--- title: "AI Governance and Compliance: The New Standard | SUMāTO" description: "Why AI compliance is now a board priority and how to prepare: use inventory, risk, transparency and oversight. By Andrés Lozada, SUMāTO." image: https://sumatogroup.com/hubfs/BRANDING/SUM%C4%81TO%20%7C%20LOGO%201000x500.png --- [Skip to content](https://sumatogroup.com/en/insights/blog/gobierno-cumplimiento-ia#main-content) - [INSIGHTS](https://sumatogroup.com/en/insights) - [SUPPORT](https://sumatogroup.com/en/support) - [CONTACT](https://sumatogroup.com/en/contact) EN [Español](https://sumatogroup.com/insights/blog/gobierno-cumplimiento-ia) [English](https://sumatogroup.com/en/insights/blog/gobierno-cumplimiento-ia) [![SUMāTO Group — home](https://sumatogroup.com/hs-fs/hubfs/BRANDING/SMT%20-%20LOGO.png?width=40&height=40&name=SMT%20-%20LOGO.png)](https://sumatogroup.com/en) - [HOME](https://sumatogroup.com/en/) - About #### SUMāTO - [About us→](https://sumatogroup.com/en/about-us) - [Terms→](https://sumatogroup.com/en/legal) - [Legal→](https://sumatogroup.com/en/legal) - [Cookies→](https://sumatogroup.com/en/legal) - [Data protection→](https://sumatogroup.com/en/legal) #### METHODOLOGIES - [Design Thinking→](https://sumatogroup.com/en/methodologies#design-thinking) - [Lean Startup→](https://sumatogroup.com/en/methodologies#lean-startup) - [PMI→](https://sumatogroup.com/en/methodologies#pmi) - [Scrum→](https://sumatogroup.com/en/methodologies#scrum) #### Vendors - [AWS→](https://sumatogroup.com/en/vendors#aws) - [Cisco→](https://sumatogroup.com/en/vendors#cisco) - [Dahua→](https://sumatogroup.com/en/vendors#dahua) - [Fortinet→](https://sumatogroup.com/en/vendors#fortinet) - [Huawei→](https://sumatogroup.com/en/vendors#huawei) - [Microsoft→](https://sumatogroup.com/en/vendors#microsoft) - [OCI→](https://sumatogroup.com/en/vendors#oci) - [Panduit→](https://sumatogroup.com/en/vendors#panduit) - Capabilities #### TECHNOLOGY - [Artificial Intelligence→](https://sumatogroup.com/en/artificial-intelligence) - [Data Analytics→](https://sumatogroup.com/en/data-analytics) - [Automation→](https://sumatogroup.com/en/automation-rpa) - [Cybersecurity→](https://sumatogroup.com/en/cybersecurity) - [Cloud→](https://sumatogroup.com/en/cloud) #### SEGMENTS - [SMB→](https://sumatogroup.com/en/smb) - [Enterprise→](https://sumatogroup.com/en/enterprise) - [Government→](https://sumatogroup.com/en/government) - Consulting #### Assessments - [AI Readiness→](https://sumatogroup.com/en/ai-readiness-assessment) - [Analytics→](https://sumatogroup.com/en/data-analytics-maturity-assessment) - [Cloud→](https://sumatogroup.com/en/cloud-readiness-assessment) - [Cybersecurity→](https://sumatogroup.com/en/cybersecurity-assessment) - [Enterprise Architecture→](https://sumatogroup.com/en/enterprise-architecture-assessment) - [IT Maturity→](https://sumatogroup.com/en/it-maturity-assessment) - [IT Strategy→](https://sumatogroup.com/en/technology-strategy-assessment) - [Process Automation→](https://sumatogroup.com/en/process-automation-assessment) #### Consulting & Architecture - [AI First→](https://sumatogroup.com/en/ai-first) - [BCP→](https://sumatogroup.com/en/business-continuity-plan) - [DRP→](https://sumatogroup.com/en/disaster-recovery-plan) - [Enterprise Architecture→](https://sumatogroup.com/en/enterprise-architecture-togaf) - [Enterprise Transformation→](https://sumatogroup.com/en/enterprise-transformation) - [IT Strategic Plan→](https://sumatogroup.com/en/it-strategic-plan) - [Strategic Consulting→](https://sumatogroup.com/en/strategic-consulting) - Operations #### INFRASTRUCTURE - [Data Center→](https://sumatogroup.com/en/data-center) - [Managed Services→](https://sumatogroup.com/en/managed-services) - [VDI→](https://sumatogroup.com/en/vdi) - [Intelligent Video Surveillance→](https://sumatogroup.com/en/video-surveillance) #### SECURITY - [NOC→](https://sumatogroup.com/en/noc) - [SOC→](https://sumatogroup.com/en/soc) #### USERS - [Modern Desktop→](https://sumatogroup.com/en/modern-desktop) - [Help Desk→](https://sumatogroup.com/en/help-desk) - Industries Industries - [Banking & Finance→](https://sumatogroup.com/en/banking-finance) - [Insurance→](https://sumatogroup.com/en/insurance) - [Government→](https://sumatogroup.com/en/government) - [Healthcare→](https://sumatogroup.com/en/healthcare) - [Telecommunications→](https://sumatogroup.com/en/telecommunications) - [Retail & Consumer→](https://sumatogroup.com/en/retail) - [Manufacturing→](https://sumatogroup.com/en/manufacturing) - [Energy, Oil & Gas→](https://sumatogroup.com/en/energy-oil-gas) - [Education→](https://sumatogroup.com/en/education) - [Logistics & Transportation→](https://sumatogroup.com/en/logistics-transport) - [Legal Services→](https://sumatogroup.com/en/legal-services) - [Engineering & Construction→](https://sumatogroup.com/en/engineering-construction) - Resources #### CONTENT - [Blog→](https://sumatogroup.com/en/insights) - [Use cases→](https://sumatogroup.com/en/use-cases) #### EVENTS - [Webinars→](https://sumatogroup.com/en/webinars) EN [Español](https://sumatogroup.com/insights/blog/gobierno-cumplimiento-ia) [English](https://sumatogroup.com/en/insights/blog/gobierno-cumplimiento-ia) Search - There are no suggestions because the search field is empty. [Inteligencia Artificial](https://sumatogroup.com/en/insights/tag/inteligencia-artificial) # AI Governance and Compliance: The New Standard [Andrés Lozada](https://sumatogroup.com/en/insights/author/andres-lozada) · Jan 16, 2024, 7:00:00 AM · 6 min read A few months ago, [artificial intelligence](https://sumatogroup.com/en/artificial-intelligence) governance was a conversation reserved for technical teams. Today, as I open my first meetings of the year, I find that AI compliance is already on the board's agenda. The question is no longer "what can AI do for us?" but "how do we demonstrate that we use it responsibly, securely and transparently?" At SUMāTO we work alongside companies across Latin America through that transition, and I want to share why this shift matters and how to prepare for it without slowing innovation. **The bottom line:** AI compliance has become a matter of corporate governance because international frameworks are converging on a risk-based approach. Companies that build a use inventory, risk assessments and human oversight today will arrive prepared. Doing it well does not stop innovation: it organizes and accelerates it. ## Why did AI compliance become a priority? For years, adopting AI was synonymous with experimenting fast. That stage isn't going away, but it now coexists with a new expectation: being able to explain and document what our systems do. Several forces are pushing this shift at once. - **Maturing frameworks:** references such as the European AI regulation are consolidating a common language of obligations based on the risk level of each use case. - **Customer and partner requirements:** procurement processes now ask how AI is governed, just as they ask about information security. - **Board accountability:** boards understand that careless use of AI is a reputational, operational and contractual risk that falls within their remit. The result is clear: compliance is no longer an afterthought and has become a condition for scaling. Those who treat it as governance, rather than as an obstacle, gain an advantage. ## The risk-based approach: the heart of the new standard The central idea behind the frameworks now maturing is simple and highly useful for management: not all AI use cases are the same, so they do not all require the same controls. An assistant that suggests internal responses does not carry the same level of exposure as a system that influences decisions about people. Thinking in terms of risk levels lets you concentrate effort where it truly matters. In practice, this means classifying each use case by its potential impact and assigning proportional controls: lighter for low-risk cases, more demanding for sensitive ones. This avoids both paralysis and negligence. ## What should companies do today? When a client asks me where to start, I propose five concrete fronts. You don't have to tackle them all at once, but you do need to keep them on the radar and move forward in an orderly way. - **AI use inventory:** before you can govern something, you have to know it exists. Document where AI is used across the organization, including the models and tools that teams adopted on their own. - **Risk assessment:** for each use case, evaluate the impact on people, data, finances and reputation. Classify by level and prioritize. - **Transparency:** make clear when a process involves AI, what data it uses and what its limits are, both internally and toward customers. - **Human oversight:** define which decisions require a person to review, approve or reverse what the system suggests. AI assists; accountability remains human. - **Documentation:** record decisions, tests and controls. If it isn't documented, in practice it can't be demonstrated. These five elements form the backbone of a serious AI governance program and, moreover, are the foundation on which trust with customers and regulators is built. ## How do you prepare without slowing innovation? This is the most common concern I hear, and I understand it. No one wants to trade speed for bureaucracy. The good news is that good AI governance does the opposite: it reduces the uncertainty that slows projects down today. - **Proportional controls:** apply lightweight processes to low-risk cases so teams can keep experimenting without unnecessary friction. - **Clear rules from the start:** when everyone knows what is allowed and what requires review, you move faster and with less rework. - **Reusable templates:** standard formats for risk assessment and documentation turn compliance into an agile step rather than a separate project. At SUMāTO we start with a maturity diagnostic through our [AI Readiness](https://sumatogroup.com/en/ai-readiness-assessment) assessment, which shows where each organization stands and which gaps to close first. From there, an [AI-First](https://sumatogroup.com/ai-first) strategy embeds governance by design, not as a patch at the end. ## Who is responsible within the company? AI governance cannot live in the technology function alone. It works when it is clearly shared among those who design, those who use and those who oversee. - **The board and leadership** set the risk appetite and demand accountability. - **The business units** understand the context of each use case and are responsible for applying controls in their operations. - **Technology, legal and compliance** provide the frameworks, tools and verification. When these roles are defined, compliance stops being a burden that falls on a single person and becomes a shared, sustainable practice. ## Frequently asked questions **Does AI compliance only apply to large companies?** No. Size influences the scale of the controls, but any organization that uses AI in meaningful decisions must be able to explain how it does so. Starting early, while small, is easier than correcting course at scale. **Do I need a dedicated team to get started?** Not at the outset. A clear owner, a use inventory and a simple risk-assessment process cover the essentials. The team grows as AI use grows. **Will compliance slow down our AI projects?** If it is designed with proportional controls, no. Done well, it reduces the doubts that stall initiatives today and lets you scale what works with confidence. **Where should we start if we have nothing in place?** With the AI use inventory. It is the step that provides visibility and on which all the other controls rest. ## The first step AI governance and compliance are already the new standard, and the good news is that preparing is within reach of any company that decides to organize its use of AI methodically. The first step is not to buy more technology, but to understand clearly where you stand today and which gaps to close first. If you want to build an AI governance program that protects your organization without slowing innovation, let's talk at [sumatogroup.com/contacto](https://sumatogroup.com/contacto). At SUMāTO we help you take that step with judgment and at your own pace. Next step How ready is your operation to adopt AI? Start by measuring it. [AI Readiness Assessment →](https://sumatogroup.com/en/ai-readiness-assessment) [Inteligencia Artificial](https://sumatogroup.com/en/insights/tag/inteligencia-artificial) ![Andrés Lozada](https://sumatogroup.com/hs-fs/hubfs/SPEAKERS/AL.jpeg?width=56&height=56&name=AL.jpeg) Andrés Lozada Jan 16, 2024, 7:00:00 AM [LinkedIn](https://www.linkedin.com/in/andreslozada/) ### Explore more from SUMāTO [Enterprise AI](https://sumatogroup.com/en/artificial-intelligence) [Enterprise Transformation](https://sumatogroup.com/en/enterprise-transformation) [Strategic Consulting](https://sumatogroup.com/en/strategic-consulting) [AI Agent](https://sumatogroup.com/en/artificial-intelligence) [AI Contact Center](https://sumatogroup.com/en/artificial-intelligence) [Cybersecurity](https://sumatogroup.com/en/cybersecurity) ### Related Posts #### [Artificial Intelligence vs. Generative AI: A Distinction That Matters in Business](https://sumatogroup.com/en/insights/blog/inteligencia-artificial-vs-ia-generativa-diferencias-negocios) There is a confusion that repeats in nearly every conversation about technology in the region's companies: using "[artificial intelligence](https://sumatogroup.com/en/artificial-intelligence)" and... #### [Landing zone: what to prepare before moving anything to the cloud](https://sumatogroup.com/en/insights/blog/landing-zone-preparar-nube) **A landing zone is the set of decisions — accounts, identity, network, controls, cost attribution — that get made once, before any workload moves. It...** #### [ChatGPT and Generative AI Reach Everyone](https://sumatogroup.com/en/insights/blog/chatgpt-ia-generativa) In recent weeks, one name has slipped into hallway conversations, WhatsApp groups, and executive committee meetings: ChatGPT. Launched in late... ![SUMāTO](https://sumatogroup.com/hs-fs/hubfs/BRANDING/SUM%C4%81TO%20%7C%20LOGO%201000x500.png?width=200&height=100&name=SUM%C4%81TO%20%7C%20LOGO%201000x500.png) Strategic technology planning consultants. AI, Analytics, Cloud and Cybersecurity ## Navigation [Home](https://sumatogroup.com/en) [Capabilities](https://sumatogroup.com/en/artificial-intelligence) [Consulting](https://sumatogroup.com/en/strategic-consulting) [Operations](https://sumatogroup.com/en/managed-services) [Industries](https://sumatogroup.com/en/banking-finance) [Resources](https://sumatogroup.com/en/insights) ## SUMāTO [About](https://sumatogroup.com/en/about-us) [Terms](https://sumatogroup.com/en/legal#terminos) [Legal & Privacy](https://sumatogroup.com/en/legal) [Data protection](https://sumatogroup.com/en/legal) Cookies ## [Contact](https://sumatogroup.com/en/contact) [sales@sumatogroup.com](mailto:sales@sumatogroup.com) Mexico HQ Mexico City, Mexico [+52 55 8897 5791](tel:+525588975791) Bogotá Bogotá, Colombia [+57 601 724 5059](tel:+576017245059) © 2026 SUMāTO Group. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Andrés Lozada", "url" : "https://sumatogroup.com/en/insights/author/andres-lozada" }, "dateModified" : "2026-07-09T19:35:33.700Z", "datePublished" : "2024-01-16T13:00:00.000Z", "headline" : "AI Governance and Compliance: The New Standard | SUMāTO", "mainEntityOfPage" : { "@id" : "https://sumatogroup.com/en/insights/blog/gobierno-cumplimiento-ia", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://sumatogroup.com/hubfs/BRANDING/Logo_SUMATO_Original%20-%201000x500.png" }, "name" : "SUMāTO Group" } } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Size influences the scale of the controls, but any organization that uses AI in meaningful decisions must be able to explain how it does so. Starting early, while small, is easier than correcting course at scale." }, "name" : "Does AI compliance only apply to large companies?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Not at the outset. A clear owner, a use inventory and a simple risk-assessment process cover the essentials. The team grows as AI use grows." }, "name" : "Do I need a dedicated team to get started?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "If it is designed with proportional controls, no. Done well, it reduces the doubts that stall initiatives today and lets you scale what works with confidence." }, "name" : "Will compliance slow down our AI projects?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "With the AI use inventory. It is the step that provides visibility and on which all the other controls rest." }, "name" : "Where should we start if we have nothing in place?" } ] } ``` ```json { "@context" : "https://schema.org", "@id" : "https://sumatogroup.com/#organization", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "MX", "addressLocality" : "Huixquilucan", "addressRegion" : "Estado de México", "postalCode" : "52787", "streetAddress" : "Av. Vialidad de la Barranca No. 6, Torre 1, Suite 400, Piso 4, Col. Bosques de las Palmas" }, "alternateName" : [ "SUMāTO Group", "SUMATO Group", "Sumato Group", "SUMATO", "SUMaTO", "SUMaTO Group", "SUMTO", "SUMTO Group" ], "areaServed" : [ { "@type" : "Country", "name" : "México" }, { "@type" : "Country", "name" : "Colombia" }, { "@type" : "Place", "name" : "Latinoamérica" } ], "contactPoint" : { "@type" : "ContactPoint", "areaServed" : "Latinoamérica", "availableLanguage" : [ "es", "en" ], "contactType" : "sales", "email" : "sales@sumatogroup.com" }, "description" : "SUMāTO is a Latin American technology consulting and integration firm founded in 2016, with a presence in Mexico and Colombia. It designs, implements and operates artificial intelligence, data analytics, automation, cybersecurity and cloud on the systems a client already runs, under governance frameworks such as NIST AI RMF and ISO/IEC 42001.", "foundingDate" : "2016", "knowsAbout" : [ "Inteligencia Artificial", "IA Generativa", "Agentes de IA", "Analítica de Datos", "Big Data", "Automatización de Procesos (RPA)", "Ciberseguridad", "Computación en la Nube", "Continuidad del Negocio y Recuperación ante Desastres", "Arquitectura Empresarial", "Transformación Digital" ], "legalName" : "SUMāTO Group", "location" : [ { "@type" : "Place", "address" : { "@type" : "PostalAddress", "addressCountry" : "MX", "addressLocality" : "Huixquilucan", "addressRegion" : "Estado de México", "postalCode" : "52787", "streetAddress" : "Av. Vialidad de la Barranca No. 6, Torre 1, Suite 400, Piso 4, Col. Bosques de las Palmas" }, "name" : "SUMāTO MX", "telephone" : "+52 55 8897 5791" }, { "@type" : "Place", "address" : { "@type" : "PostalAddress", "addressCountry" : "CO", "addressLocality" : "Bogotá", "streetAddress" : "Cra. 45 # 103-34, Of. 202" }, "name" : "SUMāTO CO", "telephone" : "+57 601 724 5059" } ], "logo" : { "@type" : "ImageObject", "height" : 500, "url" : "https://sumatogroup.com/hubfs/BRANDING/SUM%C4%81TO%20%7C%20LOGO%201000x500.png", "width" : 1000 }, "name" : "SUMāTO", "sameAs" : [ "https://www.linkedin.com/company/sumatogroup", "https://www.youtube.com/@sumatogroup", "https://torre.ai/teams/SUMaTOGroup", "https://www.cbinsights.com/company/sumto-group", "https://elioplus.com/profiles/channel-partners/57295/sumato-group" ], "telephone" : "+52 55 8897 5791", "url" : "https://sumatogroup.com" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://sumatogroup.com/#website", "@type" : "WebSite", "description" : "Technology consulting in AI, data, automation, cybersecurity and cloud across Latin America.", "inLanguage" : "en", "name" : "SUMāTO", "publisher" : { "@id" : "https://sumatogroup.com/#organization" }, "url" : "https://sumatogroup.com" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://sumatogroup.com/en", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://sumatogroup.com/en/insights/blog/gobierno-cumplimiento-ia", "name" : "AI Governance and Compliance: The New Standard", "position" : 2 } ] } ```