AI governance: from good intentions to a framework that works

Your teams already use AI, with or without a policy. Assistants draft emails, copilots write code, agents read tickets and update records. The question is no longer whether to adopt AI but whether you know where it runs, what data it sees and who answers for its decisions. That is what AI governance is about: keeping the benefits while controlling the risks.

Why it cannot wait

The cost of ungoverned AI is now measured. In IBM’s 2025 Cost of a Data Breach report, 63% of breached organisations had no AI governance policy or were still writing one. Shadow AI, meaning tools used without approval, was involved in one breach in five and added up to US$670,000 to the average cost. Most of those incidents started with something banal: confidential data pasted into a public tool, or an assistant given broader access than it needed.

The reference frameworks

You do not have to invent governance from scratch. Three references now structure the field:

• The EU AI Act (Regulation 2024/1689), in force since 1 August 2024. Prohibited practices have been banned since 2 February 2025 and obligations for general-purpose AI models apply since 2 August 2025. Most rules for high-risk systems were scheduled for August 2026, and the European Commission has proposed postponing part of them, so check the final timetable. It also applies to non-EU companies whose AI systems are placed on the EU market or whose outputs are used in the EU, which concerns many Tunisian firms serving European clients.
• ISO/IEC 42001:2023, the first certifiable management system standard for AI. It follows the same structure as ISO/IEC 27001, so organisations already certified for information security can extend their existing system.
• The NIST AI Risk Management Framework, organised around four functions (Govern, Map, Measure, Manage), with a Generative AI profile published in 2024. It is voluntary, practical and widely used as a checklist.

In Tunisia, any AI system that processes personal data also falls under Organic Law 2004-63 and the oversight of the national data protection authority (INPDP): purpose, consent, retention and transfers abroad all apply to training data and prompts.

A practical approach in six steps

• 1. Inventory. Build an AI register: every model, assistant, agent and SaaS feature in use, including shadow AI found in network and expense data. Note owner, purpose, data and supplier.
• 2. Classify the risk. Rate each use case by impact (customers, money, safety, rights) and by data sensitivity. A drafting assistant and a credit scoring model do not deserve the same controls.
• 3. Assign roles. Name an owner for each system, set up a small AI committee (business, IT, security, legal, DPO) and define who approves new use cases.
• 4. Apply controls. Least-privilege access for models and agents, data rules, human review for high-impact decisions, logging, testing against prompt injection and bias before go-live.
• 5. Monitor. Track quality, drift, incidents and costs. Treat an AI failure like any security incident, with a playbook and a post-mortem.
• 6. Train and document. Short, role-based training and an evidence trail that an auditor, a regulator or a client can review.

Good governance is not a brake. It is what lets you say yes to the next AI project quickly, because you already know how to assess it.

Start with what you already have

Most organisations do not need a separate programme. If you run ISO/IEC 27001, an ITSM process and a data protection register, AI governance is an extension of them: new assets in the register, new risks in the analysis, new controls in the statement of applicability. The first deliverable can be ready in a few weeks: an AI policy, a register of current use cases and a light approval workflow.