Why Most Regulated Organisations Think They Have AI Governance (But Don't)
Ask a Chief Risk Officer or Head of Compliance at a regulated firm whether they have AI governance in place, and the answer is almost always yes. Ask them to walk you through how a model decision gets escalated, who owns the risk register for a deployed AI system, or what happens when an algorithm produces an unexpected output — and the conversation changes quickly.
The confidence is understandable. Over the past two years, organisations across financial services, healthcare, insurance, and the public sector have invested real effort in drafting AI policies. Boards have approved them. Legal teams have reviewed them. Communications teams have published them on websites as evidence of responsible AI adoption. On paper, the box is ticked.
But a policy is not a governance framework. And in highly regulated environments, conflating the two is not just a semantic error — it is a material compliance risk. The gap between what organisations believe they have and what they actually have is precisely where regulatory exposure lives, and it is wider than most senior leaders realise.
The uncomfortable truth is that an AI policy tells people what the organisation intends. An AI governance framework determines whether those intentions are ever actually upheld.
What an AI Policy Actually Is — and Where It Stops
An AI policy is a statement of principles and intent. It typically covers the organisation's position on responsible AI use, the values that should guide AI development and deployment, high-level rules around data use and human oversight, and references to relevant legislation such as the EU AI Act, the UK's AI regulatory frameworks, or sector-specific guidance.
A well-written policy is genuinely valuable. It signals commitment. It provides a reference point for employees making day-to-day decisions. It can help attract clients and partners who want assurance that AI is being used thoughtfully.
But a policy, by definition, stops at the level of intention. It cannot:
- Assign accountability for specific AI systems to named individuals or functions
- Mandate processes for model validation, monitoring, or decommissioning
- Define escalation paths when an AI system behaves unexpectedly or causes harm
- Create audit trails that demonstrate compliance over time
- Enforce risk thresholds that trigger review or intervention
- Integrate with existing governance structures such as risk committees, procurement controls, or third-party assurance programmes
This is not a criticism of policies — it is simply an accurate description of what they are designed to do. The problem arises when organisations treat the policy as the destination rather than the starting point. When there is no framework sitting beneath it, the policy floats free of any operational reality.
What an AI Governance Framework Does That a Policy Cannot
An AI governance framework is the operational architecture that makes policy real. Where a policy states that AI must be used ethically and transparently, a framework specifies who is responsible for verifying that, how often, using what criteria, and what happens when those criteria are not met.
A functioning AI governance framework typically encompasses several interconnected layers:
Roles and accountability structures. Defined ownership at the system level — not just a general AI lead, but named accountability for each material AI application, including third-party tools and embedded models in vendor products.
Risk classification and tiering. A structured methodology for categorising AI systems by risk level, aligned to regulatory expectations. High-risk systems face more rigorous pre-deployment review, ongoing monitoring, and documentation requirements than low-risk tools.
Lifecycle governance. Processes that follow an AI system from initial procurement or development through deployment, monitoring, change management, and eventual decommissioning. Each stage has defined controls and sign-off requirements.
Model risk management integration. For regulated firms in particular, AI governance cannot sit in isolation from model risk management. The framework should connect directly to existing model validation and review processes, extending them where necessary to cover newer AI paradigms including large language models and generative AI.
Incident and escalation management. Clear triggers and pathways for escalating concerns, reporting incidents, and suspending systems where necessary. This is the part most policies completely omit.
Board and committee reporting. Regular, structured reporting that gives senior leaders genuine visibility into the AI risk landscape — not just a list of approved use cases, but insight into performance, drift, incidents, and emerging risks.
Third-party and supply chain oversight. Controls over AI embedded in vendor products, ensuring that the organisation's governance obligations extend to technology it does not build itself.
A framework, in short, converts intention into mechanism. It is what allows an organisation to demonstrate — not just claim — that its AI is governed.
The Compliance Theatre Problem: When Documentation Replaces Accountability
Compliance theatre is the organisational tendency to produce documentation that looks like governance without creating the conditions for actual accountability. It is common across many risk domains, but AI has accelerated it dramatically because the regulatory landscape is still maturing and the pressure to appear compliant often outpaces the pressure to be compliant.
In practice, compliance theatre around AI looks like this: an organisation has an AI policy, perhaps an AI ethics statement, and a list of approved use cases. There may be a governance working group that meets quarterly. There is probably a PowerPoint deck that gets shown to auditors. But probe beneath the surface and you find that no one can tell you who is accountable if a credit decisioning model produces discriminatory outputs. No one can produce evidence of the last model validation exercise. The working group has no decision-making authority and no escalation path to the board.
The documentation exists. The accountability does not.
This matters enormously in regulated environments. Regulators — whether the FCA, PRA, ICO, CQC, or sector equivalents — are increasingly focused on AI governance in their supervisory work. The FCA and PRA have both signalled expectations that firms demonstrate operational governance over AI, not merely documented policies. They are asking to see evidence that governance is functioning: minutes, validation reports, incident logs, accountability maps, board papers. A policy, however well-written, cannot produce that evidence on its own.
The risk is not just regulatory censure. It is that when something goes wrong — and with AI at scale, something eventually will — the organisation discovers that its governance framework existed only on paper, and there is no mechanism to understand what happened, who was responsible, or how to prevent recurrence.
How AI Governance Advisory Surfaces the Gap Before Regulators Do
This is where AI governance advisory becomes genuinely valuable — not as a compliance exercise, but as a risk management intervention.
Effective AI governance advisory begins not with a framework template but with a diagnostic. Before recommending any structure, a credible advisory approach examines what actually exists: not what the policy says, but how decisions are made in practice, who holds accountability in reality rather than on paper, what controls exist at the system level, and where the gaps between documented intent and operational reality are most acute.
At Navitec AI, this diagnostic phase is central to how we work. Regulated organisations often come to us believing their governance is in reasonable shape. The diagnostic frequently reveals a different picture: policies that have never been operationalised, risk registers that list AI systems but assign no ownership, vendor AI tools that sit entirely outside governance processes, and board reporting that provides no genuine visibility into AI risk.
Surfacing these gaps before regulators do matters for several reasons. First, it gives the organisation time to remediate rather than respond under pressure. Second, it allows remediation to be proportionate and sequenced — prioritising the highest-risk systems and most critical gaps rather than attempting to build everything at once. Third, it produces the kind of documented evidence trail that demonstrates good faith effort to regulators, which is materially different from having no trail at all.
The diagnostic also changes the conversation with senior leadership. When accountability gaps are named precisely — this system has no named owner, this vendor tool has never been risk-assessed, this incident type has no escalation path — the abstract question of whether governance is adequate becomes a concrete set of decisions that the board and executive can make.
AI governance advisory, done well, is ultimately about translating regulatory obligation and organisational intent into operational reality. It is the professional function that builds the bridge between the policy and the framework.
Building the Bridge: Turning Policy Into a Functioning Governance Framework
For regulated organisations that recognise the gap between their AI policy and genuine AI governance, the path forward is structured and achievable — but it requires honest assessment and sequenced action.
Start with the diagnostic, not the framework. Resist the temptation to adopt a framework template before understanding what actually exists. A governance structure built on incomplete understanding of the current state will replicate existing gaps in new form.
Map your AI landscape with precision. This means identifying every material AI system in use, including embedded tools in vendor products. Many organisations find this inventory more complicated than expected — and that complexity itself is useful governance intelligence.
Assign accountability at the system level. Every material AI application should have a named owner who understands what the system does, what risks it presents, and what their responsibilities are. This is the single most impactful governance action an organisation can take.
Integrate with existing governance structures. AI governance should not be a standalone silo. It should connect to model risk management, operational risk, data governance, procurement, and board risk reporting. Integration is what makes governance sustainable.
Build for the regulator's questions, not just your own. Think about what evidence you would need to produce in a regulatory examination. Can you demonstrate that governance is functioning — not just that a policy exists? If the answer is uncertain, that uncertainty is itself a finding.
Treat governance as continuous, not periodic. AI systems change. Regulatory expectations evolve. A governance framework that is reviewed annually is already behind the pace of change. Build monitoring, reporting, and review into the operating rhythm of the organisation.
The organisations that will navigate the next phase of AI regulation with confidence are not those that have the most comprehensive policies. They are those that have built the operational infrastructure to back their policies up — where accountability is real, where controls are functioning, and where evidence of governance exists not just in documents but in practice.
If your organisation has the policy but not yet the framework, the gap is closeable. But it requires acknowledging it exists first.