How should a security leader set up an AI governance program?

A security leader should set up an AI governance program by naming accountable owners, building an inventory of every AI system in use, sorting those systems by potential impact, and applying data and access controls sized to each tier. NIST's AI Risk Management Framework, ISO/IEC 42001, federal OMB policy from April 2025 and joint CISA guidance from May 2025 each support parts of that sequence, and none of it requires waiting for a regulator.

The sources differ in authority. The NIST framework is voluntary, ISO/IEC 42001 certification is optional, OMB policy is written for federal agencies, and the New York Department of Financial Services letter explains how an existing regulation applies to AI, so the program should borrow structure from all of them while tracking which ones actually bind the company.

Who should own AI governance?

Executive leadership should own the decisions, with documented roles beneath it, and the security leader can run the machinery day to day. The NIST framework asks that executive leadership take responsibility for decisions about AI development and deployment risks, and that roles and lines of communication be documented and clear across the organization.

Federal agencies offer a working template. Under the April 2025 OMB policy, each agency's Chief AI Officer promotes AI adoption for lower risk uses, mitigates risks for higher-impact ones and advises on AI spending, and accountability follows the existing process for government IT instead of adding new layers of approval.

Boards need to be in the loop as well. For New York financial firms, the Department of Financial Services states that Part 500 requires the senior governing body to understand cybersecurity matters, AI-related risks included, and to receive regular reports on them.

What should the first AI inventory capture?

The inventory should list every system that uses or relies on AI, including AI embedded in vendor products, together with its owner, the data it touches and how critical it is to operations. Govern 1.6 of the NIST framework calls for mechanisms to inventory AI systems, resourced according to organizational risk priorities.

The DFS letter is more specific about scope. It tells entities to identify all information systems that use or rely on AI, including those that depend on AI-enabled products and services, keep an inventory of them, and prioritize mitigations for the ones critical to ongoing business.

Third parties belong in the same list. The NIST framework's Govern 6 category covers AI risks from third-party software, data and supply chains, and the DFS letter suggests extra contractual representations and warranties when service providers use AI on a firm's nonpublic information.

How do you decide which AI uses need the most scrutiny?

Create a small number of risk tiers and reserve the heaviest review for systems whose outputs affect people's rights, safety or access to services. OMB took this approach for agencies with a single high-impact AI category for uses that need heightened due diligence because of potential effects on rights or safety.

The tier should drive what happens next. For top-tier systems, testing before deployment and at intervals afterward is the NIST baseline, and the framework also expects processes to retire AI systems safely without raising risk.

Which security controls should come first?

Start with the data. Joint guidance from CISA, the NSA, the FBI and international partners in May 2025 frames data security as central to the accuracy, integrity and trustworthiness of AI outcomes, across the whole lifecycle from development to operation.

The NSA's summary of that information sheet lists digital signatures to authenticate trusted data revisions, data provenance tracking and trusted infrastructure among its practices, and it details risks from the data supply chain, maliciously modified data and data drift.

Employee use of public AI tools is the next gap. DFS suggests monitoring for unusual query behavior that could signal attempts to extract nonpublic information and blocking staff queries that might expose it to a public AI product, and it wants training that covers AI risks and the firm's procedures for them.

For generative AI specifically, NIST's Generative AI Profile supplies a ready control catalog of just over 200 actions against 12 risks, which saves a team from drafting its own list.

How do you keep the program from going stale?

Put a review date on everything. DFS expects cybersecurity programs to be reviewed and reevaluated at regular intervals because AI risks keep shifting, and ISO/IEC 42001 builds continual improvement into its requirements.

In practice that means a quarterly refresh of the inventory, an annual pass over the risk tiers, and a standing agenda item in the security steering committee. A 90-day starting plan could be: charter and owners in month one, a first inventory and tiering in month two, and data controls, monitoring and training for the top tier in month three.