Building an AI Governance Framework

Most AI governance starts by writing a policy, which governs nothing, because a policy sets rules about a population of systems nobody has identified yet. This cursus builds the framework in the order that works: find the AI systems you actually run, including those inside software nobody bought as AI, classify them and assign owners who can stop them; then the policy, decision rights and risk register on top; then the documentation the AI Act requires, from Annex IV through logs, impact assessments and registration, generated as a byproduct rather than reconstructed at audit.