# What AI governance covers

Lesson 1 of [AI governance foundations for buyers](https://aigovernancetools.fyi/academy/ai-governance-foundations.md), 12 minutes.

AI governance decides who may build and use AI, for what purpose, and with which controls and records. AI security protects AI systems from attack and misuse. A governance program includes security checks, but it is wider.

## The four layers of tools

AI governance software is not one kind of product. Tools fall into four layers, and each layer does a different job.

- **Governance platform**: keeps the AI inventory, runs risk assessments, holds policy and approvals, and collects evidence. Typical output: an AI register, risk records and audit reports.
- **Guardrails**: screen the inputs and outputs of an AI system at run time. Typical output: blocked or redacted prompts and responses.
- **Red teaming and evaluation**: attack and test a system before and after release. Typical output: findings, scores and test reports.
- **Monitoring and observability**: watch models in production. Typical output: traces, drift alerts and performance metrics.

A governance platform does not stop a prompt injection. A guardrail does not prove compliance to an auditor. Most programs need more than one layer.

## The AI inventory

An AI inventory is a register of every AI system an organization builds or uses. Each entry has an owner, a purpose and a risk tier. Include third-party AI and AI features inside the software you already buy, not only the models your team builds. You cannot govern a system that is not in the register.

## Words you will meet

- **Guardrail**: a control that screens AI inputs or outputs at run time and blocks, edits or flags them.
- **Red teaming**: testing an AI system by attacking it, to find failures before others do.
- **Evaluation**: a repeatable test that scores model output against a standard.
- **Observability**: tracing and logging what an AI system does in production, including prompts, responses and tool calls.
- **Drift**: a change over time in input data or model behaviour that can lower quality.

## Sources

- AIGovernanceTools buyer guide: How to choose an AI governance platform, updated 2026-10-29
- AIGovernanceTools buyer guide: AI governance glossary, updated 2026-10-29

Also on the [web page](https://aigovernancetools.fyi/academy/ai-governance-foundations/what-ai-governance-covers).