AI governance and management learning resources
AI governance can’t stop at a policy document. Once models, APIs, and agents are live in production, static guidelines aren’t enough. Prompts can carry sensitive data and agents can call unapproved tools. Regulators and auditors increasingly expect organizations to show that controls are in place and working, whether under the EU AI Act or against voluntary frameworks such as the NIST AI Risk Management Framework. For CISOs, SecOps teams, and AI program managers, these resources provide a practical starting point for balancing rapid AI deployment with security and compliance. They cover four connected disciplines: AI governance, data governance, security governance, and AI security governance, with a focus on moving from static guidance to runtime control. F5 helps secure data moving through AI pipelines, identify and control shadow AI, and enforce guardrails across AI interactions, without becoming a bottleneck for your applications.
AI application business strategy
Discover strategies for integrating AI into your business operations to drive innovation and create a strategic roadmap for AI adoption.
Generative AI and digital transformation
Explore how generative AI is revolutionizing digital transformation across industries with cutting-edge applications and technologies.
AI transparency
Learn about the importance of transparency in the use of AI systems and how to implement practices that limit AI bias and ensure accountability and trust. Moreover, transparency in AI analytics empowers organizations to unlock the full potential of their data, allowing them to streamline processes and enhance project management efforts.
F5 AI collaboration and partnerships
Discover how F5 collaborates with partners to drive advancements in AI management systems and orchestration platforms to simplify inference data management.
FAQs
An AI security governance framework defines who is accountable for AI risk, which controls apply, and how they’re monitored and verified. The NIST AI Risk Management Framework is voluntary guidance built around four functions (Govern, Map, Measure, Manage) and isn’t certifiable. ISO/IEC 42001 is a certifiable AI management system standard. The two complement each other rather than compete: teams can use NIST AI RMF to shape their practice and ISO/IEC 42001 to demonstrate it.
Organizations protect large language models by treating prompts and external content as untrusted input and enforcing controls during development and at runtime. Prompt injection tops the OWASP Top 10 for LLM Applications. To protect against adversarial attacks, including prompt injection, layer filtering and logging on a least-privilege foundation. An agent that can only read a knowledge base can’t reach the customer database, though it can still leak what it reads. The F5 AI Security Platform provides comprehensive AI protection best practices, with F5 AI Guardrails enforcing protection at runtime while F5 AI Red Team tests continuously.
The EU AI Act regulates AI by risk level, and for MLOps teams, its biggest impact is on process. High-risk systems face regulatory requirements for risk management, data governance, documentation, logging, transparency to deployers, human oversight, and appropriate accuracy, robustness, and cybersecurity. The Act became broadly applicable in August 2026; high-risk obligations phase in from December 2027 (Annex III) and August 2028 (Annex I). Build those requirements into MLOps workflows now.
Best practices for auditing AI systems for bias, transparency, and security start with auditing against a framework or standard such as NIST AI RMF or ISO/IEC 42001. AI systems should be tested before release, as deployed, and retested on a schedule and after every change. Check bias across relevant groups, document intended use and limitations, and pair adversarial testing with conventional API security testing. IBM’s 2026 Cost of a Data Breach Report found that even among organizations with AI governance policies, only 29% regularly audit for unsanctioned AI.
Data governance for AI pipelines starts by classifying the data that flows through them. At rest, governance means inventorying data sources (including vector stores and prompt logs), assigning data owners, and setting retention. In motion, it means inspecting prompts and responses, redacting sensitive data before it reaches an external model, and controlling which models users can reach. F5 AI Gateway covers AI applications and agents, and F5 Workforce AI Security covers employee use of AI tools; data at rest stays with your data platforms and stewards.
Security governance sets direction, and risk management carries it out. Governance covers accountability, risk appetite, policy, and assurance, while risk management identifies, assesses, and treats risks within the boundaries governance sets. NIST’s Cybersecurity Framework 2.0 makes the relationship explicit with its Govern function. AI adds pressure on both, yet IBM’s 2026 Cost of a Data Breach Report found that only 19% of organizations with AI governance policies coordinate governance and security teams. Shared runtime visibility into AI usage helps close that gap.