)
Over the last few years, much of the business conversation about artificial intelligence has revolved around one question: what can we do with it? The question made sense while organisations were exploring use cases, running proofs of concept or adopting generative artificial intelligence tools in a relatively isolated way. But that scenario is changing fast. AI is starting to be built into sales processes, corporate applications, customer service, information analysis, operations, engineering, cybersecurity and software development. And when a technology moves from experiment to process, a second, much more complex question inevitably appears: how do we govern it?
AI Governance —the governance of artificial intelligence— is set to become a business discipline as relevant as data governance, cybersecurity or IT service management once were. Not because companies need to add yet another bureaucratic layer to their organisation, but precisely because uncontrolled adoption of artificial intelligence can end up having the opposite effect to the one intended: more risk, more technological complexity, less traceability and new dependencies that are hard to manage.
In Europe there is also an obvious catalyst. The European Artificial Intelligence Regulation has turned issues such as risk, transparency, human oversight and the documentation of certain systems into business management matters. Since 2 August 2026, new transparency obligations apply and certain enforcement powers of the European authorities have come into operation. The timeline for systems considered high-risk extends further: certain categories will start applying their requirements from December 2027, and systems built into certain regulated products will do so from August 2028.
However, reducing AI Governance to AI Act compliance would be staying on the surface. Governing AI means deciding which systems exist, what they are used for, what data they work with, what risks they introduce, who is accountable for them and how they are overseen throughout their life cycle.
To tackle that problem we propose a practical model: a 5 Pillar Framework for AI Governance based on five dimensions that should evolve together: strategy and ownership, inventory and classification, data and architecture, security and risk, and operation and continuous oversight.
From experimenting with AI to governing an AI ecosystem
One of the biggest changes in enterprise artificial intelligence is not necessarily about how sophisticated the models are, but about how widely they are spread.
A few years ago it was relatively easy to identify where a company used AI. There were certain machine learning, predictive analytics or computer vision projects, usually driven by specific technology departments. Generative artificial intelligence has broken that logic. An employee can use an AI-based assistant from their browser; a department can subscribe to a SaaS application with generative capabilities; a supplier can introduce algorithms into an existing platform, and a development team can connect a model to a corporate application through an API.
The result is that an organisation may be using far more artificial intelligence than it thinks.
This phenomenon has similarities with the well-known shadow IT, but it introduces an important difference. An AI tool does not just process information: it can generate content, recommend decisions, transform data, write code, automate tasks or influence business processes.
That is why the first goal of an AI Governance strategy should not be to stop people from using AI. It should be to make visible how it is being used.
This principle connects with international frameworks such as NIST's AI Risk Management Framework, which places governance as a function that cuts across the identification, measurement and management of risk. The framework itself proposes that organisations have mechanisms to inventory their AI systems and allocate management resources according to their risk priorities.
The ISO/IEC 42001 standard moves in a complementary direction by setting out the requirements to establish, implement, maintain and continually improve an artificial intelligence management system within an organisation. Its logic is especially interesting because it shifts the conversation from the individual project to a permanent AI management system.
The five pillars are built on that idea.
Pillar 1. Strategy, policies and ownership: someone has to govern AIThe first question of AI Governance is not technological. It is organisational: who is responsible for artificial intelligence within the company? The answer should rarely be a single person. AI cuts across too many areas to sit exclusively under IT, innovation, legal or security. Governing it needs a structure able to connect business and technology and, depending on the organisation, also bring in privacy, compliance, human resources, operations or data owners. This does not necessarily mean creating a large corporate committee. In many organisations a clear decision model will be enough. What matters is knowing who can approve certain uses of AI, who assesses their technical implications, who sets the acceptable level of risk and who must step in when a system causes an incident or behaves unexpectedly. |
|
There must also be understandable policies. A corporate artificial intelligence policy that nobody knows about, or that needs thirty pages to explain what an employee can do with a generative tool, will hardly serve its purpose.
Effective governance needs to translate into usable criteria: what information can be entered into certain services, which tools are authorised, when a person must step in, which uses need prior approval and what evidence must be kept.
The goal is not to control every interaction with the technology. It is to set limits clear enough for innovation to move forward without constantly depending on improvised interpretations.
| Pillar 2. Inventory and classification: you cannot govern what you do not knowA company can have excellent policies and still have a fundamental problem: not knowing how many AI systems it actually uses. The AI inventory should become one of the central assets of the governance model. And it should not be limited to recording large in-house projects. It must also cover third-party applications, cloud services, features built into existing software, APIs, generative models, automations and solutions developed specifically for internal processes. The important thing is not only to identify the technology, but to document its context. What function does it perform? Which department uses it? Does it process personal data, confidential information or intellectual property? Does it produce a recommendation or automatically execute an action? Does a person step in before the result has consequences? Is there a dependency on an external supplier? |
From there, a classification proportional to risk can be built.
Not every application needs the same level of control. A system used to summarise internal documentation does not necessarily have the same implications as one used to select candidates, act on critical infrastructure or support a decision with significant consequences.
This risk-based logic is precisely one of the fundamental principles of the European framework. The AI Act sets different levels of obligations depending on the characteristics and uses of the systems.
For a company, the practical consequence is clear: AI Governance must be proportional. Applying the maximum level of control to every use of artificial intelligence would end up blocking its adoption. Applying minimal controls to the whole ecosystem would leave the truly sensitive cases unmanaged.
Pillar 3. Data and architecture: AI governance starts long before the modelThere is a certain tendency to analyse artificial intelligence risks by looking only at the model. In practice, many of the problems appear before and after it. An enterprise AI solution is part of an architecture. It consumes information from applications, databases, sensors, documents, cloud platforms or corporate systems; it transforms it and generates results that can later feed other processes. Governing that chain means asking where the data comes from, how good it is, where it is processed, how long it is kept, what information is shared with external suppliers and which systems later receive the results. This becomes especially relevant in industrial environments. Connecting IT and OT systems, data platforms, plant devices, corporate applications and artificial intelligence services can create huge optimisation opportunities, but it can also widen the technology surface that has to be governed. |
|
This is where experience in IT/OT infrastructure, connectivity and software development becomes especially important. An AI strategy cannot be designed apart from the technology architecture it will run on. The ability to integrate data from different sources, set up secure flows, control access and guarantee platform availability directly determines the reliability of any application based on artificial intelligence.
In this context, Motum Technologies approaches technology adoption from an integrated perspective: infrastructure, connectivity, software, cybersecurity and operations are part of the same ecosystem. AI adds a new layer to that architecture, but it does not remove the need to govern the previous layers properly.
Pillar 4. Security, risk and compliance: extending the traditional cybersecurity modelAdopting artificial intelligence changes an organisation's technology risk map. Some risks are familiar. Problems related to identities, permissions, vulnerabilities, availability, information protection or suppliers still exist. Others take on specific characteristics: exposure of confidential information through prompts, model manipulation, incorrect answers used as if they were facts, attacks on AI-based systems, over-reliance on automated results or loss of traceability over how a given decision was produced. That is why AI Governance and cybersecurity should not be developed as separate disciplines. Existing controls for identity management, segmentation, monitoring, incident response and third-party management are a foundation on which to add controls specific to artificial intelligence. The goal is not to replace the security model, but to extend it to cover a new category of assets and risks. |
|
It is also necessary to analyse the technology supply chain. Many organisations will not develop their own foundation models. They will use third-party platforms, APIs and services. Governance must then consider what guarantees each supplier offers, where it processes information, how it handles data, what audit capabilities it provides and what happens when it changes its models or terms of service.
The NIST AI RMF stresses precisely that risk management must be maintained throughout the life cycle and evolve as systems, their context and their impacts change.
This continuity matters because the initial approval of a tool does not guarantee that it will have the same risk profile months later.
| Pillar 5. Human in the LoopPerhaps the most common mistake in managing emerging technologies is assuming the work is done once the project goes into production. With artificial intelligence, exactly the opposite happens. Models evolve, suppliers update services, data changes and users find ways of using the tools that their designers had not foreseen. A system that worked correctly under certain conditions can behave differently when its context changes. AI Governance therefore needs an operational dimension. That means observing performance, availability, behaviour, incidents and deviations. It also means defining when a person must review an answer, when an action can be fully automated and under what circumstances a system must be stopped. |
Human oversight (HITL, or human in the loop) should not be understood simply as adding a manual approval at the end of every process. Sometimes it will make sense; in other cases it would destroy much of the efficiency gained through automation. What matters is designing it according to the potential consequences of an error.
The greater the impact of a decision, the greater the capacity for explanation, review and intervention should be.
This vision connects directly with the Smart Managed Services concept of Motum Technologies. If artificial intelligence starts to be built into critical services and processes, governing it will end up being part of everyday technology operations. Monitoring infrastructure, applications, security and connectivity without observing the new AI layers will gradually stop offering a complete view of the technology environment.
A framework as a cycle, not a project
The five pillars —strategy and ownership, inventory and classification, data and architecture, security and risk, and operation and oversight— should not be read as five phases that are completed once.
They work better as a cycle.
An organisation identifies a new use case, decides who is responsible, adds it to its inventory, analyses the data and architecture required, assesses its risks, sets controls and finally monitors it while it runs. The information obtained during operation then flows back into the governance system and makes it possible to review policies, classifications or controls.
This continuous improvement logic is also present in ISO/IEC 42001, designed precisely to establish and maintain an artificial intelligence management system that evolves with the organisation.
The advantage of this approach is that it avoids two equally problematic extremes. The first is deploying AI quickly and worrying about governing it when the first problems appear. The second is designing a compliance structure so complex that any initiative needs months to get through the internal process.
Between the two there is a much more interesting space: governance proportional to risk and designed to enable innovation.
AI Governance: from obligation to business capability
Over the next few years we will probably see AI Governance follow a path similar to that of cybersecurity. At first it will be seen mainly as a need for control or compliance. Later it will be understood as a capability needed to operate.
Companies that know what artificial intelligence they use, have architectures ready to integrate it, protect their data properly and can monitor its behaviour will find it easier to add new use cases. Not because they take on more risk, but because they will have built a structure capable of managing it.
This nuance is important.
Governing artificial intelligence does not mean using less AI. It means being able to use more AI where it creates value and less where it introduces a risk the organisation cannot justify.
Achieving this will require connecting areas that have long worked relatively independently: technology strategy, infrastructure, software development, data, cybersecurity, operations and business.
It is precisely at that intersection that AI Governance stops being a conversation about algorithms and starts to become a question of enterprise architecture.
Artificial intelligence will keep changing. Models will be different in three years' time and use cases will appear that we cannot yet anticipate. Trying to build policies based solely on today's tools will probably lead to governance that becomes obsolete far too soon.
The alternative is to build something more lasting: principles, responsibilities, architecture, controls and operational capabilities able to adapt to the technology.
That is, ultimately, the purpose of the 5 Pillar Framework. Not to control artificial intelligence from the outside, but to create the conditions for it to be integrated securely, traceably and sustainably within the company.
And that will probably be one of the fundamental differences between experimenting with AI and being truly ready to operate with it.