Oxygenn Resource
EU AI Act & ISO 42001: Practical Governance
AI governance is becoming an operational discipline. Organizations need more than policies: they need a defensible view of systems, owners, data flows, risks, approvals and technical access.
AI inventory
Capture systems, models/providers, purpose, business owner, technical owner, user groups, data categories, integrations and possible actions.
Risk classification
Assess impact, data sensitivity, decision autonomy, affected people, human oversight and third-party dependency.
Controls
Use identity controls, least privilege, data classification, logging, change management, model/vendor monitoring and clear approval workflows.
Evidence
Document training, assessments, approvals, technical configuration, exceptions and meaningful changes so decisions remain traceable.
Primary sources