Questions we are asked about AI governance.

AI governance (also called algorithmic governance) is the set of policies, processes, roles and controls that ensure AI systems are developed, procured and used in an ethical, transparent, secure way and in line with applicable laws and standards. The international reference is ISO/IEC 42001:2023.

Yes. In corporate practice they are treated as synonyms and cover the same scope: ethics, risk, transparency, accountability and regulatory compliance of AI-based and automated algorithmic systems.

An AIMS is the AI management system defined by ISO/IEC 42001: a structured set of policies, processes and controls to manage the AI system lifecycle, from conception to decommissioning. It is auditable and certifiable by an accredited independent body.

Shadow AI is the use of generative AI tools by employees without company approval, inventory or formal policy. It creates risk of data leakage, breach of data protection law, loss of intellectual property and regulatory exposure.

AI security is the security discipline applied to AI systems — LLMs, predictive models and autonomous agents. It covers AI-specific threats such as prompt injection, model theft, data poisoning, jailbreak and adversarial attacks, as addressed in the OWASP Top 10 for LLM Applications.

FATE is a responsible AI framework based on four principles: Fairness (bias control), Accountability (traceable responsibility), Transparency (explainability and documentation) and Ethics (decisions aligned with values). It is operationalised through controls, metrics and evidence.

Agentic AI describes AI systems able to plan, decide and act autonomously, often combining LLMs with tools, APIs and memory. They require specific governance: human oversight, an authorisation scope, a limited blast radius and auditing of actions.

ISO/IEC 42001:2023 is the first certifiable international standard for an AI management system. It defines requirements to establish, implement, maintain and continually improve AI governance in an organisation, and includes an Annex A with 38 controls covering the AI lifecycle.

The path is: gap analysis against the requirements, implementation of the Annex A controls with auditable evidence, an internal readiness audit conducted by an independent Lead Auditor, and then certification by an accredited independent body. VGrid does not certify — it prepares organisations for certification.

Timelines depend on the organisation's AI footprint and on existing management structures. Organisations with prior ISO/IEC 27001 or 27701 maturity tend to move faster because governance structures can be reused. Scope, duration and effort are defined in the initial assessment.

ISO/IEC 42001 is certifiable and prescribes a management system with auditable requirements. NIST AI RMF is voluntary, organised around the Govern, Map, Measure and Manage functions, and works as a good-practice guide. They are complementary and can be implemented together through a crosswalk.

The EU AI Act is Regulation (EU) 2024/1689, the first comprehensive AI law, in force since August 2024 with staged application. It classifies AI systems into risk tiers and attaches obligations to each tier, including documentation, risk management, human oversight and transparency duties.

It can apply extraterritorially, depending on whether the AI system's output is used in the European Union or the system is placed on the EU market. The applicable analysis is done case by case, based on the organisation's markets, products and contracts.

Whenever an AI system processes personal data, data protection obligations apply on top of AI governance: legal basis, purpose limitation, transparency, data subject rights and impact assessments. In practice the AI management system and the privacy programme share inventories, risk criteria and evidence.

No. Certification against ISO/IEC 42001 is issued only by accredited independent certification bodies. VGrid implements the management system, conducts internal readiness audits and prepares the evidence base for the certification audit.

It starts with an initial assessment conversation to understand the AI footprint, the trigger for the request and regulatory exposure. If there is a fit, VGrid sends a scoped proposal with duration, participants, deliverables and price. There is no trial and no product demo — this is consulting, not software.

Engagements are delivered in Portuguese, English and Spanish, for organisations in Latin America, Europe and the United States.