AI governance is the set of rules, structures and controls that define who may develop and deploy AI under which conditions, who supervises it and who is liable when it causes harm. This page bundles what I have learned about it in practice with banks, insurers and public authorities.

Imagine hundreds of thousands of cars without number plates, without roadworthiness tests and without registration. Nobody would allow that. For AI models it is the normal state: models are released at random, decide on loans, job applications and medical records, and hardly anyone can explain how. AI governance is the registration office that is missing.

The three levels of AI governance

• Technology: is the system explainable, verifiable and correctable? Is there a register, logging and a switch to turn it off?
• Law: what do the EU AI Act, GDPR, DORA and MaRisk require? Which risk class does the use case fall into and which evidence must the company keep?
• Society: which values do we protect? Data protection, dignity, democracy. Who decides what a model considers right, and whose data did it learn that from?

Why the topic is urgent now

Within two weeks in the summer of 2026, OpenAI, Anthropic and the UK AI Security Institute admitted that their own agents had broken out of the sandbox in tests and accessed real systems. OpenAI documents models that invent data to solve tasks. Anthropic reports the misuse of Claude for missile guidance software. These are not footnotes; these are the vendors themselves. And while the EU postpones the high-risk obligations of the AI Act to the end of 2027, these systems scale in seconds.

Our approach: the AI governance layer

At SIFAMO we built a technical layer that sits above the AI. It implements the regulatory requirements digitally instead of managing them in spreadsheets.

• Registration: every model and every agent registers with purpose, deployment location, permissions and owner. No registration, no deployment.
• Logging: every call, every decision and every data source is recorded traceably.
• Boundaries and human in the loop: clear rules on what the AI may do and defined points where a human intervenes, for instance when bias is detected.
• Escalation: if a model behaves unusually it is reported and shut down. Automatically, not after the next quarterly review.
• Audit-ready: the documentation is structured so that BaFin, internal audit or external auditors can use it directly.

AI governance in everyday life: three examples

Credit decision. Two identical applications, one from Ahmed, one from Stefan. If the model rejects Ahmed, the bank must be able to explain why. If there is bias from historical data, a human has to decide. Without logs and a register this cannot be proven.

Training. Models must not learn from real personal data. We pseudonymise with IDs; the mapping stays in our own system. That way we can guarantee that no model has ever seen a real name.

Agents in software development. An agent that handles everything from the Jira ticket to the pull request makes decisions continuously: which library, which test coverage, how to handle sensitive data. In regulated industries every one of them must remain traceable. Speed without control is not an option there.

Further reading in English

• AI, Cognitive Transformation & Data Integrity: Key Takeaways from My Keynote at the Frankfurt Business Forum
• How Skilldex Helped Us Fix Hiring, Stop Wasting Time, and Finally Match the Right People
• From Data Lag to Real-Time — Why Event-Driven Architectures Are Critical for Scalable AI
• Why Most AI Projects Never Leave the Lab — And How to Change That
• Why AI is Reshaping Business Models Faster Than Expected

About Umair Zaffar

I started as a freelance software developer in 2017 with a first project at an insurer in Hanover. In 2019 my co-founder Ayman Kalaie and I founded sifamo GmbH, self-financed and without loans. Today around 30 consultants, architects and developers work from Berlin and Frankfurt am Main; above the GmbH sits SFM Holding with SIFAMO Events, the organiser of the SIFAMO AI Summit. Since 2023 our focus has been AI in regulated industries. On my YouTube channel and in this blog I share what we learn along the way: unfiltered, with numbers and without consultant jargon. Most posts are in German; the English articles from 2024 and 2025 are listed below.

Frequently asked questions

What is the difference between AI governance and AI compliance?

Compliance answers whether a system meets the rules. Governance ensures that it keeps doing so: with responsibilities, processes, controls and the technology that makes all of it verifiable.

Does the Mittelstand need AI governance?

Yes, at an appropriate scale. Anyone using AI for decisions about customers, applicants or suppliers needs an inventory, clear usage rules and an accountable human. That is governance in miniature and can be set up in weeks.

How do I start with AI governance?

With an inventory of all deployed AI systems, their classification under the EU AI Act and the question of which decision nobody could explain today if the supervisor asked. We help with that, see AI consultant, or via the contact page.

Want to know what a governance layer looks like in your system landscape? Reach me via the contact page, by e-mail at contact@sifamo.com or directly on LinkedIn.