Our board is asking about AI governance, SDAIA and ISO/IEC 42001 before it will approve AI projects

The situation

Business units want to run AI projects: a customer-service assistant, document automation, analytics with generative models, perhaps agents that act on systems. The board or the executive committee has started asking questions before approving the budget. Who is accountable for the AI? What does SDAIA expect of us? Should we pursue ISO/IEC 42001? What happens if the model gets something wrong with a customer’s data?

You need an answer that is credible to the board, workable for the teams and proportionate. You do not want to build a governance bureaucracy that stops every project, and you do not want to approve projects with no governance at all.

Why this is hard

• AI governance is spread across several sources: SDAIA’s AI Ethics Principles and related guidance, the PDPL for personal data, the NCA’s cybersecurity requirements and its developing AI cybersecurity guidance, sector regulators, and ISO/IEC 42001, the international standard for AI management systems.
• Boards ask for assurance, and most organizations cannot yet say which AI systems they have, what data those systems use and who owns them.
• AI risk is different from classic IT risk: model behavior, bias, data drift, hallucination, prompt injection and the actions an agent can take all need to be considered.
• ISO/IEC 42001 is new. Few organizations have implemented it, and it is easy to turn it into another binder.
• Governance that sits apart from the existing security and risk program becomes a silo nobody maintains.

What goes wrong when it is ignored

• Projects are approved on enthusiasm and later stopped when a regulator, a customer or an incident raises questions nobody can answer.
• Projects are blocked indefinitely because no one can define what “safe enough” means, and the organization falls behind.
• Personal data is processed by AI in ways the PDPL would not permit.
• A public failure of an AI system is traced back to the absence of ownership, testing and oversight.

How I approach it

1. Build the AI inventory. Every AI system in use or proposed, including embedded AI in purchased software and the external services staff already use, with the data it touches, its owner and its business purpose.
2. Classify risk proportionately. Each use case is placed in a risk tier based on data sensitivity, decision impact, autonomy and exposure to customers or the public. High-tier systems get more oversight; low-tier systems get a light path to approval.
3. Map the requirements you actually face. SDAIA principles and applicable guidance, PDPL obligations, NCA cybersecurity requirements, sector rules and ISO/IEC 42001 clauses, mapped once into a single set of controls so teams see one list, not five.
4. Extend what you already have. If you run an ISO/IEC 27001 ISMS or an NCA program, AI governance is added to it: AI risk in the risk register, AI policies alongside security policies, AI incidents in incident management. ISO/IEC 42001 is designed to work this way.
5. Define the approval path. A short, staged process: intake, risk tiering, security and privacy review, human-oversight and monitoring requirements, approval with conditions, and periodic review. Clear enough for the board, fast enough for the teams.
6. Report to the board in their language. A governance summary showing the inventory, the risk tiers, the controls in place, the open items and the decisions needed from them.

My work here is readiness, assessment and architecture. SDAIA accreditation and ISO/IEC 42001 certification decisions rest with the respective authorities and accredited bodies.

What you receive

• An AI inventory and risk-tier classification.
• A requirements map covering SDAIA, PDPL, NCA and ISO/IEC 42001 as they apply to you.
• An AI governance framework integrated with your existing security and risk program.
• An AI project approval path with templates for intake, risk assessment and review.
• A board-level governance summary and a prioritized roadmap toward ISO/IEC 42001 readiness, if you choose to pursue it.

Where to start

Book a free 30-minute Architecture Decision Review at /free-architecture-review/ with the list of AI projects waiting for approval. I will tell you what the board is likely to ask next and what the minimum credible governance looks like for your situation. Or describe the position through the contact form.