Laws and policies establish minimum threshold requirements that businesses must meet. These rules can vary greatly in jurisdiction and in scope. Some—like New York City’s law governing the use of automated employment decision tools—center on a particular capability. Others have a broader impact. For example, the EU’s proposed AI Act covers all AI systems developed, deployed, or used within the EU, regardless of industry. Businesses must understand and track the emerging patchwork of regulations to ensure that they successfully navigate compliance.

Three additional categories round out the list of governance mechanisms: voluntary guidelines, which governments and industry often develop in concert; standards, which can serve as benchmarks for verifying compliance with regulatory requirements; and certification programs, which can demonstrate—to customers, industry partners, and regulators alike—that a company’s AI processes conform with underlying standards.

By understanding the impact and interaction of these mechanisms, organizations can shape their own AI governance more precisely and more effectively. To that end, we’ve found that some best practices can accelerate and smooth the journey.

Getting AI Governance Right

Good AI governance starts at the top, meaning that RAI is a CEO-level issue. It goes directly to a customer’s trust in how a company uses technology, and it addresses organizational and regulatory risks. Setting an appropriate tone from the C-suite is vital to facilitating and supporting a culture that prioritizes RAI. A 2023 survey by MIT Sloan Management Review and BCG found that organizations whose CEOs participate in RAI initiatives realize 58% more business benefits than those whose CEOs are uninvolved.

We recommend that companies establish a committee of senior leaders to oversee development and implementation of their RAI program. The committee’s first task should be to create the principles, policies, and guardrails that will govern the use of AI throughout the organization. These principles may be high-level, but they are essential, serving as a guiding light for developing and using AI appropriately. The most effective principles link to an organization’s mission and values, making it easier to zero in on which types of AI systems to pursue—and which ones not to pursue.

The next step is to establish linkages to existing corporate governance structures, such as the risk committee. All too often, companies inadvertently create a shadow risk function, but linkages help prevent that. They also ensure clear escalation paths and decision authority for addressing potential problems.

Other best practices include developing a framework to flag inherently high-risk AI applications for greater scrutiny, consulting voluntary guidelines for insights on industry best practices, and monitoring high-profile litigation to get a sense of—and start preparing for—where courts may land on legal issues that are still in flux, such as the impact of GenAI on intellectual property rights.

Building a comprehensive RAI program takes time, but savvy companies can speed the journey. It’s a route worth taking. With the right governance, AI can drive value and growth without driving risk.