Building an AI Governance Operating Model for the EU AI Act
An AI governance operating model is a practice, not a statute: centralised, federated or hub-and-spoke, with roles and EU AI Act duties mapped to named people.
An "AI governance operating model" is a management practice, not a clause in the EU AI Act. The Act never uses the term — it imposes duties (classify, manage risk, oversee, document) and leaves how you organise to meet them to you. The operating model is that organisation: who decides, who builds, who checks, and how a duty in Regulation (EU) 2024/1689 reaches the person who actually discharges it. Treat it as the scaffolding that makes the statutory obligations land on named people instead of falling between teams.
This guide sets out the three common shapes, the roles worth naming, and how to map real Articles to real people.
Three shapes: centralised, federated, hub-and-spoke
There is no mandated structure. Choose the one that fits your size and how AI is spread across the business:
| Model | How it works | Best for |
|---|---|---|
| Centralised | One team owns AI decisions, classification, and sign-off | Smaller firms, or where AI is concentrated in one product |
| Federated | Each business unit governs its own AI against shared rules | Large, decentralised firms with AI everywhere |
| Hub-and-spoke | A central hub sets policy and reviews; embedded spokes run it locally | The common middle — central standards, local ownership |
Most mid-sized companies converge on hub-and-spoke: a small central function owns the rules, the register and the hard sign-offs, while product owners run day-to-day compliance for their own systems. It scales without forcing every decision through one bottleneck or letting each team freelance.
The roles worth naming
An operating model only works if accountability is personal. Name at least these:
- Accountable executive — a board-level or C-suite owner who carries AI risk on the risk map. Not a figurehead: they approve the risk appetite and the high-risk go/no-go calls.
- AI governance lead — runs the practice day to day: maintains the use-case register, owns the classification methodology, convenes review, reports upward.
- Product / system owners — for each AI system, the person responsible for its classification record, its instructions-for-use, its human-oversight arrangements, and its monitoring.
- Control functions — legal/DPO, security, and risk, pulled in where a system touches personal data, Article 27 FRIA territory, or material risk.
Keep this lightweight at small scale: in a 50-person firm one person may hold the governance-lead and DPO hats, with the CEO as accountable executive. The point is that every duty has a name against it.
The use-case register and the Article 9 risk-management system
Two artefacts anchor the model. The use-case register is the single inventory of every AI system the organisation builds or deploys, each carrying its classification (Article 5 screen, Article 6 result, the Article 6(3) reasoning), its role (Article 16 provider / Article 26 deployer), its owner, and its status. It is the spine the whole model hangs on — you cannot govern what you have not listed.
For high-risk systems, the Article 9 risk-management system is a statutory requirement, not just good practice: a continuous, iterative process across the system's lifecycle to identify, evaluate and mitigate risks. The operating model's job is to make sure that process has an owner, a cadence, and a route into the register and up to the accountable executive — and that it feeds Article 72 post-market monitoring once the system is live.
Mapping duties to people
This is the test of any operating model — can you point to the person who owns each duty?
| Duty | Article | Typically owned by |
|---|---|---|
| AI literacy of staff | Article 4 | AI governance lead (with HR) |
| Prohibited-use screening | Article 5 | Governance lead, at intake |
| Classification & role | Article 6 / 16 / 26 | Product owner, reviewed centrally |
| Risk-management system | Article 9 | Product owner, methodology by the lead |
| FRIA, where it applies | Article 27 | DPO / legal with the product owner |
| Post-market monitoring | Article 72 | Product owner, reported to the executive |
Article 4 AI literacy has applied since 2 February 2025 to all AI, the Article 5 prohibitions are live now, and Article 50 transparency duties have applied since 2 August 2026 — so the literacy, intake-screening and disclosure duties are not future work; they belong to a named owner today. The high-risk duties apply from 2 December 2027 for Annex III systems under Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026 (originally 2 August 2026), but the register and the model should exist well before then.
Worked example: Aalsmeer Retail Group, ~600 employees, ~€120M turnover
Aalsmeer runs AI across marketing, HR and logistics, so it adopts hub-and-spoke. A central two-person AI governance function owns the register, the classification method and the high-risk sign-off; the COO is the accountable executive. Each division has a product owner who classifies its own systems and runs the Article 9 process for anything high-risk — its HR division's candidate-screening tool (Annex III point 4) is the only high-risk system, so it carries a FRIA-adjacent review with the DPO. Marketing and logistics AI is minimal or Article 50 limited, owned locally. Aalsmeer maps every duty to a name, trains staff under Article 4, and reviews the register quarterly — governance that fits the business rather than a borrowed enterprise template.
How Confir helps
Confir gives the operating model its backbone: the use-case register, each system's Article 5/6 classification and Article 16/26 role, and the obligation list routed to an owner. The engine is deterministic and rule-based, so every system's classification and duties are reproducible and auditable — the central hub sees the whole estate, product owners work their own systems, and the accountable executive gets a defensible org-wide view without a consultant assembling it by hand.
Related guides
- AI governance, end to end
- The three lines of defence for AI
- An AI governance RACI model
- Board reporting on AI risk
- The EU AI Act for startups
- How to classify your AI system
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →