AI adoption continues to advance rapidly, yet this momentum has revealed a critical gap: by 2027, 60% of organizations are expected to fall short in realizing the value from AI initiatives due to inadequate data governance frameworks. In the private markets, investors embedding AI within their operations or backing AI-enabled companies must understand the risks and what “good” looks like when it comes to responsible AI.
Governance is the foundation for responsible AI use. This article breaks down what investors need to know about AI governance, how it drives business performance, and the regulatory developments reshaping the private markets.
What Is AI Governance?
AI governance refers to the frameworks, policies, and processes guiding the safe and responsible development and deployment of AI systems. It ensures AI delivers intended benefits without introducing disproportionate operational, legal, or ethical risks.
A strong governance foundation enables organizations to set operating parameters and outline a structured approach to addressing fairness, transparency, and accountability. Initiatives such as developing a clear AI policy and data governance best practices enable effective oversight and risk management at scale.
Governance is the foundation for responsible AI use. This article breaks down what investors need to know about AI governance, how it drives business performance, and the regulatory developments reshaping the private markets.
Why Should Investors Care About AI Governance?
The firms capturing the most value from AI are those investing early in governance, a notion supported by findings from recent PwC and IBM research. IBM notes that technologically mature organizations tend to prioritize AI governance, with less sophisticated or newer players to AI potentially struggling with the complex decisions that governance can raise.
GPs now need to proactively integrate responsible AI practices into business strategies and across their portfolios.
- AI risk is financial risk. AI-related risk is becoming a major consideration in exit valuations, as buyers and LPs are conducting extensive due diligence that can make or break transactions. Weak governance can signal execution risk and complicate acquisitions or fundraising.
- AI governance is a competitive differentiator. A mature AI governance framework gives firms the agility and resilience to quickly tap into new opportunities, such as accessing new AI-native markets or investments, as they have the future-ready mechanisms in place to facilitate rapid, responsible innovation.
- Regulation is moving quickly. New regulations, such as the EU AI Act and California SB 53, and standards such as ISO 42001 reflect growing mandatory compliance requirements for AI systems. Investors must be prepared to respond to regulatory changes and avoid substantial financial and reputational implications.
3 Steps to Responsible AI Governance
Before laying the groundwork for a structured, tailored AI governance model, identifying governance gaps and assessing existing AI use cases is critical. A few steps to start with include:
1. Assemble a cross-functional AI governance committee
AI governance is an enterprise-wide responsibility. Engaging experts across sustainability, compliance, data, legal, and other functions ensures the organization has the knowledge to ask informed, strategic questions about AI.
This collective insight also strengthens collaboration with internal and external stakeholders, helping to align expectations, clarify risks, and build trust. Priorities include:
- Establishing clear ownership and accountability over AI initiatives, ensuring that AI use is aligned with broader business and sustainability objectives
- Engaging with board directors and asset managers to align on responsible AI practices and how they are integrated into investment and diligence decisions
- Providing consistent board reviews or reporting on AI governance strategies and metrics, such as regulatory adherence, risk assessment plans, and escalation protocols
2. Develop a robust AI policy
A formal AI policy provides clarity on approved and prohibited uses of AI across the firm and its portfolios. Several AI governance frameworks, such as the OECD AI Principles, NIST AI Risk Management Framework, and the investor-specific Trusted AI Assessment offer a solid starting point for investors.
Policies should be tailored to actual organizational risks and cover:
- Where AI is implemented in reporting or compliance workflows, and how those outputs should be validated
- What is considered acceptable use, including restrictions on inputting confidential data into AI models
- List of approved and regulated AI tools and models
3. Strengthen data governance and transparency practices
AI outputs are only as good as the data they are trained on. Robust data governance practices, including good data hygiene, quality controls, and explainability, are an indispensable pillar of responsible AI governance. Companies should be able to explain how AI systems arrive at decisions, particularly in highly regulated industries such as finance.
Investors should assess the data maturity across portfolios and implement:
- Data inventory documentation outlining sources, legal basis, retention periods, and access controls
- Regular data quality audits to address data privacy and regulatory requirements
- Modern data infrastructure that can prepare and govern data for AI readiness
Emerging AI Regulations to Watch
As AI adoption grows, regulators globally are moving quickly to establish guardrails around responsible AI development and use. Although regulatory efforts are nascent, jurisdictions such as the EU and California have introduced legislation to ensure responsible practices.
The EU Artificial Intelligence (AI) Act
The EU AI Act is the world’s first and most comprehensive regulatory framework for AI. It sets harmonized rules aimed at improving the technology’s trustworthiness, safety, and transparency, and extends accountability for responsible use and development to all participants in the value chain. The regulation takes a risk-based approach and prohibits certain high-risk applications.
However, recent developments in November 2025 signal a major policy shift. The European Commission (EC) is proposing looser GDPR data protection requirements that simplify cookie consent rules and make it easier for companies to harvest user data to train AI models. Another proposed reform includes the delayed enforcement of high-risk AI rules until late 2027—a year later than originally planned.
For investors with portfolio companies operating in the EU, compliance may still be necessary despite the delays. The Act classifies many financial AI applications, such as automated portfolio building or credit scoring, as “high-risk,” thus requiring rigorous human oversight and data governance.
California SB 53
California is leading US regulatory efforts with SB 53 (Transparency in Frontier Artificial Intelligence Act). The bill requires developers of frontier AI models (trained on high computational power) to disclose safety frameworks, risk assessments, safety incident reporting, and the security of their systems.
Legal uncertainty still remains around enforcement, and the legislation’s current provisions are focused on transparency rather than an overarching approach to AI governance.
| EU AI Act | California SB 53 |
Scope | Applies to AI developers, deployers, importers, and distributors operating within the EU or offering AI services to EU citizens. Covers all high-risk AI systems across various sectors. | Affects foundational AI system developers that make a “frontier model” publicly available to Californians. |
Key Provisions | · Risk-based classification: AI systems are categorized as unacceptable, high, limited, or minimal risk. · Bans certain AI uses (social scoring, real-time surveillance). · High-risk AI requirements: strict data governance, human oversight, transparency, and conformity assessments. | · Frontier AI framework: Developers will need to publicly disclose how they address safety, standards, and risk mitigation. · Incident reporting obligations: Critical safety incidents (threats to public safety, model misuse) must be reported within defined time periods. · Whistleblower protections: Employees reporting risks are protected from retaliation. · Creation of “CalCompute”: A state-backed public cloud computing cluster to support safe, equitable, sustainable AI deployment. |
Penalties | · Up to €35 million or 7% of global annual turnover (whichever is higher). | · No monetary penalties defined yet. |
Implementation | · In effect in 2027 | · In effect January 1, 2026. |
Next steps for investors | · Review usage of high-risk AI systems · Integrate AI governance criteria into ESG due diligence and reporting. · Encourage portfolio companies to adopt Act-aligned AI risk controls. | · Implement internal AI transparency and audit practices · Monitor evolving updates and detailed provisions. |
While standardized, AI-specific metrics for investors have yet to emerge, staying on top of regulatory developments will help firms be prepared for any changes.
AI Governance: The Foundation for Responsible AI
Although many investors are eager to embrace AI and unlock its transformative potential, strong AI governance is essential to realizing value from these investments. By operating with responsibility at its core, investors can shape an AI-driven future that is innovative, ethical, and resilient.
Related resources:
- Read: Building Responsible AI Practices in the Venture Capital Industry
- Listen: Sustainable Intelligence Podcast | EP 38: How AI is Transforming Sustainability
- Read: Developing a Responsible Generative AI Policy
- Read: AI in Sustainability Reporting: Opportunities, Challenges, and Considerations for Investors
