Ensuring robust Architecture Governance with AI Governance layer — Part I
Here I would be discussing the approach for enhancing the Architecture Governance with AI Governance thereby providing an additional set of risk, trust, lifecycle and accountability controls wherever AI enters the architecture. Since I had been in and around building target state including the Architecture, I thought it would be worth to discuss parallels. In this article I have used TOGAF Architecture from the Architecture Governance / ADM standpoint. Visit Open Group website for official documentation and further referenced. Also referred NIST AI RMF Govern–Map–Measure–Manage model, with ISO/IEC 42001 as the management-system reference point. TOGAF provides the architecture method and governance structure; NIST provides a practical risk-management overlay for AI; ISO/IEC 42001 provides an organizational AI-management-system perspective. (The Open Group Library)
AI Governance and Architecture Governance: Bringing Them Together
The central idea
Organizations are increasingly using AI to improve customer experience, automate processes and make better business decisions. As AI becomes part of everyday business operations, the question is no longer whether we should govern it, but how we can do so without slowing down innovation.
A common mistake is to treat AI Governance as an entirely new process, separate from the way we already govern enterprise technology. This can lead to more approvals, overlapping responsibilities and confusion about who is accountable.
A more practical approach is to build AI Governance into the existing Architecture Governance framework.
Architecture Governance helps ensure that technology investments support business goals, fit into the wider enterprise and remain sustainable over time. AI Governance adds another important dimension: making sure AI is used responsibly, its risks are understood, and its behaviour can be monitored and controlled.
Put simply, Architecture Governance helps us build the right solution; AI Governance helps us ensure that the AI within that solution can be trusted and managed.
Both are necessary, and neither should operate in isolation.
1. Where do the two come together?
Consider a business introducing a GenAI assistant to help its customer service team respond to queries more quickly.
The business wants better customer service and lower operating costs. The technology team needs to ensure that the solution integrates with existing applications, protects customer information and can scale without creating unnecessary costs.
But there are additional questions when AI is involved. What happens if the assistant gives a customer incorrect information? Could it reveal confidential data? How will the business identify a decline in response quality? And who takes responsibility when the AI produces an inappropriate answer?
These questions cannot be answered by architecture design alone, nor can they be addressed by AI risk controls in isolation.
The solution must be designed to fit the enterprise and operated within clearly defined AI safeguards. Business, architecture, technology and risk teams therefore need to work together from the beginning, rather than reviewing these concerns separately at the end.
2. What guardrails do we actually need?
Let’s put a governance perspective and address three straightforward questions.
A. Does the solution fit our business and technology landscape?
This is where Architecture Governance plays its part.
- Does the solution address a genuine business need and support our strategic priorities?
- Are we using appropriate, approved technologies and platforms?
- Is the data being accessed and shared securely and appropriately?
- Will the solution integrate with our existing applications and infrastructure?
- Can we operate, maintain and scale it without excessive cost or complexity?
- Are security, resilience, regulatory obligations and technical standards being addressed?
The aim is to ensure that individual decisions make sense for the wider organization.
For business leaders, this means getting sustainable value from technology investments. For technology leaders, it means maintaining a coherent, secure and manageable enterprise environment.
B. Can we trust the AI to behave as expected?
AI introduces risks that traditional architecture reviews may not fully cover. An application can be technically sound and still produce unreliable, biased or inappropriate AI outputs.
AI-specific safeguards should therefore address questions such as:
- Is the AI being used for a clearly defined and appropriate purpose?
- Is the data suitable for that purpose, and are privacy and confidentiality protected?
- Have we tested the AI for accuracy, reliability, bias and harmful responses where relevant?
- Can people understand its limitations and intervene when necessary?
- Are we protected against prompt-based attacks, data leakage and misuse?
- Can we detect changes in performance or unexpected behaviour?
- Do we know how to suspend, roll back or replace the AI if something goes wrong?
The depth of these checks will depend on what the AI does and the consequences of getting it wrong.
Objective is not to eliminate every possible AI risk. It is to understand the Risks; put appropriate safeguards in place and ensure the business can respond when things do not go as planned.
C. Who owns the outcome when something goes wrong?
This is where governance becomes a leadership responsibility rather than simply a technology exercise.
An AI initiative may involve a business owner, product team, architect, data team, AI specialist, security team and an external AI provider. Without clear accountability (Core AI governance principles: Fairness, Transparency, Accountability), each team may assume that another is managing the risk.
Get Makarand Bhosale’s stories in your inbox
Join Medium for free to get updates from this writer.
Every initiative should therefore establish who owns the business outcome, who approves the solution, who is responsible for AI performance and who responds to incidents.
Key decisions should be documented, and the solution should be monitored after it goes live. Approval at launch is not enough if the AI, its data or its business context changes over time.
Good governance does not mean that everyone owns the decision. It means everyone knows their role (Core principle à Accountability), and someone is clearly accountable.
3. How do we maintain control without slowing down innovation?
Governance often becomes a bottleneck when every initiative is subjected to the same lengthy review, regardless of its risk. The opposite problem occurs when teams classify AI initiatives as experiments and bypass established controls.
Neither approach works well.
A better approach is to include AI considerations in the existing architecture review process (Proactive Approach) and scale the checks according to the potential impact.
For example:
- Low risk: An internal assistant that summarises non-sensitive documents may need a lightweight review covering approved tools, access controls and data handling.
- Medium risk: A customer-facing AI assistant may require more extensive security and privacy checks, response testing, monitoring and a way to escalate difficult cases to a human.
- High risk: AI that influences credit, recruitment or other si
4. How can we build this into our existing architecture process?
Answer is, there is no need to create an entirely separate lifecycle for AI. Organizations can incorporate AI-specific checks into the architecture processes they already use.
Existing stage
What we should consider for AI
Business vision
What problem are we solving, what value do we expect, and is AI the right approach?
Solution design
How will AI, data, applications, security and human oversight work together?
Planning and delivery
Are the chosen models and platforms suitable, affordable and sustainable? What are the dependencies and vendor risks?
Implementation and release
Has the solution been tested for architecture compliance, security and relevant AI risks before going live?
Operations and change
Are we monitoring performance and risks? Do significant changes to models, data or AI agents require another review?
This fits naturally with the TOGAF Architecture Development Method (ADM), including its focus on implementation governance and controlled architecture change.
It also reflects the NIST AI Risk Management Framework’s emphasis on governing, assessing and managing AI risks throughout the lifecycle, rather than treating risk assessment as a one-time exercise.
5. What should this mean for business and technology leadership?
The answer is a better coordination between the governance responsibilities that already exist.
Architecture Governance should continue to provide oversight of the overall solution, its alignment with enterprise standards and its long-term sustainability. AI Governance should bring the specialist knowledge needed to assess model-related risks, responsible use and ongoing AI behaviour.
The existing Architecture Board can bring in AI, data, security, legal, compliance and risk specialists when the use case warrants their involvement. Smaller, lower-risk initiatives can follow simpler review paths, while higher-risk initiatives receive deeper scrutiny.
Business leaders remain responsible for the business outcomes and the decisions being supported by AI. Technology leaders ensure that the solution is secure, integrated and maintainable. AI and risk specialists help establish whether its use is appropriate and whether the necessary controls are in place.
This shared approach avoids a situation where the business sees governance as an obstacle, technology sees it as another compliance exercise, and risk teams become involved only when the solution is nearly ready for production.
Instead, the right conversations happen early, when changes are easier and less expensive to make.
Conclusion: Make AI part of the way we govern the enterprise
The question could come, if AI Governance should sit above, below or alongside Architecture Governance? Answer is, It is how we bring both together so that innovation remains aligned with business priorities and within acceptable risk boundaries (Win-Win for Business and Tech).
Architecture Governance helps protect the enterprise from fragmented decisions, unsustainable costs and solutions that do not fit the wider technology landscape.
AI Governance addresses the additional challenges of trust, model behaviour, responsible use and accountability.
When these disciplines work together, organizations can move faster without losing control. Business teams can explore new opportunities, technology teams can build sustainable solutions, and risk teams can provide assurance without becoming a last-minute checkpoint.
The goal is straightforward:
one connected governance approach, built into the existing architecture lifecycle, with clear accountability and additional safeguards wherever AI introduces additional risk.
That is how AI moves from being an isolated experiment to becoming a reliable, responsible and sustainable enterprise capability.
Reference basis:
The Open Group TOGAF Standard; NIST AI Risk Management Framework (AI RMF) and Generative AI Profile; ISO/IEC 42001 AI Management Systems.
