A workable AI governance framework for an L&D or HR team has seven parts: scope, ownership, acceptable use, data handling, risk tiers, review cadence, and training. Write each part on one page or less, put a named person on each, and review the whole set on a fixed schedule. That is enough to start, and it is enough to make the policy something people can actually follow.
This post is for training and HR leaders who have AI tools in place and have been handed the "governance" question, often without a template. It is a practical working structure, not a certification path. If you want the public frameworks behind it, they are covered near the end with links to the sources.
Governance and regulatory requirements vary by country, state, industry and contract. This post is general information, not legal advice. Check your own obligations with qualified counsel.
Why L&D and HR end up owning part of this
Legal and IT usually own the contracts and the security review. But the questions that decide whether AI governance works day to day sit with people leaders. What may an employee paste into a chatbot? Who decides whether a tool can be used to draft performance feedback? What does a new hire learn in week one? Those are policy questions, and they are also training questions.
A policy nobody has been taught is a document. A training program with no policy behind it teaches people to guess. The framework below treats them as one system.
The seven parts
1. Scope
Decide what the framework covers before you write a rule. List the AI tools in use, including the ones nobody approved. Decide whether it covers tools employees use on their own accounts, AI features inside existing software, and AI used on behalf of customers or candidates. A short, honest inventory beats a perfect one that never gets built.
2. Ownership
Every part needs a named owner, not a committee. A common split: an executive sponsor who signs the policy, a policy owner (often HR, legal or risk) who maintains it, a technical owner who approves tools and settings, and an enablement owner (usually L&D) who makes sure people know the rules and can do the work. Write the names down. If a role is empty, that is your first finding.
3. Acceptable use
Say what people may do, may do with approval, and may not do, in plain sentences. Cover disclosure (when to tell a colleague, client or candidate that AI helped), accuracy (a person remains responsible for anything they send or publish), and the question of consequential decisions about people. Keep it short enough to be read on one screen.
4. Data handling
Most real incidents start here. Define what categories of information may never go into an AI tool, what may go into approved tools only, and what is unrestricted. Employee records, candidate information, customer data and confidential contract terms usually belong in the first two groups. Specify which tools are approved for which category, and what to do if someone has already pasted something they should not have.
5. Risk tiers
Not every use needs the same scrutiny. A simple three-tier sort works for most teams. This is a practical convention, not an official standard:
- Low: drafting, summarizing and brainstorming where a person reviews the output and no personal data is involved.
- Medium: work that touches internal data, customers or training content that will be published, with a named reviewer before release.
- High: anything that influences decisions about a person, such as hiring, promotion, pay, discipline or access to opportunity. Require a documented owner, human review of every outcome, and sign-off before the use starts.
When you are unsure which tier a use belongs in, move it up one.
6. Review cadence
Tools, vendors and rules change faster than annual policy cycles. Pick a cadence and put it on a calendar: a light quarterly check of the tool inventory and incidents, and a fuller yearly review of the policy itself. Also set triggers for an off-cycle review, such as a new tool, a vendor change, a reported incident or a new regulation that applies to you.
7. Training and enablement
This is the part most frameworks mention in a sentence and most teams under-build. Training should cover the rules (what the acceptable-use and data pages say), the judgment (how to check output, when to escalate) and the work (how AI fits into the real tasks of each role). Documentation should live where people work, not in a policy folder. And you should be able to tell whether behavior changed, not only whether people completed a module.
How the public frameworks fit
You do not need to adopt a formal framework to write a good policy, but it helps to know what the main ones are for.
- NIST AI Risk Management Framework. A voluntary framework released by NIST on January 26, 2023 (NIST AI 100-1). It organizes AI risk work into four functions: Govern, Map, Measure and Manage. NIST published a Generative AI Profile (NIST AI 600-1) on July 26, 2024. The Govern function is the closest match to parts 2, 3 and 6 above. Source: NIST AI RMF.
- ISO/IEC 42001. An international standard, published in 2023, for an AI management system: the policies, roles, risk processes and review cycles an organization uses to govern AI it develops, provides or uses. It is a larger undertaking than the seven parts here. Source: ISO/IEC 42001.
- EU AI Act. Regulation (EU) 2024/1689 sorts AI systems into four levels: unacceptable risk, high risk, transparency risk, and minimal or no risk. The European Commission lists AI tools for employment and worker management, such as CV-sorting software for recruitment, as a high-risk use. Its obligations have phased dates and have been adjusted since the Act entered into force, so check the current schedule if you operate in or sell into the EU. Source: European Commission.
The EU tiers and the "high" tier in part 5 point the same direction: decisions about people deserve the most care. Whether and how the EU Act applies to you is a legal question.
Where to start this month
- Inventory the tools actually in use, approved or not.
- Name an owner for each of the seven parts.
- Write the data-handling page first, since it prevents the most expensive mistakes.
- Sort current AI uses into the three tiers and look hardest at anything that touches decisions about people.
- Put the first review on the calendar.
If you want to check where your own setup stands, the AI readiness checklist walks the same ground in yes/no form, and this comparison of a strategy consultant and a fixed-scope audit can help you decide what kind of help fits.
Next step
To go further on AI enablement, see The AI Enablement Standard. New posts on this topic are announced in the newsletter.