AI Governance Frameworks

About this book

Fourth Edition, updated through October 2026.

AI governance has moved beyond principles, policies and model documentation. The next governance problem is operational: how do you control AI systems that retrieve information, generate decisions, call tools, work through suppliers and increasingly take actions?

AI Governance Frameworks: A Practitioner’s Guide is designed for that reality.

Instead of treating NIST AI RMF, ISO/IEC 42001, the EU AI Act and the OECD AI Principles as four separate bodies of material, this book shows how they can operate together as one governance architecture. It connects regulation, risk management, management systems, accountability and evidence, so organisations can build governance that works in practice rather than maintain four disconnected compliance programmes.

The central innovation is the shift from framework awareness to governable execution. The book shows how to move from policies and obligations to risk decisions, controls, operational evidence, assurance and board oversight. It introduces a shared-evidence approach in which inventories, risk registers, impact assessments, monitoring records, authority decisions and audit evidence can support multiple governance obligations without creating duplicate bureaucracies.

It also extends AI governance beyond traditional models and generative AI into agentic AI. The practitioner model addresses agent identity, delegated authority, least-privilege permissions, consequential-action gates, runtime limits, circuit breakers, persistent memory, observability, containment, kill switches and rollback. The question is no longer only “Was the model accurate?” but also “Who authorised the action, what was the system allowed to do, which controls ran before execution, and what evidence remains afterwards?”

A continuous NovaCred case study makes the architecture concrete. Readers see the same organisation govern traditional machine learning, GenAI/RAG applications and an operational AI agent across NIST AI RMF, ISO/IEC 42001, the EU AI Act, OECD principles, supplier governance, regulatory oversight and board reporting.

What’s new in the Fourth Edition

The Fourth Edition substantially expands the book for the 2026 governance landscape. It incorporates the revised EU AI Act implementation timetable, Article 50 transparency and marking obligations, GPAI enforcement considerations and updated high-risk planning. It adds agentic and runtime governance, integrates ISO/IEC 42005 impact assessment and ISO/IEC 42006 certification considerations, and explains how practitioners should work with NIST AI RMF 1.0 while its supporting ecosystem evolves.

The regulatory landscape has also been expanded beyond the four core frameworks. The book distinguishes binding law from proposed rules, supervisory expectations and voluntary guidance across the UK, Singapore, DIFC, India, Korea and the rapidly developing US federal-state environment, including new California coverage of frontier-model safety, independent verification and AI-auditor oversight.

The book closes the gap between governance theory and operating reality with reusable inventories, risk registers, impact assessments, classification and compliance trackers, cross-framework evidence maps, an Agentic AI Authority and Control Matrix, board reporting structures and a practical 90-day action plan.

Who it’s for

AI leaders, risk managers, compliance professionals, technology executives, board members, consultants and practitioners who need to govern, control, assure and evidence AI, not merely write policies about it.