How do we build an AI governance policy?

Building an AI governance policy requires moving beyond theoretical guidance to implement practical, operational controls that ensure reliable and accountable behavior [4, 12]. An effective framework should establish clear principles, roles, and lifecycle controls—such as fairness, transparency, and safety—to mitigate risks and trust erosion [7]. Organizations are encouraged to adopt management-based regulation, which involves creating risk management systems that include impact assessments, documentation, audits, and continuous monitoring rather than relying on fixed limits [10]. Because organizational structures evolve, governance frameworks must be designed to reflect how work is actually performed rather than just how it appears on paper [11]. For high-stakes environments, organizations should consider layered governance architectures, such as the AI Governance Control Stack, to maintain traceability and resilience [4]. Additionally, when AI is used for administrative or public decisions, it must be embedded in a compliance layer that ensures decisions are reviewable, repeatable, and legally defensible [6].