AI Governance Framework

A practitioner handbook rather than an exam guide. It takes the Regulation's obligations in the order it creates them, names the Article each one comes from, and ends every chapter with the documents you have to be able to show.

What does the AI Governance Framework cover?

• Written from the Official Journal text of Regulation (EU) 2024/1689
• Every obligation traced to its Article
• Six print-safe diagrams
• States plainly where the Act's implementation is unfinished

Which free guides go with this book?

• Who has to build an AI governance framework under the EU AI Act, and what does it have to do?Who builds an AI governance framework under the EU AI Act: provider and deployer duties by role, the dates after the Digital Omnibus, and what to build first.
• What should you ask in an EU AI Act interview, and how should candidates answer?EU AI Act interview questions for employers, recruiters and HR, what a strong answer covers, and how candidates should prepare.
• What does the EU AI Act cover, on one page?A one-page EU AI Act mind map of every part of the law with a mnemonic. Free printable PDF, Markdown for Obsidian and an embeddable PNG.
• Can you pass this 10-question EU AI Act quiz?A 10-question EU AI Act quiz for your phone: multiple choice, instant answers, each one sourced. Share your score; free Anki flashcards.
• What does the EU AI Act mean for AI in education and training?EU AI Act rules for schools, universities and training providers: Annex III point 3 (admissions, grading, proctoring), the emotion inference ban, FRIA and dates.
• Is AI in recruitment and HR high-risk under the EU AI Act, and what must employers do?EU AI Act rules for AI in hiring and HR: Annex III point 4, the Article 26 duties on employers, informing workers, the emotion recognition ban, and the 2027 date.
• What does EU AI Act Article 4 require for AI literacy training?Article 4 of the EU AI Act as amended in July 2026: who must act on AI literacy, what changed, whether staff need a certificate, and a free training record.
• What does EU AI Act Article 50 require for chatbots, AI-generated content and deepfakes?Article 50 of the EU AI Act: telling people they are talking to AI, marking AI output, disclosing deepfakes and AI text, the exceptions, and the 2026 dates.
• What does the EU AI Act require of banks and insurers using AI?EU AI Act rules for financial services: credit scoring and life and health insurance pricing as high-risk, the FRIA, financial-institution carve-outs, and 2027.
• When is AI in critical infrastructure high-risk under the EU AI Act, and how does it fit with NIS2?EU AI Act rules for AI in energy, water, transport and digital infrastructure: Annex III point 2, its exemptions from registration and FRIA, and the NIS2 overlap.
• What must a deployer of AI do under the EU AI Act?EU AI Act duties for organizations that use AI: Article 4 literacy, Article 50 disclosures, the Article 26 high-risk duties, when a FRIA applies, and the 2027 dates.
• What did the Digital Omnibus change in the EU AI Act?Every change Regulation (EU) 2026/1744 made to the EU AI Act in July 2026: new high-risk dates, two new bans, Article 4, SME and SMC relief, read from the OJ.
• What does the EU AI Act require of general-purpose AI model providers?EU AI Act rules for general-purpose AI models: the Article 53 duties, the open-source exception, systemic risk at 10^25 FLOPs, Article 55, dates and fines.
• What must a provider of a high-risk AI system do under the EU AI Act?EU AI Act duties for providers of high-risk AI: the Section 2 requirements, the 12 Article 16 obligations, conformity assessment routes, CE marking and dates.
• What does the EU AI Act require of public authorities using AI?EU AI Act duties for public bodies: high-risk public uses, registering use in the EU database, the mandatory FRIA, legacy systems by 2030, and the 2027 date.
• EU AI Act incident reporting: the two, ten and 15 day deadlines, and which one appliesThe EU AI Act sets 2, 10 and 15 day deadlines for reporting serious incidents with high-risk AI. What Article 73 requires, who reports, and to whom.
• AI governance frameworks compared: NIST, ISO/IEC 42001 and the EU AI ActNIST AI RMF, ISO/IEC 42001 and the EU AI Act compared: a voluntary method, a certifiable standard and a binding law, and how Article 40 links them.
• AI impact assessment: what it is, when the law requires one, and how it differs from a DPIAThree documents share one name: the GDPR Article 35 DPIA, the AI Act Article 27 FRIA and ISO/IEC 42005. Who owes each one, and when.
• How to run an AI risk assessment, using the NIST framework's own structureRun an AI risk assessment with the NIST AI RMF's GOVERN, MAP, MEASURE and MANAGE functions, then test it against Article 9 of the EU AI Act.
• What actually goes in AI technical documentation, and where model cards fitWhat Annex IV of the EU AI Act requires in technical documentation for high-risk AI, how Article 11 makes it mandatory, and where model cards fit.
• Does the EU AI Act apply to your company? The scope test in Article 2Article 2 of the EU AI Act, paragraph by paragraph: who it reaches, how it catches non-EU companies, the exclusions, and a decision sequence to run.
• An EU AI Act compliance checklist, built from the Articles rather than from opinionAn EU AI Act compliance checklist where every question cites its Article: scope, prohibited practices, high-risk classification, requirements and roles.
• Is your AI system high risk? Article 6 and Annex III, in the Act's own wordsIs your AI system high risk under the EU AI Act? The two routes in Article 6, the eight Annex III areas, the Article 6(3) derogation and how to claim it.
• ISO/IEC 42001 explained: what it is, and whether you can actually be certified against itISO/IEC 42001 explained: what the AI management system standard covers, how certification works under ISO/IEC 42006, and why it is not legal compliance.
• Software is now a product: what the revised EU Product Liability Directive means for AIThe revised EU Product Liability Directive (EU) 2024/2853 makes software a product, putting AI systems under strict liability alongside the AI Act.
• EU AI Act: every application date and every fine tier, from the Regulation itselfEvery EU AI Act application date from Article 113, as amended in July 2026, and every fine tier from Article 99, from EUR 7.5 million to EUR 35 million.
• The NIST AI Risk Management Framework, explained in the order you would actually use itThe NIST AI Risk Management Framework (AI 100-1) in the order you would use it: GOVERN across the organization, then MAP, MEASURE and MANAGE per system.
• The prohibited AI practices under Article 5: eight in force, two more from December 2026The AI practices Article 5 of the EU AI Act prohibits: eight since February 2025, two more from 2 December 2026, and the exceptions written into each.
• Provider or deployer? How the EU AI Act assigns roles, and why it decides your obligationsProvider, deployer, importer or distributor? How Article 3 of the EU AI Act assigns roles, and a decision sequence to place your organization.

How long is the AI Governance Framework?

22 chapters, 416 pages. Paperback and Kindle.

Which Credential Press line is it part of?

Part of the AI governance line. The AIGP and ISO/IEC 42001 Lead Implementer exams, plus practitioner handbooks on the EU AI Act, each written from the primary texts.

What else is in the AI governance line?

• AIGP Exam Guide, Artificial Intelligence Governance Professional
• AIGP Practice Questions, 198 questions with full rationales
• ISO 42001 Lead Implementer Exam Guide, PECB Certified ISO/IEC 42001 Lead Implementer
• ISO 42001 Lead Implementer Practice Questions, Practice questions with full rationales, weighted to the published domains
• AI Governance Worked Scenarios, 24 worked situations under the EU AI Act, decided against the Articles

What people search for when they are looking for this

Measured US monthly search volume, from Ahrefs, pulled in August 2026. It is here because a reader deciding between books deserves to know how small some of these markets are: a thin keyword is not a thin subject.

• eu ai act, no measured volume
• ai governance framework, 3,600 searches a month in the US
• ai act compliance, no measured volume
• ai impact assessment, 150 searches a month in the US
• ai governance policy template, 80 searches a month in the US
• eu ai act study guide, no measured volume
• eu ai act exam questions, no measured volume

Questions readers ask about the AI Governance Framework

Is it current with the Digital Omnibus changes?

Yes. It follows Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026.

When do the high risk AI systems rules apply?

The Omnibus moved them to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. The Regulation began applying generally on 2 August 2026.

Does it cover AI risk management?

Yes. Chapter 5 covers what makes a system high risk, and chapter 6 covers the risk management system the Act requires.

Does it cover general-purpose AI models?

Yes. Chapter 16 covers general purpose AI models, and chapter 17 the transparency rules that apply to everyone.

Does it cover data governance and human oversight?

Yes. Chapter 7 covers data and data governance, chapter 11 human oversight, and chapter 12 accuracy and cybersecurity.

What does it say about penalties?

Chapter 19 covers who enforces the Act and what it costs, including the penalties under Article 99.

Does it cover the GDPR AI Act overlap?

Yes. Chapter 21 is where the Act meets the GDPR.

Is this an EU AI Act compliance checklist?

It is the document set behind one. The artefact tables, collected together, are the documents your AI governance, compliance, risk management, security and legal teams have to build.

Does it apply to providers or deployers?

Both. Chapter 3 separates provider, deployer, importer and distributor, and chapters 13 and 14 set out everything a provider and a deployer owes.

Does the EU AI Act apply to UK companies?

It can. Article 2(1)(a) covers providers placing systems on the EU market wherever they are established, and Article 2(1)(c) covers providers and deployers in a third country where the output is used in the Union. Chapters 1 and 2 cover scope.

Is it legal advice?

No. It is a reading of the published law, and every quotation is identified by the Article or Recital it comes from.

Is there a companion with worked examples?

Yes. AI Governance Worked Scenarios puts you inside 24 situations under the EU AI Act and works each one to a decision.

Is AI Governance Framework on sale yet?

Yes. It is on sale on Amazon in paperback and Kindle editions.

How long is it?

22 chapters, 416 pages. Paperback and Kindle.

Who is it for?

Anyone preparing for the examination it covers, and the trainers and librarians supporting them. It assumes you are a working professional paying for the exam yourself and studying in the evenings.

What is it written from?

the exam board's own published blueprint, and the primary text of the law, standard or framework the exam tests. Not from a summary, not from another preparation book, and not from a model's memory. Each source is listed at the back with the date it was checked.

How is it weighted?

By the exam board's own published blueprint. A domain that carries more of the exam gets more of the book, so you can see where the marks are before deciding where your evenings go.

Will it tell me the pass rate?

No. the exam board does not publish one for this exam, and this book states nothing it cannot trace.

Is it a substitute for the standard or the law?

No. Where the exam tests a paid standard, you will need your own licensed copy, and the book says so rather than pretending otherwise. Where the law is public, the book teaches from its own text and cites it.

Is Credential Press independent of the exam board?

Yes, and that cuts both ways. Credential Press is an imprint of Verity AI Ltd. It has no affiliation with the exam board, no sponsorship from it and no endorsement by it, and it has no inside knowledge of the exam either. Trademarks are used only to identify the examination the book prepares you for.

Are these real exam questions?

No. Every question was written for this book from the published blueprint and the published sources. Anyone selling you real exam content either obtained it without permission or does not have it.

What happens if you get something wrong?

Send the chapter, the edition date and the source that contradicts us to hello@credentialpress.com. Confirmed corrections go into the next revision and the edition date moves forward, so readers can tell which one they have.

Can trainers, teams and libraries buy copies?

Yes, through Amazon: the book page links to its Amazon listing. We do not sell direct, offer bulk discounts or send free desk copies. Individual readers can ask for a free reader copy on the free copies page; we ask once for an honest review, and nothing depends on it. Buying for a team? See credentialpress.com/teams.

I searched for 'eu ai act' and found this. Is it the right book?

It is the Credential Press title for that exam. Read the extent and the sources above and decide: this imprint would rather you bought nothing than bought the wrong thing.