Beyond Compliance: Building an AI Operating Model Using Global Governance Frameworks

The Foundations of Modern AI Governance

Many of today’s AI governance frameworks can trace their origins to the Organization for Economic Co-operation and Development (OECD) AI Principles, first adopted in 2019 and updated in 2024.

Widely regarded as the first internationally recognized AI governance framework, the OECD AI Principles established core concepts that continue to shape global AI governance, including transparency, accountability, robustness, human oversight, security and respect for democratic values and human rights.

The influence of these principles extends beyond policy discussions. They have informed legislation, standards and regulatory guidance across the EU, national governments including the U.S., and the UN. As a result, many seemingly distinct AI regulations and frameworks share a common vocabulary and philosophy.

Similarly, the United Nations Educational, Scientific and Cultural Organization (UNESCO) Recommendation on the Ethics of Artificial Intelligence, unanimously adopted by all 194 UNESCO Member States in 2021, introduced a broader human rights-based perspective to AI governance.

The recommendation emphasizes fairness, accountability, transparency, privacy, environmental sustainability and meaningful human oversight while recognizing that governance frameworks must remain adaptable as technology evolves.

This balance between enabling innovation and managing risk remains at the heart of effective AI governance today.

Building One AI Operating Model for Many Jurisdictions

Maintaining separate AI governance programs for every region, business unit or technology implementation is neither practical nor sustainable. Instead, organizations should build a unified AI operating model grounded in internationally recognized principles and supported by established governance and risk management frameworks.

A well-designed operating model enables organizations to create consistency across AI initiatives while retaining the flexibility to address changing regulatory, technological and business demands.

An integrated approach may combine:

• The OECD AI Principles and UNESCO recommendation to define ethical objectives and governance principles
• ISO/IEC 42001 to establish an auditable artificial intelligence management system (AIMS)
• The National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework (AI RMF) to identify, assess and manage AI-related risk
• The UK Government AI Risk Management Toolkit to operationalize risk management activities across the AI life cycle

Organizations operating in jurisdictions with limited AI-specific regulation can use the EU AI Act as a valuable reference for understanding potential future regulatory expectations while considering existing privacy, consumer protection, employment law and sector-specific regulation obligations.

The objective should not be to comply with a single framework. It should be to establish a flexible governance ecosystem tailored to the individual organization and capable of adapting as regulations, technologies, AI use cases and stakeholder expectations evolve. To elaborate, an organization using AI to assist its customers may require a heavier focus on customer privacy, whereas an organization using AI for internal development may focus more on data governance and the protection of intellectual property. Optimizing multiple framework components lets you fine-tune your governance approach to fit your operations.

How Kroll Helps Organizations Develop AI Operating Models

Kroll helps organizations understand, govern, assess and operationalize AI at scale.

Our multidisciplinary teams combine expertise in cyber security, risk management, operational resilience, regulatory compliance, investigations and board advisory services to help organizations move from experimentation to controlled, defensible and scalable AI adoption.

We help clients:

• Design and implement AI governance operating models.
• Assess AI risk, regulatory exposure and governance maturity.
• Develop board-level reporting and executive oversight mechanisms.
• Conduct AI-focused red teaming and adversarial testing exercises.
• Evaluate AI-enabled cyber threats and operational risks.
• Translate complex AI risks into actionable business decisions.
• Establish AIMS aligned to ISO/IEC 42001 and ready for certification.

As organizations move from isolated AI initiatives to enterprise-wide adoption, the ability to govern AI effectively will increasingly become a differentiator. The question is no longer whether organizations will adopt AI. It is whether they can do so in a way that is trusted, resilient and sustainable.

To discuss how your organization can assess, strengthen and scale its AI governance and risk management capabilities, contact Kroll's Cyber and Risk Advisory professionals.