What AI governance covers

AI governance decides who may build and use AI, for what purpose, and with which controls and records. AI security protects AI systems from attack and misuse. A governance program includes security checks, but it is wider.

The four layers of tools

AI governance software is not one kind of product. Tools fall into four layers, and each layer does a different job.

• Governance platform: keeps the AI inventory, runs risk assessments, holds policy and approvals, and collects evidence. Typical output: an AI register, risk records and audit reports.
• Guardrails: screen the inputs and outputs of an AI system at run time. Typical output: blocked or redacted prompts and responses.
• Red teaming and evaluation: attack and test a system before and after release. Typical output: findings, scores and test reports.
• Monitoring and observability: watch models in production. Typical output: traces, drift alerts and performance metrics.

A governance platform does not stop a prompt injection. A guardrail does not prove compliance to an auditor. Most programs need more than one layer.

The AI inventory

An AI inventory is a register of every AI system an organization builds or uses. Each entry has an owner, a purpose and a risk tier. Include third-party AI and AI features inside the software you already buy, not only the models your team builds. You cannot govern a system that is not in the register.

Words you will meet

• Guardrail: a control that screens AI inputs or outputs at run time and blocks, edits or flags them.
• Red teaming: testing an AI system by attacking it, to find failures before others do.
• Evaluation: a repeatable test that scores model output against a standard.
• Observability: tracing and logging what an AI system does in production, including prompts, responses and tool calls.
• Drift: a change over time in input data or model behaviour that can lower quality.

Sources

• AIGovernanceTools buyer guide: How to choose an AI governance platform, updated 2026-10-29
• AIGovernanceTools buyer guide: AI governance glossary, updated 2026-10-29