Enterprise AI governance, the 2026 playbook.

Enterprise AI governance in 2026 needs a defined operating model, a tiered policy framework, vendor due diligence, data and IP discipline, and a risk classification that maps to regulator expectations.

Read this playbook alongside the GenAI knowledge hub, the GenAI contract advisory service, the contract red lines, and the AI procurement checklist.

AI governance is no longer optional. The EU AI Act compliance milestones land through 2026. US sector regulators follow. Boards demand quarterly reporting. The buyer side stance starts with the operating model.

Operating model

The operating model defines who decides, who executes, and who reviews. A two layer model fits most enterprises. AI committee at the top. Working group at the operational layer.

AI committee

The AI committee owns policy and risk appetite. Members include the CIO, CFO, CRO, CDO, head of legal, and a business unit representative. The committee meets monthly.

• CIO. Technology decisions and platform standards.
• CFO. Investment, ROI, and budget control.
• CRO. Risk appetite and regulatory posture.
• CDO. Data quality and data use.
• Legal. Contract, IP, and regulatory.
• Business unit rep. Use case demand signal.

Working group

The working group runs day to day governance. Members include AI platform owner, security lead, data governance lead, vendor management lead, and the legal AI specialist.

• AI platform owner. Tool selection and onboarding.
• Security lead. Threat model and security review.
• Data governance lead. Data classification and use review.
• Vendor management lead. Contract and due diligence.
• Legal AI specialist. Policy interpretation and case work.

Policy framework

The policy framework sits on four tiers. Each tier covers a risk band. Each tier carries defined controls. The framework maps to the EU AI Act risk classification.

The four tiers

Prohibited use cases. Restricted use cases. Monitored use cases. Approved use cases. Every AI use case lands in exactly one tier.

• Prohibited. Use cases that cannot be deployed.
• Restricted. Use cases that need committee approval.
• Monitored. Use cases that run with active monitoring.
• Approved. Use cases pre approved for deployment.

Tier examples

Prohibited includes biometric categorization. Restricted includes recruitment screening. Monitored includes customer service copilots. Approved includes developer copilots and internal knowledge search.

• Prohibited example. Biometric inference for hiring.
• Restricted example. Loan decisioning copilots.
• Monitored example. Customer service first response.
• Approved example. Developer code completion.

Vendor management

Vendor due diligence is now table stakes. The EU AI Act demands provider obligations. The buyer side carries deployer obligations. Both need vendor documentation.

Due diligence framework

A standard due diligence pack runs to 30 to 40 questions. The pack covers security, data, model provenance, IP, and contract posture. Every new vendor completes the pack before onboarding.

• Security pack. SOC 2, ISO 27001, pen test evidence.
• Data pack. Training data sources, processing locations, retention.
• Model pack. Model provenance, evaluation, bias testing.
• IP pack. Indemnity, output ownership, training rights.
• Contract pack. Exit, audit, change control.

Onboarding process

Onboarding runs 3 to 6 weeks for a standard vendor. The process covers due diligence review, security review, legal review, and contract negotiation. The working group owns the workflow.

• Week 1. Due diligence pack request.
• Weeks 2 to 3. Security and legal review.
• Weeks 4 to 5. Contract negotiation.
• Week 6. Signature and platform onboarding.

Data and IP discipline

Data and IP discipline sit at the foundation. Every GenAI deployment touches both. The buyer side defaults are clear. No training on customer data. IP indemnity at contract. Output ownership with the buyer.

Data classification

A three tier classification applies to data fed into GenAI tools. Public, internal, confidential. Each tier carries different controls. Confidential data needs enterprise tenant isolation.

• Public data. Any approved tool.
• Internal data. Approved enterprise tools only.
• Confidential data. Enterprise tenant with isolation guarantees.

IP and indemnity

The IP framework covers training input rights, output ownership, and indemnity for third party claims. Vendor positions vary. Buyer side moves include explicit ownership clauses and copyright plus patent indemnity.

• Output ownership. Buyer owns generated output.
• Copyright indemnity. Vendor defends copyright claims.
• Patent indemnity. Separately negotiated, often distinct from copyright.

“A regulator letter on Monday morning is not the moment to start building the use case register. The register exists or it does not. The board cares which.”

Risk classification

The risk classification follows the EU AI Act four band model. Unacceptable risk. High risk. Limited risk. Minimal risk. Every deployed use case sits in one band.

The four bands

Unacceptable risk use cases are prohibited. High risk use cases require formal conformity assessment. Limited risk requires transparency. Minimal risk requires baseline controls only.

• Unacceptable. Prohibited by EU AI Act.
• High risk. Formal conformity assessment required.
• Limited risk. Transparency obligations.
• Minimal risk. Baseline controls only.

Audit posture

Audit posture means evidence ready. Regulators, internal audit, and the board can request artifacts at any time. The artifacts must exist before the request lands.

Artifacts to maintain

Six core artifacts cover most audit requests. Use case register, vendor due diligence pack, policy framework, training logs, incident log, and quarterly metrics.

• Use case register. Every deployed use case with risk classification.
• Vendor due diligence pack. Per vendor on file.
• Policy framework. Current and version controlled.
• Training logs. User training completion records.
• Incident log. Documented incidents and resolutions.
• Quarterly metrics. Usage, risk, value, exposure.

Metrics that matter

The board wants four metric categories. Usage, risk, value, exposure. Each category translates into a small set of numbers tracked quarterly.

Board level dashboard

A one page board dashboard captures the four categories. Usage shows adoption. Risk shows incidents. Value shows ROI. Exposure shows financial and regulatory risk.

• Usage. Active users, queries per month, top use cases.
• Risk. Incidents, near misses, policy breaches.
• Value. Productivity gain, cost reduction, revenue uplift.
• Exposure. Contract value at risk, regulator exposure, IP exposure.

Suggested reading

• GenAI Contract Advisory. Cross vendor reading from the wider library.
• AI Procurement Checklist. Cross vendor reading from the wider library.
• Vendor Shield. Cross vendor reading from the wider library.

What to do next

1. Stand up the AI committee and the working group within 30 days.
2. Build the use case register and classify every active use case.
3. Issue the due diligence pack to every active GenAI vendor.
4. Set the four tier policy and publish to the enterprise.
5. Map every use case to an EU AI Act risk band.
6. Stand up the six core audit artifacts.
7. Establish the quarterly board metrics dashboard.
8. Contact Redress Compliance to scope the governance program.

Frequently asked questions

Why does enterprise AI governance matter in 2026?

The EU AI Act enforcement milestones land through 2026. US sector regulators including SEC, OCC, FTC, and EEOC are issuing AI guidance. Boards expect quarterly reporting. Insurance carriers are pricing AI governance maturity. The combined pressure converted governance from optional to mandatory.

What is the right operating model?

A two layer model fits most enterprises. An AI committee owns policy and risk appetite. The committee includes the CIO, CFO, CRO, CDO, head of legal, and a business unit representative. A working group runs day to day governance with the AI platform owner, security lead, data governance lead, vendor management lead, and legal AI specialist.

How should we classify use cases?

Use the four tier policy framework. Prohibited use cases cannot be deployed. Restricted use cases need committee approval. Monitored use cases run with active monitoring. Approved use cases are pre approved for deployment. Every active use case lands in exactly one tier.

What goes in the vendor due diligence pack?

Thirty to forty questions across five packs. Security pack covers SOC 2, ISO 27001, and pen test evidence. Data pack covers training sources, processing locations, and retention. Model pack covers provenance, evaluation, and bias testing. IP pack covers indemnity, output ownership, and training rights. Contract pack covers exit, audit, and change control.

How does this map to the EU AI Act?

The EU AI Act uses a four band risk classification. Unacceptable risk is prohibited. High risk requires conformity assessment and post market monitoring. Limited risk requires transparency. Minimal risk requires baseline controls. Foundation model use carries provider disclosure obligations.

What metrics should the board see?

Four categories on a one page dashboard. Usage shows adoption. Risk shows incidents and policy breaches. Value shows productivity gain, cost reduction, and revenue uplift. Exposure shows contract value at risk, regulator exposure, and IP exposure. Reported quarterly.