AI governance is an operating model organizations can use to keep AI systems accountable, safe, observable, and aligned with applicable requirements. It can combine decision rights, lifecycle processes, and technical controls across models, agents, tools, data, and APIs. [[1]](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/)[1] [[2]](https://www.iso.org/insights/iso-42001-explained)[2] [[3]](https://www.oecd.org/en/topics/ai-principles.html)[3]
For enterprise teams moving AI into shared infrastructure, written policies may not be enough. Teams can also collect evidence that approved controls operate consistently, without treating any gateway or platform as a complete governance program.
AI governance can be defined as the policies, roles, processes, and controls used to direct and oversee AI across its lifecycle. It can define system ownership, accepted risk, review processes, and the evidence teams retain. [[1]](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/)[1] [[2]](https://www.iso.org/insights/iso-42001-explained)[2] [[3]](https://www.oecd.org/en/topics/ai-principles.html)[3]
The NIST AI Risk Management Framework organizes risk work into Govern, Map, Measure, and Manage. It treats governance as cross-cutting and risk management as continuous throughout the lifecycle. [[1]](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/)[1]
ISO/IEC 42001 adds requirements for an AI management system, including policy, risk management, data controls, monitoring, and continual improvement. [[2]](https://www.iso.org/insights/iso-42001-explained)[2] The OECD AI Principles reinforce human oversight, transparency, robustness, accountability, traceability, and ongoing risk management. [[3]](https://www.oecd.org/en/topics/ai-principles.html)[3]
These references support a practical distinction. Program governance can set ownership, risk appetite, and review processes. Runtime governance can apply selected access, usage, data, and telemetry controls while an AI system is operating.
Enterprise AI systems may connect sensitive data, third-party models, internal APIs, or tools capable of taking action. An inventory and named ownership can help teams track approvals and understand what information crosses each boundary. [[1]](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/)[1] [[2]](https://www.iso.org/insights/iso-42001-explained)[2]
One practical step is the [formal shadow AI detection program](https://konghq.com/blog/enterprise/shadow-ai-detection-enterprise-governance)formal shadow AI detection program described in Kong's guidance. Teams can then classify each use case by impact, data sensitivity, autonomy, and regulatory scope.
For platform teams, governance can provide a shared operating model. Engineers can use reusable controls and escalation paths, while architecture and risk leaders can collect consistent evidence for reviews and incidents.
Teams should make approved AI easier to use while applying deeper review to higher-impact systems and actions.
No single taxonomy fits every organization. A practical AI governance framework can organize work around five connected pillars:
In this practical model, the pillars reinforce each other. Teams can connect telemetry to named owners and use shared enforcement to reduce inconsistent policy interpretation.
Common reference points include NIST AI RMF, ISO/IEC 42001, OECD principles, and laws that apply to a system or jurisdiction. They serve different purposes and should not be presented as interchangeable.
NIST AI RMF 1.0 is a voluntary framework released in 2023. NIST also published a Generative AI Profile in 2024, and the 1.0 framework remains under revision as of November 4, 2026. [[4]](https://www.nist.gov/itl/ai-risk-management-framework)[4]
ISO/IEC 42001:2023 specifies requirements for an organizational AI management system. Independent certification can confirm that the management system meets the standard, but it does not certify every model or guarantee legal compliance. [[2]](https://www.iso.org/insights/iso-42001-explained)[2]
The OECD principles are nonbinding recommendations. Enterprise teams can use them as a global reference for responsible stewardship across legal regimes. [[3]](https://www.oecd.org/en/topics/ai-principles.html)[3]
The EU AI Act applies progressively. August 2, 2026 has passed: enforcement powers for applicable provisions began, and Article 50 transparency requirements apply. [[5]](https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act)[5]
The December 2, 2026 milestone covers specified prohibitions concerning non-consensual intimate material and child sexual abuse material, plus a limited Article 50(2) transition. Annex III high-risk rules apply from December 2, 2027, while Annex I systems embedded in regulated products apply from August 2, 2028. [[6]](https://ai-act-service-desk.ec.europa.eu/en/ai-act/eu-ai-act-implementation-timeline)[6]
For non-compliance with Article 5 prohibited practices, the Act provides a ceiling of €35 million or 7% of worldwide annual turnover, whichever is higher. Other violation categories have different ceilings, and final penalties depend on the facts and enforcement process. [[7]](https://eur-lex.europa.eu/eli/reg/2024/1689)[7]
Kong's article maps [selected Kong AI Gateway controls to EU AI Act requirements](https://konghq.com/blog/enterprise/eu-ai-act-compliance)selected Kong AI Gateway controls to EU AI Act requirements. Teams should confirm legal interpretations with qualified counsel.
A practical governance approach can follow a system from proposal through retirement. Each stage can produce evidence that a reviewer can understand and retrieve. [[1]](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/)[1] [[2]](https://www.iso.org/insights/iso-42001-explained)[2] [[3]](https://www.oecd.org/en/topics/ai-principles.html)[3]
Kong's guide presents [AI observability and audit-trail practices](https://konghq.com/blog/learning-center/guide-to-ai-observability)AI observability and audit-trail practices as practical patterns for production evidence and incident response. Runtime telemetry does not replace model evaluation, safety testing, or business-level outcome monitoring. [[1]](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/)[1] [[2]](https://www.iso.org/insights/iso-42001-explained)[2]
In finance, fragmented AI adoption can weaken accountability and visibility across business units. The Financial Stability Board's June 2026 consultation highlights third-party dependencies, cyber risk, data quality, model risk, monitoring, and organization-wide governance. [[8]](https://www.fsb.org/uploads/P100626.pdf)[8]
A financial institution could require named ownership, documented risk appetite, approved data sources, third-party review, ongoing monitoring, and escalation for consequential decisions. The FSB practices are consultation proposals, not binding global rules.
In healthcare, governance requirements depend on the use case and regulator. For FDA-regulated AI-enabled device software functions, 2025 guidance illustrates change controls covering data management, retraining, performance evaluation, update procedures, transparency, and real-world monitoring. [[9]](https://www.fda.gov/media/166704/download)[9]
That example should not be generalized to every healthcare AI system. It offers one practical model for planned changes, validation, communication, and post-deployment evidence.
Start with the operating model, then connect policy to implementation. A workable sequence is:
This sequence can align governance with delivery. It can also make exceptions explicit before workarounds become permanent architecture.
One practical pattern is to route governed MCP server connections and AI tool calls through a shared control point. For traffic routed through it, enterprise teams can centralize selected visibility, policy enforcement, and observability. They can pair that layer with an approved inventory, identity-bound access, tool-level permissions, and consistent audit telemetry.
Kong's article on [how an AI gateway enforces runtime policy](https://konghq.com/blog/enterprise/what-is-an-ai-gateway)how an AI gateway enforces runtime policy explains this pattern. For agent-to-tool traffic, Kong's [MCP gateway architecture for server and tool governance](https://konghq.com/blog/learning-center/what-is-a-mcp-gateway)MCP gateway architecture for server and tool governance describes centralized discovery, access, routing, and telemetry for routed connections.
For traffic governed through this pattern, a concise runtime checklist can include:
Runtime controls should complement rather than replace program ownership, data and model governance, testing, human oversight, and legal review. [[1]](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/)[1] [[2]](https://www.iso.org/insights/iso-42001-explained)[2] [[3]](https://www.oecd.org/en/topics/ai-principles.html)[3] They apply only to traffic routed through the control layer, so teams must account for direct connections and downstream providers.
Kong positions its infrastructure approach around connections among applications, APIs, models, agents, and MCP servers. For traffic routed through Kong, its product materials describe selected authentication, authorization, policy, usage, and telemetry controls in AI Gateway and Konnect.
Kong's product materials describe MCP Gateway capabilities for MCP authentication, tool filtering, and observability. They position Konnect as providing shared management and inventory context, with deployment options for different enterprise architectures.
Kong presents [its AI governance solution](https://konghq.com/solutions/ai-governance)its AI governance solution as an implementation option for organizations that want AI and API runtime controls together. For traffic routed through Kong, its materials describe AI Gateway runtime controls that can support consistent enforcement. These controls do not replace organizational, data, model, legal, or risk governance.
**What is governance in AI?**
Governance in AI can be understood as the roles, policies, processes, and technical controls used to direct and oversee AI systems. It can establish accountability and manage risk from initial design through operation, change, and retirement. [[1]](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/)[1] [[2]](https://www.iso.org/insights/iso-42001-explained)[2] [[3]](https://www.oecd.org/en/topics/ai-principles.html)[3]
**Why is AI governance important?**
AI governance can help organizations manage security, legal, operational, ethical, and financial risks while scaling approved uses. It can also create evidence for oversight, incidents, audits, and decisions about whether a system should change or continue operating. [[1]](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/)[1] [[2]](https://www.iso.org/insights/iso-42001-explained)[2] [[3]](https://www.oecd.org/en/topics/ai-principles.html)[3]
**What are the core pillars of AI governance?**
A practical model includes accountability, risk and legal alignment, data and model controls, human oversight and transparency, and runtime enforcement and evidence. Organizations should adapt these pillars to their systems, risk appetite, and applicable requirements. [[1]](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/)[1] [[2]](https://www.iso.org/insights/iso-42001-explained)[2] [[3]](https://www.oecd.org/en/topics/ai-principles.html)[3]
**How do you build an AI governance framework?**
A practical approach is to assign decision rights, inventory AI systems, classify risk, and set minimum lifecycle controls. Teams can then implement reusable enforcement, collect reviewable evidence, manage exceptions, and improve the framework as systems and obligations change. [[1]](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/)[1] [[2]](https://www.iso.org/insights/iso-42001-explained)[2] [[3]](https://www.oecd.org/en/topics/ai-principles.html)[3]
**Which standards and regulations apply to AI governance?**
Common reference points include NIST AI RMF, ISO/IEC 42001, OECD AI Principles, and laws such as the EU AI Act. [[1]](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/)[1] [[2]](https://www.iso.org/insights/iso-42001-explained)[2] [[3]](https://www.oecd.org/en/topics/ai-principles.html)[3] [[5]](https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act)[5] The applicable mix depends on jurisdiction, industry, system purpose, data, users, and risk classification.
**Put AI governance controls into practice**
Request a demo to discuss where Kong runtime controls may fit within a broader AI governance program. [Contact Kong](https://konghq.com/contact-sales)Contact Kong.
[1] National Institute of Standards and Technology. AI RMF Core. NIST AI Resource Center. 2023; accessed November 4, 2026. [https://airc.nist.gov/airmf-resources/airmf/5-sec-core/](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/)https://airc.nist.gov/airmf-resources/airmf/5-sec-core/
[2] International Organization for Standardization. ISO/IEC 42001 explained. ISO. September 2026. [https://www.iso.org/insights/iso-42001-explained](https://www.iso.org/insights/iso-42001-explained)https://www.iso.org/insights/iso-42001-explained
[3] Organisation for Economic Co-operation and Development. AI principles. OECD. Updated 2024. [https://www.oecd.org/en/topics/ai-principles.html](https://www.oecd.org/en/topics/ai-principles.html)https://www.oecd.org/en/topics/ai-principles.html
[4] National Institute of Standards and Technology. AI Risk Management Framework. NIST. Accessed November 4, 2026. [https://www.nist.gov/itl/ai-risk-management-framework](https://www.nist.gov/itl/ai-risk-management-framework)https://www.nist.gov/itl/ai-risk-management-framework
[5] European Commission, Directorate-General for Communications Networks, Content and Technology. The enforcement framework of the AI Act. European Commission. October 20, 2026. [https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act](https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act)https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act
[6] European Commission AI Act Service Desk. Timeline for the Implementation of the EU AI Act. European Commission. Accessed November 4, 2026. [https://ai-act-service-desk.ec.europa.eu/en/ai-act/eu-ai-act-implementation-timeline](https://ai-act-service-desk.ec.europa.eu/en/ai-act/eu-ai-act-implementation-timeline)https://ai-act-service-desk.ec.europa.eu/en/ai-act/eu-ai-act-implementation-timeline
[7] European Parliament and Council of the European Union. Regulation (EU) 2024/1689, Article 99: Penalties. EUR-Lex. Consolidated July 27, 2026. [https://eur-lex.europa.eu/eli/reg/2024/1689](https://eur-lex.europa.eu/eli/reg/2024/1689)https://eur-lex.europa.eu/eli/reg/2024/1689
[8] Financial Stability Board. Sound Practices for Financial Institutions' Responsible AI Adoption: Consultation Report. Financial Stability Board. June 2026. [https://www.fsb.org/uploads/P100626.pdf](https://www.fsb.org/uploads/P100626.pdf)https://www.fsb.org/uploads/P100626.pdf
[9] U.S. Food and Drug Administration. Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions. FDA. August 2025. [https://www.fda.gov/media/166704/download](https://www.fda.gov/media/166704/download)https://www.fda.gov/media/166704/download
Traditional observability shows whether infrastructure and services are available, responsive, and error-free. AI observability retains those signals, then adds context ordinary APM often lacks. This includes models, tokens, retrieval results, evalu
Bring Financial Accountability to Enterprise LLM Usage with Konnect Metering and Billing Showback and chargeback are not the same thing. Most organizations conflate these two concepts, and that conflation delays action. Understanding the LLM showb
The Requirement : Article 10 of the EU AI Act mandates strict data governance for high-risk AI systems. This includes error detection, bias monitoring, and arguably most critically for enterprise use — ensuring that sensitive personal data (PII) is
Why AI guardrails matter It's natural to consider the necessity of guardrails for your sophisticated AI implementations. The truth is, much like any powerful technology, AI requires a set of protective measures to ensure its reliability and integrit
As organizations continue to adopt AI-driven applications, managing usage and costs becomes more critical. Large language models (LLMs), such as those provided by OpenAI, Google, Anthropic, and Mistral, can incur significant expenses when overused.
The explosion of AI-native applications is upon us. With each new week, massive innovations are being made in how AI-centric applications are being built. There are a variety of tools developers need to consider, be it supplying live contextual data
