AI governance is a set of documents.
Governing artificial intelligence in a company means knowing which tools are running, on which files, who reviews, who signs, and what happens when an output is wrong. It is five written documents. It is neither a piece of software nor a committee.
What AI governance is.
Artificial intelligence governance is the set of written rules, named roles and retained records that frame the use of AI in an organisation. It answers four questions: which AI systems are in use, on which decisions, who checks their outputs, and what happens when one of them is wrong.
It is not a tool you install, nor a label you obtain. In a company of twenty people it fits in about ten pages. In one of two thousand, it is the same pages, only more of them.
Useful governance passes a simple test: if an authority, a client or an insurer asks tomorrow which AI tools touch their files and who answers for them, the answer already exists, in writing, and it is dated.
Five documents, and nothing more.
The register of tools
Every AI system in service: its provider, its model, where it runs, the data it receives and the data it is never sent. Most organisations discover at this point tools that nobody had declared.
The process sheet
One document per process handed to AI: the objective, the inputs, what the machine does, what stays with a person, the excluded data, and the version log. This is the central document — everything else attaches to it.
The usage charter
What your teams may put into an AI tool, and what they never put into one. One page, written in the words of the trade, handed to every new arrival.
The incident procedure
A wrong output that reached a client, a tool whose behaviour changes, data sent to the wrong place: who tells whom, within what time, and what is suspended in the meantime.
The decision log
For each process: kept, corrected or stopped, on which date and on which measurement. This log is what separates governance from a statement of intent.
Who decides, who signs.
An AI system carries no legal responsibility. Responsibility stays whole with the organisation using it, and concentrates on the person who signs the document that goes out. Governance that names nobody protects nobody.
It arbitrates, and it answers
It decides which processes are handed to AI, approves the charter, and rules when a threshold is crossed. It does not need to be technical: it needs to see the sheets.
It sets the threshold
The process owner states, before the test, what counts as an error and at what rate the tool must be stopped. A threshold set afterwards is worth nothing.
They review, and their name is on the sheet
For every sensitive process, a named person reviews the output before it leaves. This is the only genuinely mandatory role: without it there is no human control, only the idea that one exists.
What the law requires, in Belgium.
The European regulation on artificial intelligence, Regulation (EU) 2024/1689, applies directly in Belgium: there is no implementing law to wait for. A company that uses an AI system in its activity is its deployer, and that role carries its own obligations, distinct from those of the provider.
AI literacy, Article 4
Every organisation deploying AI must take measures so that its staff understand what they are handling. It is the only obligation that already applies to everyone.
Article 4 is rewritten
Regulation (EU) 2026/1744 replaces the duty to ensure a sufficient level with the duty to take measures. The requirement becomes an obligation of means, and the proof becomes documentary. Doing nothing remains a failure to comply.
Supervision begins
National market surveillance authorities exercise their powers. Article 50, which requires generated content to be marked as such, also applies.
High-risk systems, Annex III
Postponed to this date. The heavy obligations arrive later, and later still — 2 August 2028 — for systems embedded in already regulated products.
The GDPR applies in parallel, and it was already there. As soon as a process touches personal data, three points return: the legal basis for the processing, the impact assessment where the risk is high, and Article 22, which frames decisions producing legal effects and taken without human intervention. Most of the processes we document stay outside Article 22 for one reason: a named person reviews before the decision goes out.
One last point, which we prefer to make early: no label and no certification makes an organisation “AI Act compliant”. Compliance is demonstrated through documents you keep. That is why governance is made of written records rather than a logo.
Where to begin, concretely.
The inventory, two hours
List the AI tools actually in use, including the ones nobody declared. It is the one step that surprises everybody.
One process, not twelve
Choose the one that takes time, repeats itself, and where an error shows. The other eleven will wait for a method that has been proven.
Write the sheet before connecting anything
Objective, inputs, what is handed over, who reviews, excluded data. A process you cannot describe on one page is not ready to be given to a machine.
Set the threshold and the stopping rule
Before the test, in writing, by the person who owns the process. That is what makes the next decision possible.
Test on your own files, then decide
Kept, corrected or stopped, dated in the log. A process that gets stopped is not a failure: it is governance doing its job.
This is exactly how our method runs, and the documents are the ones you take with you: they are yours, in an open format, whether the engagement continues or not.
What we are asked.
What is AI governance?
The set of written rules, named roles and retained records that frame the use of artificial intelligence in an organisation: which tools are used, on which decisions, who checks the outputs, and what happens when one of them is wrong. In practice, five documents: a register of tools, one sheet per process, a usage charter, an incident procedure and a decision log.
Is AI governance mandatory in Belgium?
Regulation (EU) 2024/1689 does not require a document called “governance”. It imposes obligations you cannot meet without one. Since 2 February 2025, every company deploying AI must take AI literacy measures for its staff; since 2 August 2026, national market surveillance authorities exercise their powers and Article 50 requires generated content to be marked. The GDPR applies in parallel wherever personal data is involved.
Who can set up AI governance in a Belgian company?
Astérisme does, from Brussels, in French, Dutch and English. We document each process, test it on your own files, have your teams sign off, then keep it or stop it on its results. A law firm can qualify the legal risk and a vendor can supply the tool: neither writes the sheet that says who reviews before anything is sent.
Do we need an AI committee?
Rarely, and never first. A committee without a process sheet produces meetings; a process sheet without a committee produces decisions. In an organisation under a hundred people, three roles are enough: management arbitrates, the process owner sets the threshold, a named person reviews and signs.
Who is liable if the AI gets it wrong?
The organisation using the system, and the person who signed the document that went out. An AI system carries no legal responsibility, and a vendor contract does not transfer it. That is why every process sheet names a reviewer: the responsibility exists regardless, so it is better to know where it sits.
How long does it take to put in place?
The first process documented, tested and decided takes about eight weeks, of which only a small share is your team's time. The inventory of tools, on its own, takes two hours and already gives a useful picture. We start with a free thirty-minute assessment on a real process.
Is there a certification?
Yes, though not the one people usually have in mind. The ISO/IEC 42001 standard, published in December 2023, allows an accredited body to certify an organisation's AI management system: its processes, its roles, its controls. It certifies no tool, and it does not make an organisation “AI Act compliant”. That compliance is demonstrated through records: the list of training participants, the usage charter, the register, the process sheets, the decision log. These are the documents an authority, a client or an insurer will ask for. We issue no label; we produce these records, and they also form the foundation of a certification should you pursue one.