How do we build an AI governance policy?

Building an AI governance policy requires moving beyond theoretical guidance toward practical, operational controls that ensure accountability, transparency, and safety [4, 7, 12]. Organizations should implement management-based regulation, which focuses on establishing risk management systems—including impact assessments, documentation, audits, and continuous monitoring—rather than relying on fixed, static limits [10]. To be effective, these frameworks must be integrated into the organization's actual operational structure, ensuring that governance evolves alongside the technology to prevent failures caused by organizational change [11]. For high-stakes environments, organizations may adopt layered governance architectures, such as the AI Governance Control Stack, to maintain reliable and traceable system behavior [4]. Furthermore, when integrating AI into public administration or enterprise operations, it is essential to embed compliance layers that make decisions reviewable, repeatable, and legally defensible [6]. Ultimately, a robust framework should define clear principles, roles, and lifecycle controls to address risks related to fairness, privacy, and institutional integrity [7].