Free resource · Word Kit

AI Governance Kit: Register, Declaration and Grid AI Act

What AI systems are running in your organization, and who has validated what? This kit provides the answers: a ready-to-fill register, a declaration form, the AI Act qualification grid, and an AI committee, to inventory, qualify, and govern your AI systems and agents within your collaborative tools, without a dedicated platform.

📄 Word, 24 pages🗂️ 29-column register🇪🇺 AI Act Qualification Grid🆓 Free

Download the kitSee an excerpt from the kit

Conceived by Flavien Besset, founder of NextStart.AI · 4,850 professionals trained · 9,4/10 satisfaction rating

The scene repeats itself in all large organizations. A Copilot agent created by an account manager, a customized GPT shared within a department, an AI function activated by a vendor in the CRM, a pilot program launched by R&D: each of these systems engages the organization's responsibility, and most have never been declared. When the question arises, whether from senior management, an auditor, or the regulator, the honest answer is often, "We don't know exactly."

This page explains what an AI systems registry should contain, how to classify each system according to the European regulation, how to make decisions without creating bottlenecks, and how to maintain the system with a small committee. It is accompanied by a complete toolkit, in Word format, with the registry, form, grids, and template ready to use.

Kit overview: what your register looks like

Before you leave your email, here's what you'll receive. Version 2, updated on October 26, 2026 to take into account the AI ​​Omnibus and the agents that act.

AI Systems Registry · 5 columns out of 29

ID	System	AI Act Level	Verdict	Conditions
IA-2026-041	Meeting summary officer	Minimal	Approved	None (self-approval)
IA-2026-042	Shortlisting of candidates	High risk, Annex III	Under conditions	C1 C5 C6 C7
IA-2026-043	Site welcome chatbot	Transparency, art. 50	Under conditions	C4
IA-2026-044	Emotion analysis in video conferences	Prohibited practice, art. 5	To review	Decree, referral to the legal department

🗂️ The register and the form

Fifteen basic columns and fourteen compliance columns for the DPO (role under the AI Act, DPIA and impact assessment on fundamental rights, CSE, autonomy), with commentary and illustrated with completed examples. The thirteen-question declaration form can be completed in ten minutes.

🇪🇺 The AI Act qualification grid

Prohibited practices, Annex III areas, transparency and minimal risk, a four-question decision tree, then three verdicts, seven self-approval criteria and ten coded standard conditions.

📄 The complete document, 24 pages in Word format

Standard file in eight sections, mandate and agenda of the AI ​​committee, seven indicators, countdown to December 2, 2027, ISO/IEC 42001 and NIST AI RMF correspondence, self-assessment in fourteen points and ready-to-fill system sheet.

Receive the complete kit by email →

1. Why a register, and why now?

The register is the essential document without which nothing else holds together. You can't classify what you don't know, you can't train users on a system you don't understand, and you can't produce audit evidence for an unregistered system. The European regulation on artificial intelligence doesn't explicitly mandate it for deployers, but it makes it indispensable for any organization using AI: avoiding prohibited practices requires knowing what you're using, complying with high-risk obligations requires identifying the systems involved, and training users under Article 4 requires knowing who is using what.

The second reason is speed. With agents, any trained employee can create a system in an hour that accesses documents, makes preparatory decisions, and serves an entire team. Organizations that had a few AI projects in 2024 will have hundreds by 2026, most of them developed outside of any established process. A governance framework that takes weeks to respond is bypassed; a non-existent framework leaves the organization discovering its infrastructure on the day of an incident.

The third reason is that the register is a deployment tool as much as a compliance tool. It reveals use cases that work and could be generalized, duplicates between departments, orphaned agents whose creator has changed positions, and it directly feeds into the training plan.

2. What is entered in the register, and how to find it

An "AI system" as defined by the registry is any software, service, or agent that produces content, recommendations, or decisions based on a model, whether purchased, embedded in vendor software, configured by a business unit, or developed in-house. Six categories cover the essentials:

Family	Examples	Where to find them
Generalist assistants	Copilot, ChatGPT, Claude, Gemini, Mistral, internal AI	Contracts and licenses, IT department
Agents and assistants created by the professions	Copilot Studio or Agent Builder agents, custom GPTs, Claude projects, Gems, Dust spaces	Tool administration consoles
AI embedded in software	AI features for CRM, HR suite, customer support, and security tools	Review of supplier contracts with purchasing
In-house development or external providers	Models and applications in production or pilot phase	Project portfolio, data, R&D
Automations that call for a model	Power Automate flow, Zapier, n8n, scripts	Interviews by management, AI ambassadors
Connectors and agents that act	MCP Connectors and Servers, Copilot Cowork, Claudius Coworkagent mode of office suites, agent browsers	Administration consoles, agent inventory, proxy logs

The register itself consists of fifteen basic columns: identifier, name, type, department and owner, purpose, users, data processed, provider and model, sources and connectors, automated decision or not, AI Act level, verdict, conditions, status, and dates. Fourteen compliance columns are added so that the DPO and the compliance officer can use it without reprocessing: AI Act role, deployer obligations, GDPR register, DPIA and impact assessment on fundamental rights, contract and transfers, human oversight, logs, information for the Works Council, incidents, training, and level of autonomy. It resides in a SharePoint list, a Notion database, or, to start, a shared workbook, with three rules: a single register for the entire organization, a specifically named register owner, and locked columns. The kit provides the template with a completed example row and the three-source method for finding what no one has declared: administration consoles, departmental interviews, and supplier contracts.

3. The four levels of the AI Act, translated into questions

The regulation distinguishes four situations, which are not mutually exclusive. The kit's grid translates these into a four-question decision tree, based on the answers to the declaration form.

Level	Question to ask oneself	What this means for you
Prohibited practices (Article 5)	Is the system used to recognize emotions at work, to socially rate people, to manipulate or exploit vulnerabilities, to build facial recognition databases through untargeted collection, or, from December 2, 2026, to generate intimate non-consensual or pedocriminal content?	Immediate cessation of proceedings and referral to legal action. Rare in a company setting, but to be explicitly ruled out.
High risk (Article 6, Annex III)	Does the system make, prepare, or influence a decision concerning individuals in matters of employment, access to credit or essential services, education, or biometrics?	Legal analysis, use in accordance with the supplier's instructions, trained supervisors, logs kept, information provided to employees and those concerned.
Transparency (Article 50)	Do people interact with the system or do they receive generated content (chatbot, realistic images or voices, texts published without proofreading)?	Informing people, reporting generated content. This is in addition to the other levels.
Minimal risk	None of the above: writing, summarizing, translating, coding, internal agents reviewed by a human.	The vast majority of the register. Internal rules (charter, GDPR, confidentiality) and user training.

Three pitfalls are common in almost every organization. A system that seems "minimal" at the vendor's end can become "high risk" within your organization depending on its use: a general-purpose assistant used to screen applications changes risk level because the qualification relates to its use, not the product itself. Secondly, the GDPR doesn't disappear behind the AI Act: any AI that processes personal data must go through the Data Protection Officer (DPO), with an impact assessment if the processing is high-risk. Finally, autonomy isn't a category within the AI Act: an agent that sends emails to clients without reviewing them is "minimal" according to the regulation but very risky for the organization; therefore, your system must address this risk.

4. Three verdicts, and the self-approval that avoids the bottleneck

The regulatory qualification states what the law requires. The verdict states what the organization decides. Three verdicts are sufficient: approved, approved with conditions, to be reviewed. What differentiates a system that works from one that is circumvented is the self-approval rule: a system with minimal risk, based on an already referenced tool, without confidential or personal data beyond professional contact information, connected to sources its users already have, with a trained owner and users, with human review before any external effect and without autonomous actions with external effects, is approved by the AI ​​expert in a few days, without going through a committee.

In practice, most of the declared systems meet these criteria. The committee focuses on the remaining aspects, and the conditions it attaches to its verdicts are drawn from a short list of standard requirements (human review, data scope, connector scope, informing individuals, documented training, informing employee representatives, logging, advance review, supervised autonomy, and verified access rights before a connected assistant), referenced by a code in the registry. The toolkit details the seven criteria and the ten standard requirements.

5. The AI ​​committee: light, regular, traced

The AI ​​committee makes decisions that are not based on self-approval, arbitrates the conditions, reviews the register quarterly, and adapts the criteria as the organization matures. It does not manage projects or replace existing bodies; it mobilizes them. Its composition is simple: a sponsor from senior management, the AI ​​lead who prepares the files, representatives from the IT or security department, the legal or compliance department, and the Data Protection Officer (DPO), plus two or three representatives from the departments most heavily involved in implementation.

Initially, the meeting is held for one hour per month, then every six weeks, with a fixed five-point agenda: register, files to be decided, overdue reviews, incidents and signals, and system adjustments. Each decision is added to the file for the system in question, which serves as the audit record: identification sheet, qualification, decision and conditions, evidence of implementation, and follow-up. It is the quarterly register review with each owner, more so than the committee, that keeps the system active: systems that have not been used for six months are removed from the register.

AI committee, AI governance committee, AI steering committee: the names vary, but the body is the same. What distinguishes it from a project committee is that it decides what can be used and under what conditions. When no one internally has the time to prepare the files or maintain the records, this role can be outsourced during the implementation phase: this is the purpose of our outsourced AI managementAnd to ensure the sponsor champions the cause with conviction, a acculturation session of the executive committee often precedes the first meeting.

6. Roles: Who does what in AI governance

A governance structure relies on appointed individuals, not an organizational chart. Seven roles are sufficient in most large organizations, and almost all of them already exist: it is primarily a matter of explicitly assigning them their share of the work.

Role	What he does	Who usually holds it
Sponsor of the general management	Chairs the AI ​​committee, arbitrates priorities and resources, and brings the matter before the management committee.	A member of the executive committee
AI expert	Maintains the register, implements self-approval, and facilitates the committee and quarterly reviews.	A person from the transformation, IT, or compliance departments, with dedicated time
System owners	They declare their agents and tools, apply the set conditions, and are accountable for their use.	Business managers who create or commission a system
IT and security	They validate the tool, the connectors, and access to the data.	CISO, architect, tenant administrator
DPO and legal	They verify the legal basis, personal data, and obligations of the AI Act.	DPO, compliance lawyer
HR and social dialogue	They prepare information or consultation for the Works Council, training and career development.	HR Director, Head of Training (see the AI and Social Dialogue Kit)
AI Ambassadors	They disseminate best practices and report on uses and needs on the ground.	Trained volunteers in each direction (see the AI Ambassadors Kit)

When the role of AI liaison is not yet filled, it can be filled externally while the system is being set up and the person who will take over is being trained: this is the purpose of our mission. Outsourced AI Management.

7. Reference frameworks: AI Act, ISO/IEC 42001, NIST AI RMF

Three texts currently structure most AI governance frameworks, and a fourth inspires their spirit. They do not compete with each other: the AI Act sets out the obligations, while the others provide a method for maintaining them over time.

Setting	Nature	What it brings
AI Act, Regulation (EU) 2024/1689	European regulation, mandatory for suppliers and deployers of AI systems in the Union	Risk levels, prohibited practices, deployment obligations and AI control (Article 4)
ISO / IEC 42001: 2023	International standard for AI management systems, voluntary and certifiable	An organization documented according to the ISO/IEC 27001 model: policy, roles, risk assessment, continuous improvement
NIST AI Risk Management Framework (AI RMF 1.0, 2023)	American voluntary framework, published by NIST	Four functions – Govern, Map, Measure, and Manage – to identify and address risks throughout the lifecycle
OECD Principles on AI	International, non-binding recommendation	The fundamental principles (transparency, robustness, accountability) adopted by most national frameworks

For a large French organization, the simplest course of action is to start with the obligations of the AI Act, maintain the register and committee described on this page, and then align the system with ISO/IEC 42001 if certification is expected by clients, contractors, or a regulator. AI Act kit from the sponsor details the schedule of obligations.

8. What the kit contains

The kit is a 24-page, editable Word document, each part of which can be copied independently to your tools. It contains, in order: instructions for use and three ways to use it; the AI ​​systems register, with what information must be included, the fifteen basic columns and the fourteen compliance columns with explanations and examples, where to keep it, and how to find undeclared AI; the thirteen-question declaration form, with the reason for each question; the risk-level qualification grid, with prohibited practices, Annex III areas, transparency obligations, minimum risk, and the decision tree; the three verdicts, the seven self-approval criteria, and the ten standard conditions; the eight-section system-specific file; the AI ​​committee, with its mandate, composition, agenda, and indicators; the countdown to December 2, 2027; and the correspondence with ISO/IEC 42001 and the NIST AI RMF. and four annexes: self-assessment of the system in fourteen points, frequently asked questions, glossary and resources, ready-to-fill system sheet.

The kit, part by part: what each part contains and what it is used for. The templates to fill in are in the Word document.

INSTRUCTIONS FOR USE

Three ways to use this kit

Starting with an initial register (parts 1, 2, and 3, two-day workshop with management), installing the complete system (the entire kit, six weeks), or auditing the existing system (Appendix A, then the sections with low scores, half a day). The kit is organized into six components: inventory, data collection, qualification, decision-making, documentation, and management.

The European regulation timetable, updated as of October 26, 2026

Since February 2, 2025, the prohibited practices (Article 5) and the AI ​​governance (Article 4) have been in effect, as rewritten by Omnibus Regulation (EU) 2026/1744: taking measures to promote staff skills, without an obligation to guarantee a specific level, under the control of national authorities since August 2, 2026; since August 2, 2025, the obligations of providers of general-purpose AI models; and since August 2, 2026, transparency (Article 50) and sanctions. On December 2, 2026, two further prohibitions were added (non-consensual intimate content and child pornography) and the deadline for marking generative systems already on the market was closed. The high risk of Annex III follows on December 2, 2027, a date postponed by the omnibus IA, that of Annex I on August 2, 2028, and the systems of public authorities already in service on August 2, 2030. This postponement is not a reason to wait: the register is in use from today.

Part 1. The AI ​​Systems Registry

1.1 What is entered in the register

Any software, service, or agent that produces content, recommendations, or decisions based on an AI model falls into six categories: general-purpose assistants, business-created agents and assistants, AI embedded in software, in-house or vendor-developed AI, automations that call a model, connectors, and agents that take action. Individual uses of a previously declared assistant, draft agents that are not shared, and software without AI are not included. When in doubt, declare: an extra line is less expensive than forgetting a system. Copilot Chat and Microsoft 365 Copilot (often called "Copilot Premium") are two separate lines, as the latter accesses emails, files, and meetings.

1.2 The fifteen basic columns

Each system is described in fifteen columns, from the unique identifier (e.g., IA-2026-042) to the declaration, decision, and next review dates, including the purpose (a one-sentence sentence with a verb), the data processed, the sources and connectors, whether the decision is automated or not, the AI Act level, the verdict, the conditions, and the status. The toolkit provides the expected content for each column and a completed example. Section 1.5 adds fourteen compliance columns (16 to 29) for the DPO and the compliance officer, illustrated by a completed example of a pre-screening of qualified, high-risk candidates.

1.3 Where to keep it

A SharePoint list, a Notion database or a shared Excel workbook is sufficient, with three rules: a single register for the entire organization, a named owner of the register, generally the AI ​​referent, who alone validates columns 11 to 15, and columns locked by choice lists so that the register remains filterable.

1.4 Finding undeclared AI: three sources

Administration consoles (Microsoft 365 and its agent inventory, OpenAI, Anthropic, Google) and proxy or cloud security tool logs for agents, automations, and shadow AI; 30-minute interviews per department for real-world use cases; and a review of software contracts renewed since 2023 for embedded AI. The initial inventory takes one to two weeks; an agent seen in the console but not mentioned by anyone is likely an orphan.

Part 2. The declaration form

The thirteen questions of the form

Serving as the single entry point to the register, the form can be completed in ten minutes by the future owner, using Microsoft Forms, SharePoint, or Notion. Its thirteen questions cover the name and owner, purpose, tool, users, data, connections, impact on individuals (high-risk detection), human review, contact with external parties (Article 50), user training, and three questions that most forms omit: the system's ability to operate independently, a possible role as a provider under the AI Act, the commissioning date, and the employees involved, in order to anticipate consultation with the Works Council.

Installation advice

Making the form visible where agents are created (charter, tool homepage, training path) and responding quickly: an acknowledgement of receipt on the same day and a verdict in less than ten days for simple cases do more for spontaneous declaration than any obligation.

Part 3. The AI Act Qualification Grid

3.1 Prohibited practices (Article 5)

Nine practices must be explicitly prohibited for each system: subliminal or deceptive manipulation, exploitation of vulnerabilities, social scoring, risk assessment based solely on profiling, untargeted image collection for facial recognition, emotion recognition of employees or students, inference of sensitive characteristics from biometric data, and two prohibitions added by the AI ​​omnibus bill, applicable from December 2, 2026: generation of intimate images, sounds, or videos of an identifiable person without their consent, and generation of child pornography. A frequent point of concern: emotion analysis functions integrated into videoconferencing, call center, or HR tools. If a box is checked, the practice must be stopped immediately and legal action taken.

3.2 High risk (Article 6 and Annex III)

A system is considered high-risk when, in a domain listed in Annex III, it is used to make, prepare, or influence a decision concerning individuals: employment and workforce management, access to essential services (credit, life insurance, and healthcare), education, biometrics, critical infrastructure, law enforcement, and justice. The obligations apply from December 2, 2027 (Annex III) and August 2, 2028 (Annex I). The exception in Article 6.3, particularly for a narrow procedural or preparatory task, never applies in cases of profiling: the provider must invoke and document this exception, and the deployer must request and retain this assessment.

What high risk means for you, the deployer (article 26)

Use the system in accordance with the supplier's instructions, entrust human supervision to competent, trained individuals with the necessary authority, monitor its operation, suspend its use in case of risk and report serious incidents, retain logs for at least six months, inform staff representatives and employees before any implementation in the workplace, inform individuals subject to a decision, who have a right to an explanation (Article 86), and carry out the required impact assessments. The impact assessment on fundamental rights (Article 27) concerns public bodies, private entities providing public services, and operators of credit or pricing systems in life and health insurance.

3.3 Transparency (Article 50)

Inform users that they are interacting with AI, flag hyper-realistic manipulations (images, sounds, and videos that appear realistic), and flag generated texts published to inform the public on topics of general interest, unless they have undergone genuine human review with editorial responsibility and a documented process. Inform users who are exposed to authorized emotion recognition or biometric categorization. According to the Commission's guidelines of July 20, 2026, an agent acting on behalf of someone else must also state for whom, and the labeling applied by the tool's publisher does not exempt the deployer from disclosing their own identity. An internally developed chatbot, even one built with Copilot Studio, essentially makes the organization its provider.

3.4 Minimal risk

Writing, summarizing, translating, researching, coding, and internal agents whose results are reviewed by a human: this constitutes the vast majority of the registry. There are no specific obligations under the AI Act beyond AI proficiency; internal rules (charter, GDPR, confidentiality, security) apply. Minimal does not mean risk-free: an agent who sends emails to clients without reviewing them is still considered minimal by the regulations.

3.5 The decision tree in four questions

Is a prohibited practice checked? Does the system influence a decision concerning individuals in a field listed in Annex III? Do individuals interact with it or receive its content? If not, it is minimal and eligible for self-approval. A word of caution: substantially modifying a system or designating it for high-risk use could make you a provider as defined in Article 25.

Part 4. The Three Verdicts

Approved, conditionally approved, or subject to review: the qualification states what the law requires, the verdict states what the organization decides. Target timeframe: less than ten days for approval, the next committee meeting for a case requiring review.

4.1 Self-approval criteria

The AI ​​expert approves, without a committee, a system that meets seven criteria: minimum AI Act level, already registered tool, no confidential or personal data beyond professional contact information, data sources already accessible to its users, a designated owner and trained users, human review before any external effect, and no autonomous action with external effects (the system proposes, a human executes or validates). Most of the registered systems meet these criteria.

4.2 The ten standard conditions

The conditions attached to a verdict are referenced by their code in the register, each with its expected proof: C1 human review, C2 data scope, C3 connector scope, C4 informing people, C5 certified user training, C6 informing staff representatives, C7 logging, C8 early review at three months instead of twelve, C9 supervised autonomy (limited actions, human validation action by action, means of immediate stop), C10 access rights verified before opening a connected assistant.

Part 5. The standard folder by system

Each non-self-approved system opens a file with eight sections: identity sheet, qualification, decision, supplier documentation (including EU declaration of conformity and registration for high-risk systems), evidence of implementation, monitoring, reviews, and GDPR and social compliance (processing register, DPIA, fundamental rights impact assessment, works council opinion, single document); the first three sections are sufficient for a self-approved system. This is the audit evidence: a third party must understand within ten minutes what the system is, why it was authorized, and how compliance is ensured.

When to reopen a case

New source or connector, new user population, change of purpose, change of model or provider, incident: the owner resubmits the form and the qualification is redone. The rest of the time, the annual review is sufficient.

Part 6. The AI ​​Committee

6.1 Mandate

The committee makes decisions without self-approval, arbitrates the conditions, reviews the register quarterly, and updates the criteria. It does not manage projects and does not replace existing bodies (safety committee, works council, risk committee): it coordinates them.

6.2 Composition

A senior management sponsor who chairs the meeting, the AI ​​lead who maintains the register and facilitates the discussions, representatives from the IT department or security, legal or compliance, the DPO, and two or three representatives from the departments most heavily involved in implementation. HR and a representative from employee relations are invited whenever a matter concerns employment or employee management.

6.3 Pace and agenda

One hour per month for the first six months, then every six weeks, with a fixed agenda: register, files to be decided (ten minutes maximum each), overdue reviews, incidents and signals, adjustments to the system. Each decision is recorded in a one-page summary.

6.4 Indicators

Seven indicators with an indicative target: systems on the register by status and level, share of self-approvals (70% or more), median time between declaration and verdict (less than 10 days), systems with trained owner and users (100%), systems discovered out of declaration (declining), reviews completed on time (90% or more) and high-risk systems with a compliance plan (100% before December 2, 2026).

6.5 Quarterly review of the register

Each quarter, the AI ​​coordinator sends each owner a list of their systems with three questions: still in use? still in accordance with the declaration? still the correct owner? Systems not in use for six months go to the status "withdrawn", those whose owner has left their position are reassigned or suspended.

Part 7. The Countdown to December 2, 2027

For each system classified as high-risk under Annex III, twelve months of work are divided into five milestones: at D-12 months, identify, classify, and appoint an owner; at D-9, obtain the supplier's instructions, EU declaration of conformity, and schedule, then decide whether to retain, replace, or withdraw the system; at D-6, train supervisors, establish log retention procedures, conduct the DPIA, and, if necessary, the fundamental rights impact assessment; at D-3, inform and consult the Works Council and prepare information for personnel; at D-1, review by the committee. A separate section addresses the case of systems already in operation (Article 111).

Part 8. Correspondence with ISO/IEC 42001 and the NIST AI RMF

An indicative table links each of the six building blocks of the kit to the requirements of ISO/IEC 42001:2023 and the functions of NIST AI RMF 1.0, for organizations that are aiming for certification or aligning with this framework.

Annexes

Four annexes: the self-assessment of the system in fourteen points, frequently asked questions, a glossary and resources, and a ready-to-fill system sheet which includes the 29 columns of the register.

Appendix A. Fourteen-point self-assessment of the system

Fourteen criteria, each worth 2 points for yes, 1 for partial, and 0 for no, to be completed individually in twenty minutes or as a committee once a year. If a score is below 14 out of 28, sections 1 and 4 are completed first.

9. Frequently Asked Questions

Do we need to declare the individual uses of a generalist assistant?

No. The generalist assistant is declared once, at the organizational level, along with its usage rules in the charter. What is declared individually are the agents, spaces, and automations that the business units create and share, because they have their own purpose, sources, and users.

Do we need an AI governance platform?

Not for beginners. The kit's components fit within SharePoint, Notion, or a shared workbook and are sufficient for most organizations. A dedicated platform becomes necessary when the system infrastructure exceeds several hundred systems, when multiple entities need to consolidate their records, or when your audit obligations require an automated trail. The kit's records can then be migrated without loss.

What should be done with an agent created by an employee and already used by their team?

Declare it, categorize it, and in the vast majority of cases approve it, often with conditions. The goal isn't to stop what works, but to acknowledge its existence and establish rules. A system perceived as policing usage is circumvented within weeks.

Who is responsible if a system produces an error?

With respect to third parties, the organization is responsible. Internally, the system owner is responsible for its use in accordance with the terms and conditions, as is the AI ​​expert for the system. This is why no system is approved without an owner.

How to reconcile the register with the charter of uses?

The charter establishes what each party has the right to do with AI; the registry and its rulings determine who approves what, on which list, and with what evidence. The two are mutually dependent: the charter stipulates the obligation to declare, and the system relies on the charter's rules to define standard conditions.

How long does the setup take?

An initial, qualified register was created in a two-day workshop with management; a complete system, including forms, decisions, a committee, and initial files, was established in six weeks. Subsequently, the AI ​​liaison officer will dedicate half a day per month to this system, and the committee will hold one hour per session.

What is AI governance?

It is the set of rules, roles, and decisions that govern the use of AI in an organization. Specifically: a charter of uses, a register of AI systems, qualification of each system under the AI Act, decisions made by a small committee, appointed roles, and a few indicators reviewed quarterly.

Is ISO/IEC 42001 certification required?

No, the standard is voluntary. It becomes useful when clients, contractors, or a regulator request formal proof of your AI management system. The registry, verdicts, and committee described on this page already form its foundation.

What is an AI governance committee?

This body decides which AI systems and agents the organization is authorized to use, and under what conditions. It comprises a sponsor from senior management, the AI ​​lead, the IT or security department, legal counsel and the data protection officer, and representatives from two or three business units. Initially, it meets for one hour per month, with a fixed agenda: register, items to be decided, scheduled reviews, incidents, and adjustments.

Who manages AI governance when the company does not have an AI manager?

Most often, an AI expert is appointed within the transformation, IT, or compliance department, with dedicated time. When this time is lacking at the outset, the project management can be entrusted to an external consultant who maintains the records, prepares the committee, and trains the internal expert until they take over.

10. Going further

This kit is the operational counterpart to our AI charter template The charter sets the rules, and the registry and its rulings enforce them system by system. For an overview of your deployment obligations, the timeline to 2028, and the AI ​​literacy program required by Article 4, see the AI Act kit from the sponsorNextStart.AI also installs the complete system according to your instructions, within six weeks, as part of the mission. Governing your agents, with a two-day entry point for inventory and qualification.

Read also : AI Charter in Business: The 2026 Model (Downloadable), AI Ambassador Network: The 2026 Toolkit, AI Adoption Roadmap in 12 Months: The 2026 Toolkit et AI Maturity Grid: The 2026 Kit.

The entire series of free kits. To drive adoption: AI charter template, AI training plan template, AI Ambassadors Kit, Manager's toolkit for dealing with AI, AI-powered time-saving kit, Adoption Roadmap Kit, AI maturity grid, AI Measurement and ROI Kit, Cowork kit, 50 Copilot M365 prompts, Copilot Studio kit, Deploy Microsoft 365 Copilot kit, Copilot Kit Cat, Copilot Excel kit, Copilot Teams and Outlook kit, Copilot Word and PowerPoint kit, Configure Claude kit, Deploying Claude in the Workplace Kit, Claude Agents Kit, Claude Skills kit, Claude Plugins Kit, Claude Code kit, Claude Design kit et Vibe coding kitFor the AI ​​project sponsor: AI Act kit, GDPR kit, Security and data kit, Shadow AI kit, AI and Social Dialogue Kit, frugal AI kit, AI Sovereignty Kit et responsible AI kitBy profession: AI HR kit, AI marketing kit, AI finance kit, AI kit for lawyers, AI kit for salespeople, AI toolkit for project managers, AI innovator kit, communicator's AI kit, AI Shopping Kit et AI Kit for Researchers.

11. sources

The regulatory references cited on this page are based on the following sources.

• European Union, Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Articles 4, 5, 6, 25, 26, 27, 50, 86, 111 and Annex III), 2024.
• European Union, Regulation (EU) 2026/1744 (omnibus IA) amending Regulation (EU) 2024/1689, adopted on 8 July and published on 24 July 2026, in force since 27 July 2026 (reformulated article 4, postponement of high risk).
• European Commission, Guidelines on prohibited artificial intelligence (AI) practices, as defined by the AI Act, February 4, 2025.
• European Commission, Guidelines on the AI ​​system definition, February 6, 2025.
• European Commission, AI Literacy, Questions & Answers (Article 4 of the AI Act), updated on July 27, 2026.
• European Union, Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation), 2016.
• CNIL, Data Protection Impact Assessment (DPIA).
• CNIL, Data protection impact assessment: publication of a list of processing operations for which an assessment is required, November 6 2018.
• ISO, ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system.
• NIST, AI Risk Management Framework, version 1.0, January 2023.