What Is AI Governance? NIST, ISO/IEC 42001, the EU AI Act and Thailand's ETDA Guidelines for Development Teams

Imagine a company where the marketing team uses AI to draft campaigns, the development team uses a coding assistant, customer service has just launched a chatbot, and someone in accounting has tried uploading customer files to a free AI tool to summarize a report. Everyone has good reasons. But if an executive asks, "What AI are we using right now? What data has already left the building? And who is responsible if an AI answer is wrong?", many organizations cannot answer on the spot.

That set of questions is what AI Governance is about. Today Superdev Academy looks at what it is, which frameworks with real source documents exist (NIST AI RMF, ISO/IEC 42001, the EU AI Act and the guidelines from Thailand's ETDA), and what an ordinary software team can do starting this week. This article is general educational knowledge and not legal advice; questions about binding obligations should go to a legal professional or the relevant authority directly.

What is AI Governance?

Put simply, AI Governance is the set of policies, roles and processes an organization defines so that using and building AI systems is responsible, can be audited afterward, and stays within a level of risk the organization can bear. It is not a piece of software, and it is not a document you write once and file away. It is ongoing work tied to how people actually work.

Think of a restaurant kitchen with rules for cleanliness, someone responsible for stock, and a log of refrigerator temperatures. None of that exists because the cook is distrusted. It exists so that when something goes wrong, you know where it went wrong and can fix it. AI Governance does the same job for an organization's AI systems.

Fun Fact: several of the frameworks below are not mandatory. NIST states on its official page that the AI RMF is intended for voluntary use, while a legal instrument such as the EU AI Act applies according to where an AI system is placed and how it is offered.

Framework 1: NIST AI RMF

NIST, the US National Institute of Standards and Technology, released the AI Risk Management Framework, AI RMF 1.0, on 26 January 2023 to help manage risks that AI poses to individuals, organizations and society. The official page says it is intended for voluntary use and that it is being revised as part of the White House AI Action Plan, so check NIST's site for the latest version before citing it in real work.

The core has four elements named on the official page: Govern, Map, Measure and Manage. Here is our short interpretation (ours, not text from the document). Govern is setting policy, roles and a culture of accountability. Map is understanding the context: what this AI system is used for, with whom, and what could happen. Measure is testing and measuring the risks you identified. Manage is deciding how to treat them, reduce their impact and keep monitoring.

NIST also published a companion document, the Generative AI Profile (NIST-AI-600-1), on 26 July 2024, for risks specific to generative AI. That is the place for development teams that use LLMs to keep reading.

Framework 2: ISO/IEC 42001

ISO/IEC 42001:2023 is the first international standard for an AI management system that can be certified. According to the standards catalogue pages we checked, it was published on 18 December 2023 and sets out requirements and guidance for establishing, implementing, maintaining and continually improving an AI management system within an organization. It applies to organizations of any size that provide or use AI-based products or services.

A note on sources: ISO's own page was not accessible while we researched (it returned 403), so the details above come from the summary pages of national standards bodies that distribute the standard. We did not read the clause-by-clause content ourselves, and the full document must be purchased. An organization considering certification should read the full ISO text or go through its national standards body.

The easiest way to see the difference between the two: NIST AI RMF is a framework you choose how to adopt, voluntarily. ISO/IEC 42001 is a management-system standard that an organization can have assessed by an outside body.

Framework 3: the EU AI Act

The EU AI Act is a European Union law, which sets it apart from the two frameworks above that are not directly binding. According to the European Commission's official page, it divides AI systems into four risk levels: unacceptable risk, which are banned practices; high risk, with strict obligations before market entry; transparency risk, with disclosure duties (the page's pyramid labels it limited risk); and minimal or no risk, with no specific rules.

The timeline from the same page: the Act entered into force on 1 August 2024. The prohibitions and AI literacy obligations applied from 2 February 2025. Governance rules and obligations for general-purpose AI (GPAI) models applied from 2 August 2025, and the Act became generally applicable, with exceptions, on 2 August 2026. For high-risk rules, the page says the AI Omnibus moved the deadlines: Annex III use cases to 2 December 2027, and AI embedded in regulated products under Annex I to 2 August 2028. The Omnibus entered into force on 27 July 2026.

Our limit: we cite only the sequence of dates and the risk-level structure that can be read on the official page. We did not read the obligations article by article, who falls in scope, or the penalties from the legal text itself, so we give no figures or summaries of them. Teams that may be in scope should consult a legal professional and read the official text.

And in Thailand?

In Thailand the body driving this is ETDA, the Electronic Transactions Development Agency. According to the OECD.AI Policy Navigator, the AI Governance Guideline for Executives was published in 2023 as a non-binding guideline that organizations follow voluntarily, and it accompanies Thailand's AI Ethics Guideline, first approved in 2021.

Reports we found also say ETDA and the Ministry of Digital Economy and Society issued a separate guideline on generative AI for organisations on 30 October 2024. That comes from a digital policy tracking database, which is a secondary source; we did not open the original document, and the news sources we found disagree on the Cabinet status of the guideline, so we do not summarize that status. Always check ETDA's website directly.

What can a development team start this week?

You do not need a company-wide policy before you begin. The checklist below is our team's proposal, loosely tied to the four parts of the NIST AI RMF; it does not come directly from the text of any document.

• Keep a register of the AI you use (Govern and Map): tool name, owner, which work it is used for, and what kind of data goes in, including tools staff use on their own without going through IT.

• Separate the risk level of each use (Map): an assistant that drafts internal emails and a system that helps decide something affecting customers should not get the same level of control.

• Define where a human must check before a result is used (Manage): for example AI-written code goes through code review, and customer-facing answers need approval where the risk is high.

• Set up tests and measurement (Measure): if you build a feature that calls an LLM, keep sample questions and pass criteria in the repository and rerun them when the model or the prompt changes.

• Keep logs you can audit later (Manage): record which model version received what input and produced what output, taking care not to store more personal data than necessary.

• Write a procedure for incidents (Manage): who can switch an AI feature off temporarily, who informs the people affected, and how the lessons are recorded after a fix.

If you are building an AI agent that can call tools on its own, guardrails deserve special attention. We have related articles such as building secure AI agent runtimes with sandboxes and Claude Skills vs. Prompts, which explains why high-impact work still needs permissions and human review. To see an agent in real code, try AI Agents and the ReAct Pattern with Go.

Caution: governance is not a certificate that AI will not fail

Two misunderstandings are common. The first is believing that following a framework means the system will not make mistakes. It will not. These frameworks help you see risk, assign owners and respond when something happens, but they do not make a model error-free. The second is thinking this is work only for legal or management. In reality, decisions about logging, testing, agent permissions and model choice are made in development teams every day. Governance that does not reach the code is only a document.

Summary: start by knowing what AI you are actually using

AI Governance is the set of policies, roles and processes that make an organization's use of AI responsible and auditable. NIST AI RMF gives a voluntary four-part framework of Govern, Map, Measure and Manage. ISO/IEC 42001 is a management-system standard you can be certified against. The EU AI Act is a law that sorts AI systems into risk levels and has a staged timeline. And Thailand's ETDA has voluntary guidelines for executives and for generative AI.

If you finish reading and still do not know where to begin, begin with one thing: open a new file and list which AI tools your team uses, who owns each, and what data goes into them. Within half an hour you will usually find at least one surprise, and that is where real governance starts.

🎯 Follow dev knowledge from Superdev Academy:

• 🔵 Facebook: Superdev Academy Thailand

• 🎬 YouTube: Superdev Academy Channel

• 📸 Instagram: @superdevacademy

• 🎬 TikTok: @superdevacademy