--- title: "Building an AI Governance Framework | Pitch" description: "What an internal AI governance framework consists of, which legal duties it must carry, and how a mid-sized organisation can build one in proportion to its use…" url: https://www.pitch.law/academy/building-an-ai-governance-framework --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [Legal Aspects of Artificial Intelligence](https://www.pitch.law/academy/topics/legal-aspects-of-artificial-intelligence) # Building an AI Governance Framework What an internal AI governance framework consists of, which legal duties it must carry, and how a mid-sized organisation can build one in proportion to its use of AI. - By By Bart Lieben, Attorney-at-Law - Published 25 February 2026 ## The legal framework No law says "you must have an AI governance framework". But several duties in Regulation (EU) 2024/1689 (the AI Act) and in the GDPR can only be met by an organisation that has one. A framework is the set of policies, roles, records and controls that lets you show, system by system, that you know what AI you use, what law applies and who is responsible. ### What the law requires that governance has to deliver - **AI literacy (Article 4 AI Act).** Providers and deployers must take measures to ensure their staff have an adequate level of AI literacy, taking account of their role and the context. The duty has applied since 2 February 2025. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) amended the wording of Article 4. Check the current text when you design training. - **Prohibited practices (Article 5).** Certain uses, such as emotion recognition in the workplace or social scoring, have been banned since 2 February 2025. Governance must stop them from entering the organisation. - **High-risk systems.** Providers must have risk management (Article 9), data governance (Article 10), documentation (Article 11), logging (Article 12) and human oversight (Article 14). Deployers must use the system according to its instructions, assign human oversight to competent people, monitor operation, keep logs for at least six months and inform workers' representatives and affected workers (Article 26). The Omnibus moved the application of the high-risk rules for Annex III systems to 2 December 2027 and for systems embedded in regulated products (Annex I) to 2 August 2028. See [the AI Act timeline](https://www.pitch.law/academy/ai-act-compliance-timeline). - **Transparency (Article 50).** Users must be told when they interact with an AI system or see AI-generated content, in the cases listed in the Article. - **GDPR.** Records of processing (Article 30), data protection impact assessments (Article 35), rules on solely automated decisions (Article 22) and processor contracts (Article 28) apply whenever AI processes personal data. See [the AI Act and the GDPR](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap). ### Five building blocks 1. **Inventory.** A register of every AI system in use or development: purpose, data, affected persons, vendor, and the role of the organisation as [provider or deployer](https://www.pitch.law/academy/provider-vs-deployer-ai-act). 2. **Classification and assessment.** For each system, the AI Act [risk tier](https://www.pitch.law/academy/ai-act-risk-classification-explained), whether a DPIA is needed, and, for the deployers that Article 27 covers, a fundamental rights impact assessment. 3. **Accountability.** A named owner for each system, a decision-maker for approving, changing and stopping systems, and a route for escalation. Smaller organisations can combine these roles. 4. **Controls.** A usage policy for employees, human oversight procedures, logging, incident handling and training. 5. **Vendor management.** Due diligence before purchase, [contract terms](https://www.pitch.law/academy/ai-clauses-in-vendor-contracts) and periodic review. ## In practice A Leuven logistics company with 300 staff uses an AI tool to rank job applicants, a chatbot on its website, and a generative assistant that employees use for drafting. It has no AI policy. It starts with an inventory and finds eleven tools, three of which nobody in management had approved. The recruitment tool falls in Annex III and is high-risk; the company is a deployer and must plan for the obligations from the applicable date. The chatbot needs an AI disclosure. The generative assistant is acceptable for general drafting but not for client data, and the policy says so. The company appoints an AI owner in HR and one in IT, adds AI to the procurement checklist, runs a DPIA for the recruitment tool, and schedules training. The whole framework is a few documents and a register. It is proportionate, and it can be shown to a regulator. ## Frequently asked questions ### Do we need a framework if we only use ChatGPT-type tools? You need at least a policy, an inventory and training. The literacy duty and the GDPR apply even to limited use. ### Who should own AI governance? A senior person with authority across legal, IT and HR, often supported by the DPO. The AI Act does not require a specific title. ### How is this different from GDPR compliance? The GDPR concerns personal data. The AI Act concerns AI systems, whether or not they use personal data. The two share tools, such as registers and impact assessments, but not scope. ### How often should we update it? When you adopt or change a system, when the law changes, and at a fixed review interval, for example yearly. ## How this connects Our service [AI Act compliance](https://www.pitch.law/solutions/ai-act-compliance) builds this framework with you. [Our AI Act register and assessments](https://www.pitch.law/technologies/ai-act-governance-toolkit) keep the inventory, classification and assessments, [our compliance registers](https://www.pitch.law/technologies/privacy-register) hold the GDPR records, and [our DPIA tool](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) supports the impact assessments, with an attorney reviewing the results. ## In short - The five building blocks of an AI governance framework - How the AI Act and the GDPR shape it - Roles, inventory, assessments and vendor control - A worked example for a mid-sized company ## Related solutions - [Solutions](https://www.pitch.law/solutions/ai-act-compliance) ### [AI Act Compliance](https://www.pitch.law/solutions/ai-act-compliance) [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://www.pitch.law/solutions/ai-act-compliance) ## Technology we use - [Technology](https://www.pitch.law/technologies/ai-act-governance-toolkit) ### [AI Act Register and Assessments](https://www.pitch.law/technologies/ai-act-governance-toolkit) [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://www.pitch.law/technologies/ai-act-governance-toolkit) - [Technology](https://www.pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) - [Technology](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) ### [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) ## More in Legal Aspects of Artificial Intelligence - ### [AI Act Timeline: What Applies When](https://www.pitch.law/academy/ai-act-compliance-timeline) [The application dates of the AI Act as of October 2026, including the postponement of the high-risk rules adopted in 2026.](https://www.pitch.law/academy/ai-act-compliance-timeline) - ### [AI Act Meets GDPR: Where the Two Frameworks Overlap](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) [How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories.](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) - ### [AI Act Risk Classification](https://www.pitch.law/academy/ai-act-risk-classification-explained) [How to tell whether an AI system is prohibited, high-risk, subject to transparency duties or free of specific obligations under the AI Act.](https://www.pitch.law/academy/ai-act-risk-classification-explained) - ### [AI Clauses in Vendor Contracts](https://www.pitch.law/academy/ai-clauses-in-vendor-contracts) [Which clauses to expect and negotiate when you buy or supply AI: AI Act allocation, data use, output ownership, IP indemnity, liability and change control.](https://www.pitch.law/academy/ai-clauses-in-vendor-contracts) - ### [AI in HR and Recruitment](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) [Which AI tools in recruitment and people management are prohibited or high-risk under the AI Act, what employers must do, and how national labour law and the GDPR add to it.](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) - ### [AI and Intellectual Property: Training Data, Copyright and Disclosure](https://www.pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) [How EU copyright law and the AI Act treat training data, rights holders' opt-outs, training summaries, and the protection of AI-generated output and inventions.](https://www.pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)