Key takeaways
- Governance is organisational: policies, owners and controls, not a single product feature.
- Frameworks such as the NIST AI RMF give a structure; the EU AI Act sorts uses by risk.
- An audit trail records what an AI system did, on what input and with whose approval.
- An approval step is a control, not a compliance certification.
What an AI governance framework covers
An AI governance framework covers the whole life of an AI tool in an organisation, from choosing it to retiring it. It names who owns each decision and what evidence they need.
- An inventory of the AI tools in use and what each is for.
- Permitted and forbidden uses, written in plain words.
- Which data each tool may read, store or send elsewhere.
- Which actions need a person's approval before they run.
- How output is reviewed, logged and corrected.
- Who handles an incident, and how users report one.
The NIST AI RMF and the EU AI Act
The NIST AI Risk Management Framework is a voluntary US framework built around four functions: Govern, Map, Measure and Manage. Govern sets the culture, roles and policies; Map sets out the context and risks of a use; Measure assesses those risks; Manage decides and acts on them.
The EU AI Act is legislation that sorts AI uses into risk tiers, with stricter obligations for higher-risk uses and a short list of banned ones. Whether and how it applies depends on the use and the organisation, so a team should take its own legal advice rather than rely on a vendor's description.
AI auditability and the audit trail
AI auditability is the ability to reconstruct what an AI system did and why, after the fact. It rests on an audit trail: a record of the input, the output, the action taken, the time and the person who approved it.
Auditability connects governance to explainable AI. A log shows what happened; an explanation or a cited source shows why. Together they let a team answer a customer's complaint, fix a recurring error or show a regulator how a decision was made.
Responsible AI, guardrails and governance
Responsible AI is the set of principles, such as fairness, transparency, privacy and accountability; governance is the machinery that puts those principles into practice. A principle with no owner, policy or check behind it changes little.
Guardrails are the technical limits inside a tool, such as blocked actions or required approvals. They are one kind of control a governance framework can require, alongside training, review and vendor checks.
AI governance for a sales team, as an example
For a sales team, AI governance is a short set of rules for AI-assisted outreach. In an illustrative policy, the assistant may use CRM records and the company's own positioning but not personal data bought from unknown sources; any message to a new prospect needs a rep's sign-off; and an opt-out is honoured everywhere the moment it arrives.
The same policy names an owner, usually in revenue operations, who reviews the rules each quarter, checks a sample of sent messages and decides whether a new tool may join the stack. The rules are only as strong as their review.
Where Pebbles Ai fits
- CapabilityAI workspaceExecution modes decide what the assistants may do. In Manual, actions that reach the outside world wait for approval; in Plan they are queued; in Auto they run without asking, except template send and calendar delete, which ask in every execution mode.
- FoundationAgent memoryAgent memory sits under Tenant-Isolated AI: each business works in its own secured tenant, no data crosses between tenants and no customer's data trains a model. Details are on the trust page.
Common questions
What are the four functions of the NIST AI RMF?
Govern, Map, Measure and Manage. Govern sets roles and policies, Map frames the context and risks, Measure assesses them and Manage acts on them.
Who owns AI governance in a company?
Usually a named group that spans legal, security, data and the business teams using AI. In a sales organisation, revenue operations often owns the day-to-day rules for sales tools.
Does an approval step make an AI tool compliant?
No. An approval step is one control. Compliance depends on the law that applies, the data involved and the organisation's own policies and records.
About this page. Written by the Pebbles Ai team for people who run sales, marketing and growth. Last updated .
