What Is AI Governance for Business? A Practical Guide for Apple and Windows Fleets
Every business now has AI running inside it, whether it planned for that or not. Staff use AI to draft emails, summarise documents, write code and answer questions, on their work laptops, on their phones and increasingly through tools that run directly on the device. Most of this is happening without policy, without oversight and without anyone in the business being able to say exactly what AI is in use or what data it is touching.
That gap is the reason AI governance has moved from a boardroom abstraction to a practical necessity. It is no longer a question of whether your business uses AI. It uses AI already. The question is whether you can see it, control it and prove you are handling it responsibly.
This guide explains what AI governance actually means for a business, why it matters now, the frameworks that shape it, and how it applies in practice across the Apple and Windows devices your team uses every day. It is the first in a series on governing AI across a modern fleet, and it sets the foundation the rest build on.
What AI governance actually means
AI governance is the set of policies, controls and processes a business uses to manage how it adopts and uses AI, so that it captures the benefits and keeps the risks in check. It is the discipline of knowing what AI is in use, deciding what to permit, enforcing those decisions, and being able to demonstrate all of it.
It helps to separate governance from two things people often confuse it with.It is not the same as AI security, which is one part of it. And it is not the same as an AI policy document, which is only the written layer. Governance is the whole system, the policy, the technical controls that enforce it, and the reporting that proves it is working.
A useful way to think about it is in three layers. There is what you say, the policies that define acceptable use. There is what you do, the technical controls on the devices and services that put those policies into practice. And there is what you can prove, the reporting and evidence that show an auditor, a client or an insurer that the controls are real. A business with only the first layer has an AI policy. A business with all three has AI governance.
Why AI governance matters now
The starting point is simple. Your staff are already using AI, and most of that use is unsanctioned. People paste work into whatever tool is convenient, often without considering where that data goes. This is shadow AI, unapproved AI tools handling company information, and it is one of the fastest-growing data security concerns for UK businesses. You cannot govern what you have not acknowledged, and most businesses have not yet acknowledged how much AI is already running inside them.
AI now runs on the device itself
Until recently, AI mostly meant a cloud service, which at least left a network trail a business could monitor. That is changing. Modern hardware, including the latest Apple silicon, can run capable AI models entirely on the device, with no data leaving the machine and no network traffic for traditional security tools to see. That is good for privacy and genuinely useful, but it means AI is increasingly invisible to the network-based controls most businesses rely on. Governance has to reach the device itself, not just the network.
Regulation and standards have arrived
AI governance is no longer only good practice. It is becoming a documented expectation. A set of recognised frameworks now defines what responsible AI governance looks like, and they are starting to appear in the same client and procurement conversations as established security standards. For any business that sells to larger organisations or operates in a regulated sector, being able to speak to AI governance is quickly becoming part of the price of doing business.
The frameworks that shape AI governance
You do not need to become an expert in AI regulation to govern AI well, but it helps to know the three reference points that define the field in 2026. They are complementary rather than competing, and mature programmes use them together.
NIST AI RMF
The NIST AI Risk Management Framework is a voluntary framework from the United States that organises AI risk work into four functions: govern, map, measure and manage. It is deliberately technology-neutral, and more businesses use it to describe AI risk than any other vocabulary. Think of it as the operating model, the structured way of thinking about and managing AI risk, rather than a certification.
ISO/IEC 42001
This is the one that matters most for the businesses nDuo works with. ISO/IEC 42001, published in late 2023, is the first certifiable AI management system standard. Where NIST gives you a method, ISO 42001 lets you build a management system you can be independently certified against, which is what gives clients and procurement teams external proof that you govern AI responsibly.
Crucially, ISO 42001 extends an existing ISO 27001 management system rather than replacing it, and it is beginning to appear in vendor assessments alongside SOC 2 and ISO 27001. If your business already holds, or is working toward, ISO 27001, then ISO 42001 is the natural next step, and the two share much of the same underlying discipline.
The EU AI Act
The EU AI Act is binding law, and it is the only one of the three that carries legal force. It classifies AI systems by risk tier and imposes obligations accordingly, with significant penalties for non-compliance. Its reach extends beyond the EU to any business whose AI output reaches the EU market, so UK businesses serving EU clients can fall within its scope. Its transparency obligations began to apply in August 2026, with further high-risk obligations following later.
The practical takeaway is not to pick one. It is to understand that these frameworks form a stack, a method, a certifiable standard and a legal floor, and that a sensible programme draws on all three in proportion to your exposure.
What AI governance looks like in practice
Frameworks describe the destination. The practical work of governance is more concrete, and it comes back to the three layers.
Policy, what you permit
The foundation is a clear position on how your business uses AI. Which tools you approve and which you do not. What data staff may and may not put into an AI tool. What you expect of them. A good AI acceptable use policy is short, specific and genuinely enforceable, rather than a long document nobody reads. This is where governance starts, and it is the subject of a dedicated guide later in this series.
Technical controls, what you enforce
A policy you cannot enforce is a wish. The controls that turn policy into practice live on the devices and in the services your team uses. On a managed fleet, that means using your device management tooling to see which AI tools staff have installed and are using, to permit or restrict them, and to protect the data they can reach. For AI that runs on the device itself, this increasingly means governance at the operating-system level, because the network can no longer see what is happening. How that works specifically on Apple devices is the subject of a later post in this series.
Reporting, what you can prove
The final layer is evidence. Being able to show, on demand, what AI is in use across your fleet, that your controls are active, and that staff are following your policy. This is what turns governance from an internal intention into something you can demonstrate to an auditor, a client or an insurer. As AI governance appears in more compliance assessments, the ability to produce this evidence quickly becomes a real commercial advantage.
Why the device layer is where governance gets real
Much AI governance writing stops at policy and strategy. For a business actually trying to control AI, the device is where it becomes real, and it is the part most often overlooked.
Your staff use AI on their laptops, phones and tablets. That is where AI tools are installed, where company data meets those tools, and increasingly where AI models run directly. A governance programme that lives only in a policy document and a risk register, without reaching the devices, governs the idea of AI rather than its actual use.
This is also where the Apple and Windows distinction starts to matter. The two platforms are managed differently, secured differently and governed differently, and AI running locally on a Mac raises questions that Windows-centric tooling does not fully answer. A business running a mixed fleet needs governance that genuinely covers both, rather than strong control on the Windows side and a blind spot on the Apple side. That mixed-fleet reality, and the specific challenge of governing AI on Apple devices, is what the rest of this series examines.
Where to start
If AI governance feels large, the honest reassurance is that it does not have to be tackled all at once. A sensible first step is simply to gain visibility, to find out what AI is actually being used across your business today, because almost every business underestimates this. From there, a short, clear acceptable use policy gives staff a position to work to. Technical controls to enforce that policy come next, and reporting to prove it follows.
The businesses that get ahead of this now, while AI use is exploding and the frameworks are still settling, will find themselves in a far stronger position than those that wait until a client questionnaire or an incident forces the issue. Governance is far easier to build deliberately than to retrofit under pressure.
How nDuo helps
We help UK businesses govern AI across their Apple and Windows fleets, with particular depth on the Apple side, where on-device AI and the specifics of Mac management create challenges that general IT providers are not always equipped for. That means giving you visibility of the AI in use across your fleet, the technical controls to enforce your policy at the device level, and the reporting to prove it, all tied into the wider security and compliance posture we manage for you.
For businesses already working toward ISO 27001 or Cyber Essentials, AI governance is the natural next layer, and it builds on the same foundations. This post is the first in a series that moves from these principles through to practical, hands-on guidance for governing AI across your fleet.
Read our guide on why the new Macs running local AI matter for data security for the hardware side of this shift, or our Apple IT support page for how we manage Apple and mixed fleets for UK businesses.
Book a free consultation with our team to talk through where your business stands on AI governance and where the gaps are.