Page 364 - CyberSecurityEssentialsEnglish

● Remember: a policy is not the whole of governance
An organization may hold an excellent document and hold no register of uses, no owner
for each system, no test before release, and no means of stopping. Governance shows in
decisions, evidence, and daily behavior.

Video: Introduction to the NIST AI Risk Management
Framework, an Explainer Video
An official explanation of the logic of the framework, its
four functions, and how it helps organizations manage
risk without stopping innovation.
Duration: about 10 minutes | Level: Introductory
Learning objective: Connect governing, mapping,

measuring, and managing into one cycle.
Source: National Institute of Standards and Technology
[17]. https://www.nist.gov/video/introduction-nist-ai-
risk-management-framework-ai-rmf-10-explainer-video
Verified: June 6, 2026

8.3 Governance Structure: From Leadership to Independent Assurance
◆ Key idea: governance is not only a committee.

A good structure does not mean a large committee. It means that decision authority,
delivery responsibility, and independent oversight are clear, and that the level of
involvement is proportionate to the impact of the use.

Governance begins with leadership, because leadership sets why the organization is
investing in AI and which risks it will not accept. But leadership cannot review every use. It
therefore needs an organized delegation that places daily decisions with process owners,
calls in experts as risk rises, and keeps a clear escalation path.

We can simplify the structure into four layers. The first is leadership or the board, approving

direction, budget, and risk appetite. The second is management and the owners of use cases,
who deliver the value and apply the controls. The third is specialist oversight functions such

as risk, legal, privacy, security, and data, which set standards and review the important cases.
The fourth is independent assurance, such as internal audit or an external evaluation, which
asks whether the system works as it is said to work.

These layers need not be separate departments in a small organization. One person may

hold more than one role, but it must be avoided that a single person designs a system,
approves it, and evaluates it alone in high-impact uses. Relative independence is necessary,
because time pressure or enthusiasm for a project may lead its owner to understate the risks

or overstate the results.

363