Governance is not management — the EDM model

Lesson 1 of 4 in Board-Level AI Governance: ISO/IEC 38507 and Organizational Accountability.

Everything in this module rests on a distinction that most organisations blur and every governance standard insists on: governance is not management.

Management plans, builds, runs, and reports. Governance — exercised by the governing body: a board of directors, trustees, supervisory board, or partners — does three things and only three things, captured in the Evaluate–Direct–Monitor model that ISO/IEC 38500 established for IT governance in general:

  • Evaluate the current and future use of AI: proposals, strategy fit, risk posture, stakeholder impact.
  • Direct through principle and policy: set risk appetite, approve strategy, assign accountabilities, allocate resources.
  • Monitor performance and conformance against what was directed: reports, KPIs, assurance, escalations.

Notice what is absent: the governing body does not do anything operational. It does not select models, run impact assessments, or approve individual deployments. It decides what the organisation is trying to achieve, how much risk it will accept getting there, and who answers for the result — then verifies reality against that direction. When a board starts approving individual model releases, governance has collapsed into management; when a board merely receives management’s slide deck without ever redirecting anything, governance has evaporated into theatre. Both failure modes are common, and both are visible in the incident record.

ISO/IEC 38507:2022 — Governance implications of the use of artificial intelligence by organizations — applies that EDM lens to AI. Three facts about it orient everything else:

  1. It comes from SC 40 (IT governance) working jointly with SC 42 — which is why it speaks fluent 38500 and cross-references the AI vocabulary of 22989.
  2. Its audience is the governing body, plus the executives who prepare its decisions. Not engineers. It contains no lifecycle controls, no metrics, no shall statements aimed at developers.
  3. It governs the use of AI by an organisation — whether that organisation builds AI, buys it, or has it arrive embedded in a SaaS renewal nobody read. The board’s duties attach to use, not to authorship.

Its core message: AI does not require a new governance framework — it requires the existing one to be re-examined and adjusted, because AI changes the speed, opacity, and reach of organisational decision-making in ways the current instruments were not calibrated for. The next lesson covers exactly what changes; first, make the governance/management boundary reflexive.

EDM wrapped around PDCA — how 38507 and 42001 interlock

  1. EVALUATE (board)

    The governing body weighs AI strategy, proposals, and risk posture against organisational purpose and stakeholder expectations.

  2. DIRECT (board)

    Risk appetite set, AI policy principles approved, accountabilities assigned, resources committed — the mandate 42001 clause 5 requires top management to carry.

  3. Management runs the AIMS (Plan–Do–Check–Act)

    Clauses 4–10 of 42001: management operationalises the board’s direction into scope, risk assessment, controls, operation, and internal audit.

  4. Management review (42001 clause 9.3)

    Top management reviews AIMS performance: audit results, objective attainment, incidents, improvement decisions.

  5. MONITOR (board)

    Distilled reporting reaches the governing body: KPIs/KRIs, assurance opinions, escalated incidents. The board checks conformance with its direction.

  6. Re-evaluate & redirect

    Monitoring feeds the next Evaluate: appetite adjusted, policy revised, strategy corrected. The loop is only real if direction actually changes when evidence demands it.

Interactive sorting exercise: Governing body or management? Sort each activity to where 38507 says it belongs.

Key terms: governing body, Evaluate–Direct–Monitor (EDM), governance vs management, top management, risk appetite / risk tolerance

Interactive checkpoint quiz (1 questions) — open this page in a browser to take it.