risk: sampling for low-risk uses, systematic review where outputs affect customers.
Use existing structures
AI governance works best as an extension of existing risk, privacy and vendor processes rather than a parallel bureaucracy. Standards such as ISO/IEC 42001 provide a management-system structure that sits comfortably alongside ISO/IEC 27001.
Need this applied to your organisation?
Our team can turn this guidance into an action plan for your regulators, systems and timelines.
Book a consultationRelated reading
1 min read
A practical roadmap for Sri Lanka's Personal Data Protection Act
Where to start, what to prioritise and how to show progress to your board — a phased approach to the PDPA for organisations that can't do everything at once.
1 min read
Why compliance programmes fail at evidence, not intent
Most organisations do the right things. Far fewer can prove it on demand. The difference is designing controls around the evidence they produce.
1 min read
Third-party risk in 2026: the concentration problem
As more critical services run on a handful of cloud and software providers, vendor risk management has to look beyond individual questionnaires.
Regulatory notes, monthly
New rules, enforcement themes and practical guidance. One email a month, no promotions.