Artificial intelligence has moved beyond being a laboratory project and is now used to decide on credit, screen resumes, respond to clients, and prioritize customer service. Each of these decisions uses personal data and has an impact on people. AI governance is the set of rules, roles, controls, and evidence that allows a company to use this technology safely, in a traceable way, and within the law. This guide explains what it involves, what regulations require, and how to structure a program that works in practice.
What is AI governance?
AI governance is how the organization decides Which artificial intelligence systems can be used, for what purpose, by whom, and under what conditions?...and how it proves that these decisions have been implemented. It rests on three pillars: an inventory of the systems and models in use, an assessment of the risks of each one, and a set of policies and controls that accompany the life cycle, from design to disposal.
This is not just a technical issue. A recommendation system, a chatbot, or a scoring model involves legal, privacy, information security, the business area that uses it, and often external suppliers. Therefore, AI governance is born alongside privacy and risk management programs, not separately.
Why has this become a priority?
- The data is personal. A large portion of AI systems process data from customers, employees, and citizens; LGPD This applies fully to this treatment, including the rules on automated decisions (Article 20) and on impact reporting.
- Regulation has arrived. O AI Act The European Union's [regulatory body] came into effect in 2024 and applies obligations based on risk level; in Brazil, Bill 2338/2023 is being processed in Congress with a risk-based approach, and the ANPD [National Data Protection Authority] is already acting on the use of personal data in models.
- The risk is both reputational and operational. Biases, hallucinations, data leaks through prompts, and unauthorized use of tools by teams (so-called "shadow AI") are incidents that happen without anyone having chosen to take the risk.
- Clients and auditors ask. Supplier questionnaires and audits now include questions about the use of AI, and the answer must be supported by evidence.
What do the rules and laws require?
LGPD
The General Data Protection Law does not mention the term "artificial intelligence," but it covers any processing of personal data carried out by AI systems: legal basis, purpose, minimization, transparency, and security apply to the training and use of the models. Article 20 guarantees the data subject the right to request a review of decisions made solely on the basis of automated processing and requires clear information about the criteria used. In high-risk processing, the Data Protection Impact Assessment (DPIA) is the instrument for documenting the safeguards.
AI Act (European Union)
The European AI Regulation classifies systems into risk levels: prohibited practices, high risk (with obligations regarding risk management, data quality, technical documentation, human oversight, and registration), limited risk (transparency obligations), and minimal risk. It also creates obligations for general-purpose AI models. This applies to companies outside the European Union when the system is placed on the European market or its results are used there, which affects Brazilian groups with international operations.
PL 2338/2023 (Brazil)
The bill that creates the legal framework for artificial intelligence in Brazil follows a risk-based classification logic, provides for the rights of affected individuals, algorithmic impact assessment for high-risk systems, and a national system of regulation and governance. Even before its approval, it indicates the direction that companies need to follow.
ISO/IEC 42001 and NIST AI RMF
ISO/IEC 42001 is the AI management system standard, structured like the ISO standards for security (27001) and privacy (27701): policy, roles, impact assessment, controls, and continuous improvement, with the possibility of certification. The NIST AI Risk Management Framework, from the United States, organizes the work into four functions (govern, map, measure, and manage) and is used as a reference for risk programs. Both serve as the backbone for a program that needs to demonstrate compliance with more than one regulation.
How to structure the program in 7 steps
1. Take inventory of the AI systems.
No governance works without knowing what exists. Document each system or project that uses AI: responsible area, purpose, technology and model employed, supplier, input and output data, people affected, and stage (idea, pilot, production). Include the tools used by teams on a daily basis, such as code writing and writing assistants, which often escape the official map.
2. Link each system to the personal data it processes.
For each item in the inventory, identify which personal data goes into the training or usage, from which data subjects, on what legal basis, and with which providers. This link to data mapping is what allows you to respond to a data subject's request, assess an incident, or produce an impact report without starting from scratch.
3. Classify the risk
Evaluate each system using objective criteria: impact on people's rights, use of sensitive data, degree of autonomy in decision-making, number of data subjects, regulatory exposure, and dependence on third parties. The result defines the required level of control, from simple registration to a full impact report with human oversight.
4. Define policies and guidelines.
The AI usage policy outlines what is permitted, what requires approval, and what is prohibited, covering topics such as the insertion of personal data into external tools, human review of results, intellectual property, and communication with users. It needs to be concise, known by the teams, and accompanied by training.
5. Link standards, controls, and action plans.
For each high-risk system, relate the applicable requirements (LGPD, AI Act, ISO 42001, internal policies) to the implemented controls: bias testing, data quality validation, decision logging, appeals channel, performance monitoring. Anything not yet covered becomes an action plan with a responsible party and deadline.
6. Conduct an impact assessment when the risk warrants it.
High-risk systems require an impact assessment before going into production: system description, necessity and proportionality, risks to people, mitigation measures, and acceptable residual risks. In Brazil, this aligns with the LGPD's Impact Assessment Report; in Europe, with the impact assessment on fundamental rights under the AI Act.
7. Monitor, review, and generate evidence.
Models change, data changes, suppliers change. Define periodic reviews per project, log AI-related incidents, and keep reports ready for committees, audits, and authorities. The audit trail, detailing who did what and when, is what transforms policy into evidence.
Roles: who is responsible for what
- AI (or data) committee: Approves policies, decides on high-risk systems, and monitors indicators.
- Person in Charge (DPO): ensures that the use of personal data by the systems complies with the LGPD (Brazilian General Data Protection Law) and conducts impact assessments.
- Product owners and business areas: They are responsible for the purpose, the results, and the human review of decisions.
- Technology and security: They take care of data quality, technical controls, and monitoring.
- Legal and compliance: They interpret applicable regulations and handle contracts with AI suppliers.
common mistakes
- Treating AI governance as a document, and not as a process with a living inventory and revisions.
- Leave out of the inventory the AI tools used informally by the teams.
- Classifying everything as low risk to avoid work, or everything as high risk and paralyzing innovation.
- Failure to document decisions: without an audit trail, the policy serves as no evidence.
- We need to rely on the vendor to answer what the model does with the data.
How Privacy Tools supports AI governance
The module of AI Governance da Privacy Tools It brings together, in one place, what the steps above require: the registration of all projects that use AI, classification by area, purpose, stage, technology and model, identification of personal data processed and suppliers involved, association with standards, policies and controls, action plans and periodic reviews per project, and the generation of evidence and reports for committees, audits and authorities. It integrates with Data Mappingin Risk management and Diagnoses and AssessmentsSo that AI governance becomes part of the privacy program, and not a separate effort.
FAQ
Is AI governance mandatory in Brazil?
There is still no specific law in effect, but the LGPD (Brazilian General Data Protection Law) already imposes obligations on any processing of personal data by AI, and Bill 2338/2023 tends to make risk assessment mandatory for high-risk systems. Companies operating in the European Union are already subject to the AI Act.
Where to start with a small team?
Through inventory and usage policy. Knowing which systems exist and stating what can or cannot be done with personal data already reduces the most frequent risks; risk classification and impact assessments follow, prioritizing systems that affect people.
What is the relationship between AI governance and LGPD (Brazilian General Data Protection Law)?
All AI that uses personal data falls under the LGPD (Brazilian General Data Protection Law). The inventory of AI systems is an extension of data mapping, algorithmic impact assessment is aligned with the RIPD (Brazilian Data Protection Regulation), and the right to review automated decisions requires a service channel for the data subject.
Want to see how to structure inventory and controls in practice? Request a demo da Privacy Tools.
