# AI Governance Framework — legal context bundle > Curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/topics/ai-governance-framework > Sources are cited per item. Verify against the official texts before relying on them. Compliance with AI Act requirements involves establishing a comprehensive governance framework covering organizational structures, policies, and procedures, which is distinct from individual compliance obligations. ## Overview ## Legal Framework The AI Act establishes its governance framework primarily through Recitals 148 and 173. Recital 148 outlines the foundational principle that the regulation requires a multi-level governance structure to coordinate application at the national level, build central Union-level expertise, and integrate stakeholders. This is operationalized through the establishment of the AI Office, whose mission is to develop and support this framework. Concurrently, Recital 173 establishes the adaptive nature of the governance framework by granting the European Commission delegated powers to amend key aspects of the Act, such as the list of high-risk AI systems and technical documentation requirements, ensuring the rules can evolve with the technology. ## Practical Application While the Recitals set the structural vision, the practical governance framework is implemented through the Act's operational articles and the authority of the AI Office. The framework is distinct from an individual provider's compliance obligations; it refers to the overarching regulatory and institutional ecosystem. This includes national competent authorities, the European Artificial Intelligence Board, and the Commission's enforcement mechanisms. The AI Office, as the central Union body, is tasked with building expertise, issuing guidance, and ensuring consistent application across Member States, thereby giving practical effect to the coordination mandate stated in Recital 148. ## Key Considerations * **Distinguish Governance from Compliance:** An organization's internal AI governance policies are a compliance obligation, but they operate within the broader external AI Act governance framework of authorities, boards, and EU-level coordination. * **Monitor for Regulatory Evolution:** Given the delegated powers in Recital 173, organizations must monitor amendments to delegated acts by the Commission, as changes to the high-risk list or technical standards can directly alter compliance requirements. * **Engage with the Multi-Level Structure:** Compliance may involve interaction with both national supervisory authorities and the EU-level structures (e.g., the AI Board for standards or the AI Office for guidance), understanding their respective roles within the coordinated framework. ## Legislation (full text of key provisions) ### Recital 148 — AI governance framework coordination structure *Source: AI Act, aiact-rec-148-en, 2024-06-12 — https://overview.legal/posts/93978* This Regulation should establish a governance framework that both allows to coordinate and support the application of this Regulation at national level, as well as build capabilities at Union level and integrate stakeholders in the field of AI. The effective implementation and enforcement of this Regulation require a governance framework that allows to coordinate and build up central expertise at Union level. The AI Office was established by Commission Decision (45) and has as its mission to develop Union expertise and capabilities in the field of AI and to contribute to the implementation of Union law on AI. Member States should facilitate the tasks of the AI Office with a view to support the development of Union expertise and capabilities at Union level and to strengthen the functioning of the digital single market. Furthermore, a Board composed of representatives of the Member States, a scientific panel to integrate the scientific community and an advisory forum to contribute stakeholder input to the implementation of this Regulation, at Union and national level, should be established. The development of Union expertise and capabilities should also include making use of existing resources and expertise, in particular through synergies with structures built up in the context of the Union level enforcement of other law and synergies with related initiatives at Union level, such as the EuroHPC Joint Undertaking and the AI testing and experimentation facilities under the Digital Europe Programme. ## Recent developments ### Data Protection Officer or Chief Privacy Officer?The rise of the Data Protection Officer *Source: White Label Consultancy, 2022-01-04 — https://overview.legal/posts/6311 — original: https://whitelabelconsultancy.com/2022/01/chief-privacy-officer-or-data-protection-officer/#entry-16* > Do we need an Chief Privacy Officer, a Data Protection Officer, or do we need both?In the following article, I will examine the benefits of both roles, but I will also look at some of the challenges related to each of the roles and why these have impelled both Data Protection Officers and organisations to question what the ideal setup is for them. ## Literature ### Health AI Governance, Medical Devices Health Data *Source: Open Science Framework, 2026-07-17 — https://overview.legal/posts/132112 — original: https://doi.org/10.17605/osf.io/kpxn7* This AGRIR-Lab component develops an interdisciplinary research programme on the governance, regulation, clinical safety, cybersecurity and ethical deployment of artificial intelligence in healthcare. It examines the EU Artificial Intelligence Act, the Medical Devices Regulation and In Vitro Diagnostic Medical Devices Regulation, the European Health Data Space, GDPR, NIS2, Medical Device Software, clinical and performance evaluation, health-data governance, anonymisation, predictive analytics, h ### From the EU AI Act to Audit Practice: A Governance-to-Controls Framework for Quality Management and Evidence *Source: Accounting and Auditing, 2026-07-15 — https://overview.legal/posts/132365 — original: https://doi.org/10.3390/accountaudit2030012* Artificial intelligence (AI) tools—including audit data analytics, robotic process automation, machine-learning models, and generative AI—are changing how audit teams identify risks, select procedures, and evaluate evidence. At the same time, Regulation (EU) 2024/1689 (the EU AI Act) establishes a risk-based governance architecture built around risk management, data governance, technical documentation, logging, transparency, human oversight, robustness, cybersecurity, and post-market monitoring. ### Italy’s Artificial Intelligence Act and Global AI Governance: The EU Model’s Practice and Prospects *Source: Law and Economy, 2026-02-25 — https://overview.legal/posts/132619 — original: https://doi.org/10.63593/le.2788-7049.2026.03.004* The Italian Artificial Intelligence Act, enacted on September 17, 2025, represents the first comprehensive national implementation of the European Union’s AI Act. This study examines the Italian legislation through the theoretical lens of multi-level governance, analyzing its dual function as both a “bridging legislation” that translates EU framework into domestic practice and a site of significant regulatory innovation. Through detailed textual analysis and case studies, particularly in healthc ### A Comparative Analysis of the EU AI Act and the Colorado AI Act: Regulatory Approaches to Artificial Intelligence Governance *Source: International Journal of Computer Applications, 2024-09-26 — https://overview.legal/posts/132613 — original: https://doi.org/10.5120/ijca2024923954* International Journal of Computer Applications (0975 – 8887) Volume 186 – No. 38 , September 2024 23 A Comparative Analysis of the EU AI Act and the Colorado AI Act: Regulatory Approaches to Artificial Intelligence Governance Mayur Jariwala School of Computer and Information Sciences, University of the Cumberlands, Williamsburg, KY, USA ABSTRACT This comparative study examines the EU AI Act and the Colorado AI Act, focusing on their regulatory approaches to artificial intelligence. The EU AI Act provides a comprehensive framework with a risk - based classification, emphasizing transparency, accountability, and the protection of fundamental rights across diverse sectors. It aims to set a global benchmark for AI governance, influencing international standards. The Colorado AI Act targets high - risk AI systems, prioritizing consumer protection, fairness, and the prevention of algorithmic discrimination. It mandates detailed documentation, ri sk management, and transparency measures to ensure ethical AI deployment. This analysis explores the impacts of each act on innovation, industry practices, and consumer protection, as well as their potential global influence. The findings highlig ### The EU Artificial Intelligence (AI) Act: An Introduction *Source: Global Privacy Law Review, 2024-03-01 — https://overview.legal/posts/132617 — original: https://doi.org/10.54648/gplr2024004* As part of its digital strategy, the European Commission proposed the world’s first-ever comprehensive legal framework on AI in April 2021. In December 2023, the Council and the Parliament reached a political agreement on the EU’s new Artificial Intelligence Act (AI Act). The AI Act follows a risk-based approach and aims to ensure that AI systems placed on or used in the EU market are safe and respect fundamental rights. The AI Act is expected to become a model for AI governance worldwide in a s ## Related topics - **Artificial Intelligence** — https://overview.legal/topics/ai AI systems and their implications for data protection - **Monitoring** — https://overview.legal/topics/monitoring Systematic observation and tracking of individuals - **Data Governance for AI** — https://overview.legal/topics/data-governance-ai The AI Act's section on 'Data and data governance' requires specific provisions for managing training data, validation data, and test data in AI systems. This c - **Human Oversight** — https://overview.legal/topics/human-oversight-ai This new topic is needed because human oversight is a specific and distinct requirement under the AI Act that deserves dedicated coverage, encompassing mechanis - **AI Value Chain Actors and Roles** — https://overview.legal/topics/ai-value-chain-actors The content focuses on responsibilities distributed across different actors in the AI value chain. A dedicated topic for understanding the various actors, their - **Accountability** — https://overview.legal/topics/accountability Principle of demonstrating GDPR compliance --- Generated by overview.legal · https://overview.legal/topics/ai-governance-framework · 2026-08-22