What does an AI governance specialist do? Role guide

What the job involves day to day

The work starts with knowing what AI the organization actually runs. A specialist keeps an inventory of models and AI features, sorts each one by risk, and decides which need a full review. For the risky ones they run an impact or risk assessment, record the findings in a risk register, and track fixes with the engineering team. They also write the policies that say who may build or buy AI, what approval is needed, and what testing must happen before launch.

The IAPP's AI Governance Skills Framework, published in September 2026, splits this field into eight kinds of work: policy, governance, technical, product, ethics, risk, legal and assurance. Few employers hire a separate person for each. A specialist at a mid-sized company often covers several at once: running the review committee, maintaining the risk register, training staff on AI literacy, and preparing evidence when an auditor or customer asks how a model was tested.

The three frameworks you will use most

The NIST AI Risk Management Framework (AI RMF 1.0) came out on 26 January 2023 and is voluntary. It organizes risk work into four functions: govern, map, measure and manage. NIST added a Generative AI Profile (NIST-AI-600-1) in July 2024, and its own page says AI RMF 1.0 is being revised under the White House AI Action Plan. Many US teams use it as the backbone of their internal review process.

ISO/IEC 42001:2023 sets requirements for an AI management system, built on a Plan-Do-Check-Act cycle like ISO/IEC 27001 for security. Certification to it is voluntary, and companies seek it when they want an independent check of their AI management system. A specialist often owns the evidence an external auditor will inspect.

Why the EU AI Act matters to US employers

The EU AI Act entered into force on 1 August 2024 and applies in stages. Prohibitions applied from 2 February 2025, general-purpose AI model rules from 2 August 2025, and transparency rules under Article 50 from 2 August 2026. After the Digital Omnibus on AI amendments, the European Commission lists 2 December 2027 for Annex III high-risk systems and 2 August 2028 for high-risk AI embedded in regulated products.

High-risk examples include CV-sorting tools for recruitment and credit scoring. Those systems will need risk mitigation, quality datasets, activity logging, detailed technical documentation, information for deployers, human oversight, and robustness and cybersecurity. Any US company selling such systems into the EU needs someone to build that evidence, and that person is usually the governance specialist.

Who hires them and where they come from

Demand comes from companies that build or deploy AI, including technology firms, banks, insurers, healthcare groups and consultancies. In the IAPP and Credo AI AI Governance Profession Report 2025, 77% of surveyed organizations said they were working on AI governance, and only 10 of 671 said they would need no extra staff in the next year.

Backgrounds vary. Privacy, legal, compliance, IT and data governance teams often take on AI governance work. Many new programs hire managers who already worked in privacy. Engineers and data scientists also move into the technical side, building controls, evaluations and monitoring for fairness, robustness and security.

Pay

AI governance only, survey median

$151,800

Privacy plus AI governance, survey median

$169,700

Technical AI governance in tech sector, survey median

$221,000

USD a year, before tax. Medians from the IAPP Salary and Jobs Report 2025-26 (published August 2025), a global survey reported in US dollars. These are not US-only figures. BLS has no AI governance series, so no BLS anchor is shown. Sector, technical depth and combining privacy with AI work move pay the most.

What you need

Framework fluencyWorking knowledge of the NIST AI RMF functions, the ISO/IEC 42001 management system requirements and the EU AI Act risk tiers and deadlines.
Risk assessment skillAbility to run an AI impact or risk assessment, record it in a risk register and follow fixes through to closure.
Enough technical literacyYou need to understand how models are trained, evaluated and monitored so you can question test results and documentation with engineers.
Policy writingTurning legal requirements into clear internal policies, approval steps and checklists that product teams will actually follow.
Audit readinessKeeping model documentation, logs and decision records in a form an internal auditor, external certifier or regulator can check.
Optional certificationThe IAPP Artificial Intelligence Governance Professional (AIGP) certification covers AI laws, frameworks and the AI life cycle. It shows knowledge to employers but does not guarantee a job.

How to get there

Year 0-2Start in a neighboring fieldPrivacy, legal, compliance, risk, security, data governance or ML engineering all feed into AI governance. Learn how your current team handles reviews and evidence.
Year 1-2Learn the frameworksRead NIST AI RMF 1.0 and its Generative AI Profile, the European Commission's AI Act pages, and ISO's material on ISO/IEC 42001.
Year 1-3Take on AI review workVolunteer for AI impact assessments, model inventories or vendor AI reviews inside your existing role. This is how many people move in.
Year 2-3Consider a certificationThe IAPP AIGP certification is aimed at this role. Use it to fill knowledge gaps.
Year 3-5Move to a dedicated roleApply for AI governance, responsible AI or AI risk roles, often sitting in privacy, legal, compliance or a central AI team.
Year 5+Lead a programSenior specialists run the governance committee, own ISO/IEC 42001 or EU AI Act readiness, and report to executives.

Open now on AutomationRoles.ai

AIML - Machine Learning Engineer, Evaluation - Responsible AI and SafetyApple · Cupertino, California

Responsible AI ConsultantAccenture · Athens, Greece

See all →

Questions people ask

Is AI governance a technical or a legal job?

It can be either. The IAPP's skills framework lists eight types of AI governance work, from policy and legal through technical and assurance. Smaller organizations usually want one person who can cover several of them.

Do I need a license to work in AI governance?

No. There is no license or regulator for the job itself. Credentials such as the IAPP AIGP certification are voluntary and show knowledge, not a legal right to practice.

Is the NIST AI RMF mandatory?

No. NIST says the AI RMF is intended for voluntary use. Many organizations adopt it anyway because it gives a shared structure for AI risk work, built around the govern, map, measure and manage functions.

When do the EU AI Act high-risk rules apply?

After the Digital Omnibus on AI amendments, the European Commission's timeline lists 2 December 2027 for Annex III high-risk systems. High-risk AI embedded in products covered by Annex I follows on 2 August 2028.

Can a privacy professional move into AI governance?

Yes, and it is a common route. The IAPP Salary and Jobs Report 2025-26 found that 68% of privacy professionals have taken on AI governance responsibilities. Many organizations add AI questions to their existing privacy impact assessments.

What does an AI governance specialist do?