Organizational AI Governance
The AI Governance Framework consists of the Hourglass Model, which provides the overall structure of organizational AI governance, and the AI Governance Task List, which breaks that structure down into concrete governance tasks. The framework has been developed and evaluated with practitioners over several years and is used by organizations in finance, the public sector, and IT services.
2026 edition
The Hourglass Model’s structure remains unchanged. Focus area F Transparency and explainability has been renamed to match the task list.
The Task List has been revised for generative AI and developments in the EU AI Act:
- - generative AI and general-purpose model risks
- - vendor and sourcing governance
- - the provider and deployer roles
- - human oversight and AI competence
- - explainability and contestability grounded in what stakeholders need.
Citation: Mäntymäki, M., Minkkinen, M., Birkstedt, T., & Viljanen, M. (2022). Putting AI Ethics into Practice: The Hourglass Model of Organizational AI Governance (arXiv:2206.00335). arXiv. https://doi.org/10.48550/arXiv.2206.00335
The Hourglass Model (v3) consists of seven designated
focus areas (A–G) and related tasks.
Scroll down or click the buttons below to view the focus areas and tasks.
A. Accountability and ownership. Putting in place the decision rights and responsibilities to govern AI systems and models, including an organization-wide AI system registry, human oversight, AI competence, and the integration of AI sourcing and operations with organizational governance.
- Tasks within focus area A:
- A1. Organization-level accountability
- A2. AI system-level accountability
- A3. AI system registry
- A4. Human oversight
- A5. AI competence and training
- A6. AI sourcing, operations, and governance integration
B. AI system. Documentation, performance metrics, and approval processes for AI systems. Maintaining AI system documentation providing a complete view of the organizations’ AI systems and models. Governing AI system vendors including vendor oversight and contractual relationships.
- Tasks within focus area B:
- B1. AI system registration and AI ID
- B2. AI system version control
- B3. AI system sourcing and vendor governance
- B4. AI system planning, scoping, and architecture
- B5. AI system metrics
- B6. AI system verification and validation
- B7. AI system approval
- B8. AI system performance monitoring
- B9. Periodic AI system review
C. AI model. Documentation, performance metrics, and approval processes for AI models. Maintaining documentation on the AI models used by the organization.
- Tasks within focus area C:
- C1. Model inventory and documentation
- C2. Model version control
- C3. Model planning and scoping
- C4. Model metrics
- C5. Model verification and validation
- C6. Model approval
- C7. Model performance monitoring
- C8. Periodic model review
D. AI data. Data quality management, data sourcing, performance metrics and control points. Ensuring copyright, intellectual property, and privacy issues related to AI data are handled.
- Tasks within focus area D:
- D1. Data source documentation
- D2. Data copyright, intellectual property, and permissions
- D3. Data quality metrics
- D4. Data ontologies, inferences, proxies, and metadata
- D5. Data quality assurance
- D6. Data quality monitoring
- D7. Periodic data review
E. Risk and impact management. Identifying, managing, and monitoring potential risks and impacts caused by the AI system. Risks may be related to, e.g., discrimination, misleading content produced by generative AI systems, violations of fundamental rights, safety issues, and foreseeable misuse of AI systems.
- Tasks within focus area E:
- E1. AI system harms and impacts pre-assessment
- E2. Model and GPAI risk assessment
- E3. AI system impact metrics design
- E4. AI system impact assessment
- E5. AI system bias and non-discrimination assurance
- E6. AI system negative impact minimization
- E7. AI system impact monitoring
- E8. Periodic AI system impact review
F. Transparency and explainability. Ensuring AI systems’ transparency and explainability. Fulfilling requirements coming from regulation and stakeholders. Ensuring vendor transparency regarding AI products and the use of AI in products and services.
- Tasks within focus area F:
- F1. Transparency and explainability expectation assessment
- F2. Transparency and explainability design
- F3. Transparency and explainability validation and assurance
- F4. Transparency and explainability monitoring
- F5. Periodic transparency and explainability review
G. Regulatory compliance. Understanding the regulatory environment of an AI system and ensuring its compliance with the relevant regulations (in the EU for example the GDPR, AI Act, national regulations, sector-specific regulations).
- Tasks within focus area G:
- G1. Regulatory environment assessment
- G2. Regulatory risks, constraints, and design parameter analysis
- G3. Regulatory design consultation
- G4. Compliance assessment, including vendor compliance verification
- G5. Compliance monitoring
- G6. Periodic compliance review