An AI governance framework is the set of owners, rules, records and checks that decide which AI you use, for what, and how you prove it works. For a finance or audit function it can be small: an inventory, risk tiers, approval steps, monitoring and a log you can show a reviewer. Start with those five and add the formal standards later.
Last reviewed: 17 October 2026. Facts checked. We opened NIST's AI Risk Management Framework page (released 26 January 2023, voluntary, with a Generative AI Profile published 26 July 2024) and the EU AI Act's high-level summary at artificialintelligenceact.eu. We searched, but did not open, material on ISO/IEC 42001 (iso.org returned 403). For India's DPDP Rules we relied on search results that cite the PIB backgrounder; we could not open the PIB page, and sources differ on whether notification was 13 or 14 November 2025.
Why finance and audit need their own layer
Company-wide AI policy often covers chatbots and marketing. Finance and audit have extra duties.
- Their output feeds financial statements and opinions.
- They hold confidential client and employee data.
- Their work must be reviewable by someone else, years later.
A framework is how you show that AI helped the work without weakening it.
The five parts
| Part | What it answers | Minimum to have |
|---|---|---|
| Ownership | Who is accountable? | One named owner, plus a reviewer |
| Inventory | What AI do we use? | A list of tools, uses, data and users |
| Risk tiers | How careful must we be? | Low, medium, high with rules for each |
| Approval and testing | Is it safe to start? | A short checklist before go-live |
| Monitoring and records | Is it still working? | Logs, periodic review, incident route |
1. Ownership
Name a person, not a committee. In a CA firm that may be a partner. In a company it may sit with the CFO or head of internal audit, with IT and legal consulted. The NIST framework treats governance as a core part of AI risk management, not an add-on.
2. Inventory
You cannot govern what you cannot see. List every AI tool in use, including free accounts staff opened themselves. For each, record the purpose, data it touches, vendor, and who approved it.
3. Risk tiers
A simple scheme works.
- Low: drafting generic text with no client data.
- Medium: summarising client documents, extracting data for a person to check.
- High: anything that feeds a figure, a conclusion or a decision, or that acts on a system.
Higher tiers need more testing, more review and tighter data rules. The EU AI Act also sorts systems into tiers (unacceptable, high, limited, minimal risk), which is a useful model even if it does not apply to you.
4. Approval and testing
Before a tool goes live, check where data is stored, whether the vendor trains on your inputs, what happens on error, and test it on a file where you know the answer. Our AI audit tool evaluation checklist and AI governance workpaper give ready structures.
5. Monitoring and records
Sample AI outputs regularly, track errors and near misses, and decide who is told when something goes wrong. Review the inventory at least once a year, and whenever a vendor changes terms.
Audit trail: why it matters
An audit trail is a time-stamped record of who did what, when, with which data. For AI it should show the prompt or instruction, the data supplied, the output, the model or tool version, and who reviewed and accepted it.
Why it matters:
- Reperformance. A reviewer can follow the steps.
- Accountability. Edits and approvals tie to a person.
- Incident response. If an output was wrong, you can find what else it touched.
- Evidence. Working papers need support for conclusions.
India already has a related requirement for accounting software used by companies: an audit trail of changes. We did not re-open the rule text for this post; our existing explainer covers it in audit trail in accounting software: Rule 3(1) and Rule 11(g). For AI-specific records see audit logs and tamper-evident records.
Where standards fit
- NIST AI RMF is voluntary guidance. See our NIST AI RMF explainer.
- ISO/IEC 42001 is a management system standard that organisations can be certified against. See ISO/IEC 42001 certification.
- EU AI Act is law for those in scope. See EU AI Act for Indian companies.
- DPDP Rules apply to personal data. They were notified in November 2025 with an eighteen-month phase-in.
A 30-day start
- Week 1: name the owner and list every tool.
- Week 2: assign each use a tier.
- Week 3: write a one-page policy and approval checklist.
- Week 4: switch on logging and schedule the first review.
Frequently Asked Questions
What is an AI governance framework?
It is the roles, rules, records and checks that control how an organisation chooses, uses and monitors AI. It can be a few pages for a small team.
Do we need ISO 42001 to have governance?
No. The standard is one way to structure and certify a programme. Many teams begin with an inventory, tiers and a policy.
Who should own AI governance in a CA firm?
A named partner, with support from whoever handles IT and confidentiality. One accountable person works better than a shared one.
What should an AI audit trail record?
The request, data supplied, output, tool and version, reviewer and decision, with dates. Keep it where it cannot be quietly edited.
Is AI governance a legal requirement in India?
We did not find a general Indian law requiring a governance framework. Data protection duties under the DPDP Act and professional duties still apply.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error