Board-level AI governance comes down to four things a board can verify: a named owner for AI risk, an inventory of the AI systems the organization builds, buys and uses, clear roles for approving and monitoring them, and evidence that those roles actually operate. Two reference points are often confused. The NIST AI Risk Management Framework is voluntary guidance you can use to structure that work. The EU AI Act is law, and whether and how it applies depends on your role, the use and its risk, which is a question for counsel rather than for a template.
This guide covers the governance structure. The operational controls it should oversee, such as release gates, monitoring and incident handling, are described in our guide to managing hallucination risk in production.
A board’s primary role is to set the boundaries within which management approves prompts, chooses models and operates systems. In practice that means four decisions:
- Risk appetite. Which uses of AI the organization will pursue, which need explicit approval and which are off-limits, for example fully automated decisions about customers' access to services.
- Accountability. One named executive accountable for AI risk across the organization, with authority to stop a system.
- Reporting. What the board receives and how often: the inventory, material incidents, exceptions and decisions awaiting approval.
- Assurance. Who checks independently that the controls work, such as internal audit or an external reviewer.
Everything else is delegated, but to named people. A policy that says the company will ensure AI is fair and transparent, without an owner or a check, is a statement of intent, not governance.
You cannot govern systems you have not listed. For each AI system, record its purpose and business owner; who uses it and who is affected by its output; the data it uses, including personal data; the model or provider; whether it makes or informs decisions about people; which countries and markets it touches; what human oversight exists; and its status, from pilot to retired.
Include what you buy as well as what you build. AI features inside existing software, such as a CRM that drafts emails or an HR platform that ranks applicants, belong in the inventory, as does staff use of public chat assistants for work. Internal assistants deserve the same treatment; our guide to choosing internal AI copilot use cases explains which workflows suit them. Where personal data crosses borders, the inventory should point to the data-flow record your privacy team keeps; for Saudi operations, see our PDPL data-flow and responsibility checklist.
Figure 1 — Inventory built and bought AI. Include staff tools.
Governance fails at the handoffs, so make each one explicit. A workable split, which is TecnoStack's guidance rather than any framework's requirement, looks like this:
- Business owner: accountable for the use and its outcomes, approves releases and accepts residual risk within the appetite.
- System owner: runs the system day to day and keeps versions, monitoring and the release record.
- Risk, legal and compliance: classify each system, decide which laws apply and set the evidence each one needs.
- Security and privacy: review data access, retention and vendor terms.
- Independent assurance: test a sample of systems end to end and report to the board.
Scale the approval path to the impact. A low-impact drafting assistant may use delegated business-owner approval within an agreed policy, after any necessary security and privacy review. A system that informs credit, hiring or benefit decisions warrants risk and legal review and board visibility.
NIST describes the AI Risk Management Framework as voluntary guidance. It is not a certification and not a law. It organizes risk work into four functions, Govern, Map, Measure and Manage, which fit the structure above: Govern covers ownership, policy and roles; Map covers the inventory and each system's context; Measure covers evaluation; and Manage covers acting on what the measurements show. In July 2024 NIST added a Generative AI Profile that extends the framework to generative AI.
The framework's value is a shared vocabulary and an organized set of questions. Its limit matters just as much: saying a program is aligned with NIST does not certify it, and does not by itself show compliance with any law.
The European Commission presents the AI Act as a regulation whose obligations differ with the organization's role, how the AI system is used and the level of risk. A provider that develops a system and places it on the market has different obligations from a deployer that uses one. Being headquartered outside the European Union does not settle the question either way; what matters is the activity, and that calls for a legal assessment of each system, not a blanket answer for every Gulf company.
Timelines have also moved. According to the Commission's current AI Act FAQ, the Digital Omnibus entered into force on 27 July 2026 and extended the timelines for high-risk obligations. Treat dates in older summaries with caution, and confirm the current official timeline with counsel before planning against it.
Figure 2 — Distinguish guidance from law. Assess legal scope with counsel.
Good evidence is a by-product of the work, not a separate paperwork exercise. Ask management to be able to show, on request:
- the current inventory, with an owner and a classification for every system;
- the reasoning behind each classification and each legal-scope decision;
- approval records and release decisions, with the evaluation results behind them;
- the incident log, with causes and fixes;
- vendor assessments for the AI features you buy;
- exceptions to internal advisory controls, each with an owner and an expiry date; these cannot waive mandatory legal or security requirements.
If one of these cannot be produced, that gap is itself the finding to report.
For organizations in the Gulf with European customers or operations, a practical pattern is to use the NIST functions as the internal structure and apply each applicable law as an overlay on the same inventory and owners: EU AI Act obligations for the systems counsel finds in scope, data protection rules for systems that process personal data, and sector rules where they exist. One register avoids parallel programs that contradict each other. It does not make anything compliant by itself; each overlay still needs its own legal assessment.
The recommendations in this article are TecnoStack's guidance, not legal advice and not requirements of NIST or the European Commission. If you are setting up AI governance alongside an adoption program, our AI transformation service can help you build the inventory, roles and reporting.
- National Institute of Standards and Technology. AI Risk Management Framework: voluntary guidance with the Govern, Map, Measure and Manage functions; Generative AI Profile published 26 July 2024.
- European Commission. AI Act: regulatory framework on artificial intelligence: official overview of the regulation and its risk-based approach.
- European Commission. Navigating the AI Act: current answers on application and timelines, including the Digital Omnibus changes.
