Useful AI governance comes down to a few clear decisions: who approves a new tool, where systems are listed, who supervises their results and how problems are handled. KIND helps you set it up at the scale of your organisation.
AI tools enter the company through teams, software vendors and suppliers. Without a common framework, management does not always know which uses exist, which data is processed and who answers when difficulties arise. Governance gives management, the DPO, IT and business teams a shared basis to decide quickly and to prove what was decided.
A named AI lead, management decisions, the role of the DPO, IT and business teams. Who decides, who checks, who is informed.
A living list of AI systems, their purposes, vendors and data. The starting point for any AI Act and GDPR work.
A short, readable charter: authorised tools, data that must never go into external tools, human review rules.
A simple procedure before any new use: purpose, data, hosting, subcontractors, contract, risk level.
The cases where a person must review, validate or be able to challenge a result, and how they are trained to do so.
Indicators, periodic review, incident handling, register updates. This is what keeps compliance from going stale.
Governance can draw on ISO/IEC 42001 (AI management system) and on guidelines published by authorities. It fits with the obligations of the AI Act and with GDPR applied to AI. The aim is not to pile up documents, but to keep the mechanisms your teams can actually sustain.
It is the set of rules, roles and tools that lets an organisation decide which AI systems it uses, under what conditions, under whose responsibility, and how it follows their effects over time.
Not necessarily. In an SME, a designated AI lead, an up-to-date register and a simple rule for approving new tools are often enough to get started. The structure grows with the number and risk level of uses.
Governance is what allows AI Act and GDPR obligations to be met over time: system register, human oversight, information to individuals, control of vendors. Without it, compliance remains a one-off snapshot.
This standard describes an AI management system and can serve as a reference framework. It is not mandatory and does not replace the AI Act. KIND can draw on it to structure your governance without making it a prerequisite.
KIND starts from the mapping of your uses, proposes a governance framework proportionate to your size, then provides follow-up with KIND Compliance. Experts from KIND's network also check how systems behave.
A first conversation lets us frame your scope and propose a framework suited to your size.