Who this is for
For management, legal counsel, and privacy, technology and risk teams in organizations that use AI tools, develop AI-based solutions or operate in the European market.
AI governance connects organizational needs with legal and technology considerations. It provides a practical framework for mapping AI use, assigning responsibility, setting rules and maintaining ongoing oversight.
The regulatory landscape
Israel. Israel does not currently have a single cross-sector statute governing all uses of AI. Developing and using AI systems may be subject to existing law, including the Protection of Privacy Law, and to sector-specific requirements. The Israeli government's 2023 AI policy principles are a policy document, not legislation binding in their own right.
European Union. The EU AI Act applies in the circumstances set out in Article 2, including certain activities by entities outside the EU. Under Article 113 as amended, certain Chapter III requirements for high-risk AI systems apply from 2 December 2027 to systems covered by Article 6(2) and Annex III, and from 2 August 2028 to systems covered by Article 6(1) and Annex I. Other provisions already apply. The applicable obligations, exceptions and dates must be assessed according to the system and the organization's role.
Standards and professional frameworks. ISO/IEC 42001 is an international AI management system standard, while the NIST AI RMF is a voluntary AI risk management framework. Neither is legislation in its own right, although contractual or sector-specific requirements may affect how they are used.
Core elements of AI governance
Law and regulation. Reviewing legal requirements applicable to developing and using AI, including privacy, intellectual property and specific obligations where relevant.
Risk management. Identifying and mitigating technical and business risks, such as sensitive data exposure, attacks on AI systems, bias and unreliable outputs.
Ethics and fairness. Defining boundaries for use and assessing discrimination risks, fairness concerns and effects on people in AI-supported decisions.
Transparency and accountability. Assigning responsibility, human oversight and appropriate levels of transparency and explanation according to the use and applicable law.
Data governance. Mapping data used to develop, train and operate AI systems, and setting rules for entering data, with regard to privacy, confidentiality and intellectual property.
How the work is done
Use case mapping. Which tools are in use, by whom, for what tasks and with what data. Including AI features embedded in existing software.
Risk classification. Which uses are permitted, which require review and which are prohibited.
Policy and rules. An AI use policy, data input rules, human review of outputs and an exceptions process.
Vendors. Reviewing terms of use, data retention, model training and permissions.
Training and review. Role-based training and a periodic update cycle.
Possible deliverables
- Tool and use case register
- AI use policy
- Tool approval process
- AI risk assessments
- DPIAs for AI systems
- EU AI Act applicability and readiness review
- Guidance on ISO/IEC 42001 implementation readiness
- Training for management and staff
Confidentiality and sensitive data
Protecting confidential, business and personal information matters across sectors. Alongside duties arising from law or contract, professional confidentiality duties may also apply, for example to lawyers, accountants and psychologists, depending on the circumstances. An AI governance review should therefore consider what data is entered into tools, vendor terms, access permissions and controls for reviewing outputs. This assessment is tailored to the organization and is not limited to any profession or industry.