RUAIH focus area 1 — Governance

Governance answers the question every other focus area assumes: who is accountable, and how would you prove it? Five of the crosswalk’s fifteen controls live here — the certification’s largest concentration.

The five controls

Organisational AI policy. The rules of the road, adopted by the organisation rather than drafted and shelved. Evidence: the policy itself, with an approval date and an owner.

AI governance committee. The accountable body — chartered, multidisciplinary, with authority to approve and suspend. Evidence: the charter, and more importantly the minutes. Whether it is required has its own page; the short version is that every published source treats it as foundational.

AI inventory and registry. The list of what you actually run — model, vendor, setting, risk tier. The control the other fourteen reference, and the recommended first step of any preparation order.

Board reporting. Oversight that reaches the top: AI risk on a standing agenda, in writing. Evidence: the reporting pack.

Resourcing the programme. Governance with people and budget attached, on paper — the difference between a programme and an aspiration.

Where to start

The inventory, then the committee — the two artifacts everything else references, and the two whose evidence accumulates rather than drafts. The readiness score grades this area in its first section; HAI-OS makes the inventory and the decision trail a living record instead of a spreadsheet.