AI compliance started as a project. In many companies it is becoming a function — something with a named owner, a defined operating model, a budget line, and regular reporting to leadership. What companies need to build is not a large department. It is a small, clear structure that other teams can actually use.
This article covers what that structure usually contains, what belongs in existing functions, and how to size it without over-building.
Why It Is Becoming a Function
The work repeats. New use cases arrive continuously, models change, vendors change, and reviews expire. Repeating work needs an owner, not a project plan.
The questions arrive from outside. Security questionnaires, procurement due diligence, customer contracts, and management-system audits all now include AI questions. Someone has to answer consistently.
The risk is cross-functional. Legal, privacy, security, quality, procurement, and the business each hold part of it. Without coordination, gaps fall between them and the same question gets three different answers.
Leadership needs a view. Boards increasingly ask what AI the company uses, what could go wrong, and what is being done about it. That requires a reporting line.
What Companies Actually Need To Build
1. A named owner and mandate
One accountable owner, with a written mandate covering scope, decision rights, escalation, and what they cannot decide alone. This is the single highest-value item, and the cheapest.
2. An operating model
Most organizations land on a hub-and-spoke pattern: a small central function that sets method, keeps the inventory, and reports; business owners who run their own systems; and existing functions that keep their specialisms. Write down who does what, because the overlaps with security and privacy are where disputes happen.
3. A defined process set
At minimum: intake and approval, inventory maintenance, risk assessment, oversight design, change review, vendor review, monitoring and incidents, internal audit, and management review. Turning these from statements into operating steps is covered in moving from AI policies to real controls.
4. A common risk method
One method, used by everyone, so results are comparable. The NIST AI Risk Management Framework is a widely used voluntary reference, and our AI risk assessment guide sets out a practical structure.
5. A management-system backbone
If AI compliance is a permanent function, give it the structure that other permanent functions use. ISO/IEC 42001 provides that pattern — context, roles, objectives, risk treatment, competence, documented information, internal audit, and management review. Certification is optional; the structure is useful either way.
6. Skills and training
Two kinds: general awareness for staff using AI tools, and deeper competence for the people running assessments and oversight. The second is harder to find, which is the subject of the AI governance skills gap.
7. Tooling, sized honestly
A spreadsheet inventory plus a document repository is a legitimate starting point. Buy a platform when volume, not ambition, makes manual tracking unreliable.
8. Reporting
A short, regular report: systems in use, new approvals, open risks, incidents, audit findings, and decisions needed. If leadership cannot read it in five minutes, it will not be read.
What Should Not Be Built Separately
Do not duplicate what already works. Information security controls belong in the ISMS. Privacy assessments belong with the privacy function. Supplier due diligence belongs in procurement. Quality processes such as nonconformity and corrective action already exist in ISO 9001 or ISO 13485 systems and can absorb AI findings.
The AI function's job is to connect those, add the AI-specific risk and oversight work, and hold the single inventory — not to run a parallel compliance organization.
Where Legal Obligations Fit
Whether specific legal requirements apply depends on your role, your markets, and the systems involved. The EU AI Act sets obligations that vary by role and classification and apply on a phased basis; sector rules may also apply. Assess your own position and take legal advice where the answer matters. Our overview of preparing for EU AI Act obligations describes the practical groundwork most organizations end up doing regardless.
How To Size It
A reasonable starting shape for a mid-sized company:
- One accountable owner, part-time to start
- One coordinator maintaining the inventory and intake queue
- Named business owners for each material system
- Existing security, privacy, legal, and quality functions supporting in their own areas
- Specialist expertise brought in for the first management system, an independent gap assessment, or audit preparation
Grow from evidence — volume of use cases, audit findings, customer demands — rather than from headcount ambition.
Where Specialized Expertise Helps
Standing a function up for the first time is different work from running it once it exists. Many organizations use external specialists for the build and independent checks, and keep the ongoing operation in house.
ElevateQCS helps companies find, vet, and engage specialists in AI governance, AI risk, management systems, quality, and regulatory compliance. You tell us the scope, the frameworks, the industry, and the experience required. We identify and vet relevant professionals. You review them and decide who to engage directly, or ask ElevateQCS to manage the engagement.
See the AI governance expertise we source, or tell us what you need.
This article is educational and is not legal advice. ElevateQCS is an independent expert sourcing and engagement company — not a certification body, auditor, or law firm.
Frequently Asked Questions
What is AI compliance?
AI compliance is the ongoing work of making sure an organization's use of AI meets the obligations that apply to it — legal requirements, contractual commitments, internal policy, and any standards it has adopted — and can show evidence of that.
What is the difference between AI governance and AI compliance?
Governance is how decisions about AI get made and overseen. Compliance is meeting and evidencing specific obligations. In practice they overlap heavily, and many organizations run them as one function.
Who should own AI compliance in a company?
A named owner with a written mandate, usually sitting in risk, compliance, quality, legal, or security, with an executive sponsor and business owners accountable for individual systems.
Do we need a dedicated AI compliance team?
Not necessarily. Many organizations start with a part-time owner and a coordinator, using existing security, privacy, quality, and procurement functions for their specialist parts, and scale only when volume requires it.
What processes does an AI compliance function need?
Intake and approval, inventory maintenance, risk assessment, oversight design, change review, vendor review, monitoring and incident handling, internal audit, and management review.
How much does AI compliance cost?
It depends on scope, the number and type of AI systems, existing management systems, and how much is done internally. There is no dependable published average, so build a cost view from your own scope and required effort rather than a benchmark figure.
Does AI compliance require ISO 42001 certification?
No. ISO/IEC 42001 certification is voluntary. Organizations often adopt the structure of the standard for internal use and decide separately whether certification is justified by customer or market expectations.
How does AI compliance relate to ISO 27001 and privacy work?
They overlap and should be connected rather than duplicated. Security controls stay in the ISMS, privacy assessments stay with the privacy function, and the AI function adds AI-specific risk, oversight, and inventory.
What should AI compliance report to leadership?
Systems in use, new approvals and rejections, open risks and their owners, incidents, audit findings, and any decisions leadership needs to make. Keep it short and regular.
When should we hire specialized AI compliance expertise?
Commonly when building the function or management system for the first time, when an independent assessment is needed, when preparing for certification or a customer audit, or when internal capacity is fully committed.
Sources
These references provide standards, regulatory text, or background context. They do not independently validate every recommendation in this article. Linking does not imply endorsement. Standards may require purchase; refer to the publisher for the current text.
