What Is AI Governance? A Guide to Building an Organizational Framework Aligned with the AI Promotion Act and Guidelines

"We want people to use AI proactively. But I am afraid confidential information will leak, or that someone will take a flawed output at face value and cause an incident." From information systems, corporate planning, and legal teams, requests for help with this exact dilemma have genuinely multiplied. Clamp down too hard and the front line stops using AI; loosen up too much and the seeds of a serious incident remain. And when it comes time to explain the necessity or the return on investment to leadership, people cannot figure out where to even begin. We hear this all the time.

What makes the situation harder is that the environment around the rules has shifted. In 2025, Japan's first AI-related law, the AI Promotion Act, came into force, and AI governance moved from being "an effort that is nice to make" to "a domain to confront squarely, socially and legally." Look abroad and the EU AI Act is expanding its application in stages, with extraterritorial reach that touches Japanese companies too.

This article organizes the full picture of the AI governance a company should have in place as of 2026 -- from the legal frameworks at home and abroad, to a policy template, the steps for building a framework, and incident response. The goal is that by the time you finish reading, what your organization should do next is concretely in view.

What you will learn in this article

• What AI governance means, and why putting it in place has become urgent in 2026
• How the rules in Japan and around the world changed between 2024 and 2026
• The five categories of AI risk companies must address, plus the often-overlooked problem of shadow AI
• Where the AI Business Guidelines, the AI Promotion Act, the EU AI Act, and international standards sit, and how they affect companies
• A ready-to-use AI usage policy template, and a four-step approach to building your framework
• Incident response procedures, and the "traffic light" method for containing risk without stopping adoption
• A maturity checklist for locating where your organization stands, and answers to frequently asked questions

What is AI governance (and why is it urgent in 2026)?

AI governance is the umbrella term for the rules and the structure that let an organization keep using AI safely and effectively. Which data may go into which AI, how outputs get checked, and who does what when something goes wrong. It refers to the whole mechanism of deciding these judgment criteria in advance and revising them as you operate.

The phrase may sound like a large-enterprise concern, but the reality is the opposite. Generative AI is no longer a special tool; it has dissolved into everyday tasks like drafting documents and looking things up, becoming an ordinary instrument. Japan's Ministry of Internal Affairs and Communications, in its "Information and Communications White Paper (Reiwa 7 edition)," shows that corporate use of generative AI keeps widening year over year and that more companies are putting usage policies and rules in place, even as individual use in Japan still lags the United States and China. The more people use it, the more risk accumulates from a state where everything is left to each person's judgment with no rules.

The biggest reason this became urgent is that the environment moved from "a domain of effort" to "a domain with a legal framework." With the AI Promotion Act enforced in 2025, the nation's posture of working on both the promotion and the trustworthiness of AI took the form of law. It is not a penalty-centered regulation, but the mood in which a company could get by with "we had not put rules in place" is gone. Personally, I feel that over the past few years AI governance has been elevated from "back-office work for the IT department" to "a theme for which management bears accountability."

From 2024 to 2026: how the AI governance landscape changed

In just two years, the premises behind the rules moved substantially. If you are frozen in the mindset of 2024, your design will drift out of step with reality. Start by grasping the overall shape of the change.

Aspect	2024 (then)	2026 (now)
Domestic legal standing	The AI Business Guidelines (no legal binding force) served as the effective standard	The AI Promotion Act was enacted and fully enforced (Japan's first AI-related law). The guidelines updated to version 1.1
Promotion structure	The expert-led "AI Strategy Council"	A newly established "AI Strategy Headquarters" of all cabinet ministers (chaired by the Prime Minister) formulating the AI Basic Plan
International regulation	The EU AI Act was still in deliberation and enactment	The EU AI Act took effect. Prohibited practices (2 February 2025) and general-purpose AI obligations (2 August 2025) already apply; the transparency obligations (Art. 50) and others start on the general date of application, 2 August 2026, while high-risk obligations start on 2 December 2027 for Annex III and 2 August 2028 for Annex I
International standards	ISO/IEC 42001 had just been published	ISO/IEC 42001 certification is spreading into a diffusion phase among Japanese companies too
Corporate situation	Generative AI adoption was led mostly by a few front-runners	Company-wide use has become the norm. Countering unmanaged use (shadow AI) is a new challenge

The point is that Japan advanced from the "soft law" of a single guideline to a stage where it now has a law, the AI Promotion Act, and that international rules have begun to affect the daily operations of Japanese companies. Your governance design needs to be rebuilt on the premise of this new position.

The five categories of AI risk, and shadow AI

Before you write rules, putting into words what you want to prevent keeps the later design from wobbling. The AI risks companies face sort broadly into five.

• Data leakage. The risk of entering confidential data or personal information into AI and having it flow out externally or be used for training. It is the most frequent category and the first that practitioners should guard against.
• Copyright infringement. The risk that generated output resembles someone else's copyrighted work and draws an infringement claim. It arises easily when generating marketing material or code.
• Hallucination. The risk that AI plausibly generates information that is factually wrong, and that a decision goes astray because someone takes it at face value.
• Bias and discrimination. The risk that skews in the training data produce unfair outcomes in decisions such as hiring or credit.
• Legal liability. The risk that, when an AI-assisted decision causes harm, who bears responsibility becomes ambiguous.

Alongside these, the one that troubles the most people right now is "shadow AI." It refers to the state in which, while the company is either banning or turning a blind eye to AI, employees are quietly using free AI on personal accounts for work. The trouble is that you cannot control what you cannot see. Ironically, a ban-everything policy is the single greatest cause of shadow AI. A prohibition meant to eliminate risk ends up multiplying the risk you cannot see.

Sorting out the standards to follow in Japan and abroad

The standards a company should reference in 2026 split into four layers: domestic guidance, domestic law, and international regulation and standards. What matters is not to mix up their binding force and their scope.

The AI Business Guidelines (METI and MIC)

For handling AI, the guidance closest to practice right now is the AI Business Guidelines. Version 1.0 was published on April 19, 2024; version 1.01, with minor corrections, followed on November 22, 2024; and version 1.1, with content updates, on March 28, 2025. They were created by consolidating three documents that had existed separately -- the AI Development Guidelines, the AI Utilization Guidelines, and the Governance Guidelines for Implementing AI Principles -- and knowing this background makes the whole picture easier to grasp. They are expected to be revised further in step with the AI Promotion Act and the AI Basic Plan, so check the latest version when you operate against them.

The guidelines divide the parties involved with AI into three positions and set out the responsibilities of each.

Position	Description	Main responsibilities
AI developer	A business that develops AI models	Ensuring safety, appropriate management of training data
AI provider	A business that provides AI services	Appropriate information disclosure to users, explanation of risks
AI user	A business that uses AI in its operations	Establishing appropriate usage rules, human oversight

Most ordinary companies fall under "AI user." What is required is putting usage rules in place and having a mechanism for humans to check and oversee AI outputs. There is no legal binding force, but because business partners and regulators treat them as a de facto standard, it is realistic to handle them as an effective standard.

The AI Promotion Act (enforced 2025) and its impact

Its formal name is the "Act on the Promotion of Research, Development, and Utilization of Artificial Intelligence-Related Technologies." It was enacted on May 28, 2025, promulgated and partially enforced on June 4, and fully enforced on September 1. It is Japan's first law concerning AI. It newly establishes an AI Strategy Headquarters composed of all cabinet ministers, chaired by the Prime Minister, and formulates a national AI Basic Plan.

What companies should note is that this law is not a regulatory type that binds through penalties, but a risk-based framework centered on promotion. That said, for serious cases that markedly infringe citizens' rights or interests, the state is granted authority to investigate and advise developers. The absence of penalties does not mean you may leave things alone. Existing laws such as the Act on the Protection of Personal Information and the Copyright Act apply as a matter of course, and in terms of social trust as well, now that a law exists, we have entered a stage where a commensurate level of preparation is expected.

The EU AI Act (watch for extraterritorial reach)

The EU AI Act (Regulation (EU) 2024/1689) is a "risk-based" set of rules that varies the strength of regulation according to AI's risk, and it took effect in 2024. It does not all switch on at once; different blocks of provisions carry different dates. The prohibited practices (Art. 5) and the AI literacy provision (Art. 4) have applied since 2 February 2025. The obligations for general-purpose AI (GPAI) models, the governance chapter, and the penalties provisions (Art. 99 and Art. 100) have applied since 2 August 2025.

2 August 2026 is then the general date of application. From that date, the transparency obligations (Art. 50), the provisions on harmonised standards, conformity assessment, CE marking, and registration (Art. 40 to Art. 49), and the European Commission's power to impose fines on providers of general-purpose AI models (Art. 101) apply.

The easy mistake here is to read 2 August 2026 as the date on which high-risk AI becomes fully regulated. It is not. Under the amending Regulation (EU) 2026/1744 -- the "Digital Omnibus," adopted on 8 July 2026, published in the Official Journal on 24 July 2026, and in force since 27 July 2026 -- the substantive high-risk obligations were pushed back. The requirements in Chapter III, Sections 1 to 3 apply to Annex III high-risk systems (Art. 6(2)) from 2 December 2027, and to Annex I product-embedded high-risk systems (Art. 6(1)) from 2 August 2028. The authorised representative obligation (Art. 22), the value chain obligations (Art. 25), the deployer obligations (Art. 26), and the fundamental rights impact assessment (Art. 27) switch on at those same dates.

Separately, the newly added prohibitions -- non-consensual sexual deepfakes under Art. 5(1)(ba) and the generation of child sexual abuse material under Art. 5(1)(bb), among others -- apply from 2 December 2026. The newly added Art. 111(4) also requires providers of synthetic-content-generating AI placed on the market before 2 August 2026 to bring those systems into line with Art. 50(2) by 2 December 2026. For existing high-risk systems, the transitional rule in Art. 111(2) brings them into scope only where significant changes are made to their designs after the Chapter III application dates, so the reference point moves with 2 December 2027 and 2 August 2028.

On penalties, breaches of the prohibited practices (Art. 5) carry fines of up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher; other breaches, including those relating to general-purpose AI, carry up to EUR 15 million or 3% of worldwide turnover, whichever is higher. Which category your use falls into determines both the deadline you are working to and the level of preparation required.

The reason this is not someone else's problem for Japanese companies is its extraterritorial reach. If you supply an AI system to the EU market or use AI output within the EU, you can fall under the regulation even without a base in the EU. Companies with any trading or business touchpoint with the EU can rest easier by confirming early which risk category their use falls into.

International standards: ISO/IEC 42001 and NIST AI RMF

As an anchor for building a framework, international standards are drawing more attention. ISO/IEC 42001, published in December 2023, is a certification standard for an AI management system (AIMS) that lets an organization demonstrate, through third-party certification, that it has a mechanism to manage AI. From 2025 onward, moves to obtain certification have spread among Japanese companies too. Alongside it, the U.S. NIST AI RMF (AI Risk Management Framework) is also referenced as a practical framework for handling risk systematically. Even for companies not aiming at certification, the concepts these present -- govern, map, measure, and manage -- are useful as the skeleton of your own governance design.

How to write an AI usage policy (template)

From here it is practical. Below is a template for writing your organization's AI usage policy. Select and adapt the items according to your company's size. Each item carries a one-line note on "why it is needed," so you can also use it as material for internal explanation.

1. Purpose and scope (state at the outset what the rules are for)

• The purpose of this policy (to encourage safe and effective use of AI)
• Who it applies to (regular employees only, or also temporary staff and contractors)
• Which services it covers (both internal AI and external AI services)

2. Approved services (whitelist) (prevent a disorderly proliferation of tools)

Type of service	Main uses	Data input restrictions	Approval level
Corporate generative AI (Team/Enterprise editions, etc.)	Document creation, research, analysis	No confidential information	Department head approval
AI assistant integrated into Office	Assistance with Office documents	Internal data permitted	Not required (deployed company-wide)
Enterprise AI (domestic-data-center type, ZEROCK and similar)	Analysis of internal documents, processing of drawings and technical documents, work support	Internal data permitted (stored domestically)	Deployed company-wide
Image generation AI	Creation of marketing material	Copyright verification required	Department head approval

Enterprise AI that stores data on domestic servers -- like ZEROCK, which uses GraphRAG to handle internal documents -- is an option that is easy to place on the whitelist for work involving highly confidential information. Spelling out the use and the storage location lets the front line make decisions without hesitation.

3. Data classification and input restrictions (draw the line on which data may go in, and how far)

Data classification	Definition	Input to external AI	Input to internal AI
Public information	Information posted on websites, etc.	Permitted	Permitted
Internal information	Internal notices, meeting minutes, etc.	Conditionally permitted	Permitted
Confidential information	Business strategy, cost data, etc.	Prohibited	Permitted (with access controls)
Personal data	Personal information of customers and employees	Prohibited	Conditionally permitted
Information under confidentiality obligation	Information covered by contractual confidentiality	Prohibited	Case-by-case judgment

4. Output quality management rules (prepare for hallucination and lines of responsibility)

• AI outputs must always be checked by a human before being used in work
• For documents submitted externally, keep a record noting that AI was used
• Numerical data and legal judgments must always be verified against original sources

5. Incident reporting flow (do not hide incidents; stop them quickly)

• Suspected data leaks are reported within 24 hours
• Make the reporting order clear (information security officer, manager, executive leadership)

Four steps to build an AI governance framework

A policy is not finished the moment you write it. It works only as a set with the structure that operates it. Let us build it up stage by stage.

Step 1: Establish a promotion structure

AI governance is not the problem of a single department. Place a leader directly under executive leadership and involve related departments across the organization. What is workable depends on company size.

Company size	Structure	Meeting frequency	Main activities
Under 30	President + head of administration	Quarterly	Draft and communicate a one-page set of usage rules
30-100	Managers + IT lead + legal (including external counsel)	Bimonthly	Policy development, tool vetting
100-300	Add an AI agenda to the existing security committee	Monthly	Usage review, risk assessment
300+	Formally establish an AI governance committee	Monthly	Policy operations, training, auditing

You do not need to stand up a brand-new organization out of nowhere. Start by adding an AI agenda to your existing compliance or security committee, and once operations are running, grow it into a standalone committee. It is a realistic approach that secures effectiveness while holding down additional headcount.

Step 2: Draft a usage policy

Using the earlier template as a base, customize it to your situation. The points that require the most care differ by industry.

Industry	Rules to prioritize	Rationale
Manufacturing	Restrictions on AI input of quality data and engineering drawings	High risk of leaking technical secrets
Services	Prohibition on entering customers' personal information into AI	Compliance with the Act on the Protection of Personal Information is essential
Construction/Real estate	Handling of bid and pricing information	Abundance of competitively sensitive information
Finance/Insurance	Oversight rules for AI use in credit and underwriting	Compliance with financial regulation is required
Professional services	Management of information tied to client confidentiality	Risk of breaching professional confidentiality obligations

The pitfall to watch here is the side effects of a too-strict policy. One service company adopted a "no AI use whatsoever" stance, but employees began using free tiers on personal accounts, sliding into a shadow AI state where control was, if anything, weaker. Three months later they revised it to "conditional permission" and shifted toward recommending use of the approved services. Usage rates rose and, if anything, risk fell. A ban looks like the strongest rule, but it is in fact the rule most easily broken.

Step 3: Put a risk assessment process in place

If a staff member judges by gut each time a new AI tool comes in, the criteria wobble. Prepare a checklist that standardizes the adoption decision.

Assessment item	What to verify	Low risk	Medium risk	High risk
Data storage location	Where the servers are	Domestic	Overseas (GDPR-compliant, etc.)	Unknown
Data used for training	Whether input data is used for training	No (explicitly stated)	Opt-out available	Yes (unavoidable)
Access control	User permission management	SSO/RBAC supported	Username/password	Shared accounts
Encryption	Encryption in transit and at rest	Latest standards supported	Common level	Unknown
Contract terms	SLA, data deletion provisions	Clear SLA and immediate deletion	SLA exists	No SLA
Vendor reliability	Company size, track record	Listed company/major firm	Proven track record	Startup/unknown

Keep the decision rule simple. If even one item is high risk, hold off on adoption and look for an alternative. If three or more are medium risk, adopt only on condition of additional safeguards. If everything is low risk, recommend adoption. One IT company distilled this assessment into a one-page "AI tool adoption request form." It is a simple process that does not add too much overhead, yet it prevents a disorderly proliferation of tools and leads to early detection of security risk.

Step 4: Monitor and improve

AI governance is not something you build once and are done with. Because both the technology and the law keep moving, keep it turning with an "agile governance" mindset.

Item	What to check	Frequency	Owner
Policy compliance	Review usage logs, count of violations	Monthly	IT department
Incidents	Whether any security incidents occurred	As needed (per occurrence)	Security officer
Tool inventory	Update the list of AI services in use	Quarterly	IT department
Policy revision	Response to changes in technology and regulation	Semi-annually	Governance committee
Employee awareness survey	Awareness of the rules, ease of use	Annually	HR department

It is not unusual for rules decided six months ago to no longer fit the current front line. External moves in particular -- revisions to the AI Promotion Act or the guidelines, and the application timelines of the EU AI Act -- are worth inventorying and reflecting at least twice a year. Regularly ask again whether "the rules have become a shackle on the front line," loosening where you can loosen and tightening where you should tighten. This adjustment is, I believe, the very substance of governance.

Incident response procedures (levels 1 to 3)

It is best if incidents never happen, but whether you have decided how to act when one does changes the scale of the damage. Organize it in three stages according to severity.

Level 1: minor incidents (e.g., accidental input of internal information, or internally sharing hallucinated misinformation)

1. The person who found it reports to their supervisor (same day)
2. The supervisor contacts the IT department
3. Request the AI service provider to delete the data in question
4. Consider prevention measures and issue an advisory

Level 2: moderate incidents (e.g., confidential information entered into AI, suspected copyright infringement)

1. The person who found it reports immediately to their supervisor and the security officer
2. Investigate the scope of impact (within 24 hours)
3. Report to executive leadership
4. Confirm whether there is any external impact
5. Develop prevention measures and communicate them company-wide

Level 3: critical incidents (e.g., leak of personal data, legal liability triggered)

1. The person who found it reports immediately to the security officer
2. Suspend AI use for the affected scope
3. Emergency report to executive leadership (within 2 hours)
4. Consult the legal department or external counsel
5. Report to the regulator as required
6. Investigate the cause and implement permanent countermeasures

Leaks of personal data in particular may trigger a reporting obligation under the Act on the Protection of Personal Information. Simulating the level 3 flow once in peacetime, including reporting to the regulator, keeps you from panicking when the moment comes.

The "traffic light" method for balancing governance and adoption

A trap you fall into easily when designing governance is making the rules so strict that no one uses AI. AI that goes unused is not only a failed investment; it also becomes a breeding ground for shadow AI. The principle for balancing the two is this.

• Give low-risk work more freedom. For internal document drafting and organizing information, loose rules are enough.
• Apply strict oversight to high-risk work. For official customer-facing documents and situations that affect decisions, make human review mandatory.
• Use conditional permission, not prohibition. Do not stop at "you must not enter confidential information"; show the path -- "you may use it with an AI service where security is assured."

What plays well on the front line is the "traffic light" method. One construction company sorted its rules into three colors: green (use freely -- drafting internal documents, summarizing minutes, and the like), yellow (supervisor confirmation required -- customer-facing documents, technical proposals, and so on), and red (prohibited -- entering bid information or personal data). Because the classification is simple, employees could judge without hesitation, and both usage rates and compliance improved. Rather than assembling 100 detailed provisions, three colors you can recall when in doubt work better in the field.

AI governance maturity checklist

Check which stage your organization is at now, by level. You do not have to tick every box. Starting from level 1 is the realistic move.

Level 1 (minimum)

• An AI usage policy has been documented
• The range of data that may be entered into AI is clearly defined
• A managed list of approved AI services is maintained

Level 2 (basic)

• There is a risk assessment process for adopting new AI tools
• Human review of AI outputs is built into the operational workflow
• There is a mechanism for reporting AI-related incidents

Level 3 (developing)

• Employee-facing AI usage guidelines have been communicated company-wide
• A schedule for periodic governance reviews is set
• An AI usage training program is being delivered

Level 4 (advanced)

• AI usage is monitored quantitatively
• Incident response drills are conducted
• Regulatory changes are watched regularly and reflected in policy

Rather than aiming for perfection and delaying adoption by six months, laying down minimum rules and improving as you operate ultimately brings risk down faster. Start from the first rung -- that is the iron rule.

Frequently asked questions

Q. Do small and mid-sized companies need AI governance too? Yes. If anything, smaller companies without a dedicated security function are more likely to leave the risk of confidential data being entered by mistake, or of shadow AI, up to each individual. You do not need a heavyweight committee like a large enterprise has. Even just a one-page set of usage rules, a clear line on what data may be entered, and a point of contact for questions will make a real difference in practice.

Q. Should the IT department or the legal team write the AI usage policy? Not one or the other. The basic approach is to involve both, plus the front line. It works well when the information systems department takes the lead, legal checks personal data protection and contractual matters, and each department brings how AI is actually used on the ground. Having executive leadership sponsor the effort and making lines of responsibility clear prevents drift in operation.

Q. Does the AI Promotion Act carry penalties? Is it illegal not to comply? The AI Promotion Act sets no direct penalties for companies. It is a promotion-oriented, risk-based law under which the state can investigate and advise on serious cases that infringe citizens' rights and interests. But the absence of penalties is a separate matter from being held responsible when you cause an incident. Existing laws such as the Act on the Protection of Personal Information and the Copyright Act apply as a matter of course.

Q. Is compliance with the AI Business Guidelines mandatory? There is no legal obligation to comply. They are voluntary codes of conduct issued by METI and MIC. That said, business partners and regulators reference them as a de facto standard, and if you are not following them you risk being judged, when an incident occurs, to have failed to take reasonable care. It is wise to treat them as an effective standard.

Q. Should we ban the free version of ChatGPT entirely? A blanket ban tends to backfire. Prohibition invites shadow AI, where employees quietly use personal accounts. Because free tiers may be configured to use input data for training, the realistic approach is conditional permission: prohibit entering confidential information, provide a corporate plan or a domestically hosted AI for business use, and steer people toward those.

Q. Should we obtain ISO/IEC 42001 certification? It is not essential for every company. When a business partner requires it, or when you put AI at the core of your business, it becomes a strong way to demonstrate the trustworthiness of your framework externally. Even if you are not aiming at certification, the management concepts 42001 presents are useful as the skeleton of your own governance design.

Q. If we use AI for the EU, do we fall under the EU AI Act? You can. The EU AI Act applies extraterritorially even to companies outside the EU when they supply an AI system to the EU market or use its output within the EU. The prohibited practices (Art. 5) have applied since 2 February 2025 and the general-purpose AI obligations since 2 August 2025; the transparency obligations (Art. 50) and others begin on the general date of application, 2 August 2026. High-risk obligations begin on 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. If your business touches the EU, you should confirm early which risk category your use falls into.

Q. How often should we review the AI usage policy? Once every six months is a good yardstick. Both the AI technology and the external environment -- revisions to the AI Promotion Act and the guidelines, the application timelines of the EU AI Act -- keep moving. On top of the regular review, set up an operation where you make an ad hoc revision when there is a major legal change or a serious incident.

Summary

• With company-wide AI use now the norm, putting governance in place has become a theme for which management bears accountability
• Cover the domestic standards with two pillars: the AI Business Guidelines (version 1.1) and the AI Promotion Act enforced in 2025
• The EU AI Act has extraterritorial reach: the transparency obligations (Art. 50) and others start on the general date of application, 2 August 2026, while high-risk obligations start on 2 December 2027 and 2 August 2028
• ISO/IEC 42001 and NIST AI RMF serve as anchors for building your framework
• Set your usage policy as a package of data classification, input restrictions, quality management, and incident reporting
• Standardize adoption decisions with a risk assessment sheet, and keep it turning with monitoring and revision
• Move from prohibition to conditional permission. A classification like the traffic light method, where people can judge without hesitation, works on the front line
• Do not wait for perfection; starting from level 1 ultimately brings risk down the fastest

Hands-on support for AI governance (TIMEWELL WARP)

Having read this far, many of you may feel, "I understand what needs to be done, but we do not have the bandwidth to do it on our own." Governance does not work simply by handing out a policy template. It works only when the AI literacy that lets employees genuinely make use of AI and the structure to keep operating it are both in place.

TIMEWELL's AI consulting and training service, "WARP," supports exactly this part, working alongside you. WARP BASIC starts from foundational training and building a usage-policy template; WARP NEXT builds a risk assessment process tailored to your operations; and WARP covers everything from guideline training to designing your monitoring structure and running incident response drills, putting your organization's AI use and governance in order in stages. Former senior DX and data strategy professionals walk with you all the way to implementation, so it does not end as rules on paper.

• If you first want to know where your organization stands, check your maturity with the AI Literacy Check.
• For details on our support and programs, see the WARP service page.
• If you would like to discuss building a concrete framework, feel free to reach out through a free WARP consultation.

---

Related articles:

• Building AI Literacy Across Your Organization -- Literacy education that makes governance effective
• Change Management for AI Adoption -- Balancing governance and adoption as part of organizational culture
• 10 Common AI Adoption Mistakes -- Failure patterns caused by governance gaps, and how to counter them
• Generative AI in Business -- Specific use cases that governance needs to cover

References (primary sources)

• Cabinet Office: AI Strategy (AI Strategy Council / AI Strategy Headquarters) -- Official government information on the AI Promotion Act, the AI Strategy Headquarters, and the AI Basic Plan
• METI: AI Business Guidelines -- Primary source for versions and revision dates (v1.0 / v1.01 / v1.1)
• MIC: Information and Communications White Paper -- Latest statistics on corporate and individual use of generative AI
• Personal Information Protection Commission -- Handling of personal data and reporting obligations in the event of a leak
• European Commission: AI Act (EU AI Act) -- Risk-based regulation, application schedule, and extraterritorial reach
• ISO/IEC 42001 (AI Management System) -- Overview of the AIMS certification standard
• NIST AI Risk Management Framework -- The U.S. AI risk management framework