AI governance: control over how your organisation uses AI.

AI governance is the set of agreements, roles and controls through which an organisation decides how AI is used, who is responsible and how risks are managed. In concrete terms: an AI policy, a register of AI applications, an owner for each application, AI literacy among staff and periodic review. For a mid-sized organisation that fits on a few pages and a regular meeting.

An AI policy is the working agreement for staff: which tools are allowed, which data never goes in and where a person checks. AI governance is the system around it: who maintains the policy, how you assess new applications, how you organise AI literacy and how you adjust course. The AI policy is therefore one part of AI governance.

An AI policy for a mid-sized organisation answers seven questions: what you use AI for and who the policy applies to (including freelancers and interns), which tools are allowed, which data must never go in, which output a person checks, when you tell customers they are dealing with AI, what explanation or training each role receives, and who maintains the register and how often you review the policy. It fits on two sides of A4.

Yes. Article 4 of the AI Act has applied since 2 February 2025 to everyone who deploys AI. Since 27 July 2026 a lighter text has applied through the Digital Omnibus on AI (Regulation (EU) 2026/1744): you take measures to support the AI literacy of your people, but you do not have to guarantee a particular level. Doing nothing at all does not comply. A certificate is not needed; an internal record of training and instructions is enough.

Start with the register: who uses which AI tools, and for what. For each role, decide what someone needs to know: what a tool can and cannot do, when output must be checked, which data must not go into public tools, what a hallucination is and who is responsible if AI makes a mistake. Provide training that fits the role, record who received which explanation and repeat it when tools or tasks change. For the municipality of Twenterand we delivered such a training for policy officers, communications advisers and administrative staff, focused on using AI safely in their work.

The AI Act itself sets no fine for AI literacy. In the Netherlands, under the draft implementing act, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) supervises Article 4, with the AFM and DNB for financial institutions. If you fall short, the supervisor can impose an order subject to a penalty payment (last onder dwangsom): an instruction with a deadline that only costs money if you let that deadline pass. The implementing act is still a bill; the obligation itself already applies, because the regulation has direct effect.

For most SMEs and mid-sized organisations the AI Act is manageable. You are usually the deployer, not the provider, and most applications fall into minimal or limited risk. What applies: supporting AI literacy, making it recognisable when customers are talking to your AI or seeing realistic AI-generated images, and avoiding the prohibited practices. The heavy requirements for high-risk AI, such as AI in recruitment or credit scoring, apply from 2 December 2027, and for AI in products from 2 August 2028.

An AI governance framework is the fixed structure in which you set down AI governance: principles, roles, a register, risk assessment, controls and review. Well-known frameworks are ISO/IEC 42001, the international standard for an AI management system, and the voluntary AI Risk Management Framework from the US NIST. For a mid-sized organisation certification is rarely the goal; such a framework mainly serves as a checklist. The six steps on this page are a workable start.

Senior management is ultimately accountable, not IT alone. For each application you appoint an owner from the business who decides what AI does and checks that it works. Larger organisations sometimes appoint a Chief AI Officer; for mid-sized organisations a full-time role is often too heavy and an external partner can partly fill it. You do not need to appoint an AI officer for Article 4.

Not with a ban: staff do not stop, they hide their use and you lose visibility. What works: taking stock of which tools are running without punishing anyone for the answer, a short guideline on which data may and may not go into AI tools, and an official route with business tools that is faster than the unofficial one.

No. Innoworks is an AI implementation partner, not a law firm. We map which AI is running, set up the policy, the training and the processes, and build the applications. For a legal review, for example of a high-risk application or a contract, you work with a lawyer; we make sure practice matches what they advise.

That depends on the size of your organisation and what is already in place. We work in steps with a fixed scope and price for each step, usually starting with an AI audit. Book an intro call for an estimate for your organisation.