"SOX hit Finance. GDPR hit Privacy. HIPAA hit Records. AI hits them all."

That's the line we use to open our webinar, Who Owns AI Governance.

Here is the data behind it.

Brian Wangerien put four regulations on the same map of the business, one after the other. This is what he showed.

The map

We sort every control in our library into 15 areas of the business. We call them impact zones. Some belong to one team. Audit and risk. Leadership. HR. Third parties. Others cut across teams, like operational management and systems design. And one of them, system hardening and configuration management, is huge. It holds the detailed, do-exactly-this requirements that regulators and standards bodies have been writing for two decades.

The darker the color, the deeper the controls go in that area. Light means surface level. Dark means pages of specifics.

So where are HIPAA controls concentrated?

HIPAA lands in two areas

Privacy and data protection, as you would expect. And operational management, because in healthcare the data moves with the paperwork, the facilities and the people who handle it. Two areas. The rest of the map is nearly empty.

GDPR lands in one

Data privacy. Most global companies still answer to GDPR, and nearly all of its controls sit in that one area.

Both HIPAA and GDPR have almost nothing in system hardening. They are written in regulatory language, about what must be protected. Not in implementation language, about how to configure a system to protect it.

ESG spreads thin

ESG is fuzzier. Most of its weight sits in audit and risk, with a cluster in leadership and high-level objectives. The documents talk philosophy more than practice. They tell you to manage and report ESG risk. They rarely tell you how to build a control for it. So ESG touches a lot of areas, but only a little in each.

Where AI lands

Based on the 51 AI documents we have mapped so far, the controls spread across the entire map, but we're just getting started.

This could be like ESG all over again, only 10 times more.

The biggest cluster is operational management. People want rules for how AI runs inside the business, who uses it, and how.

Next is audit and risk. How do we track it, report on it, and what is the exposure? There is a growing patch of technical security in the top right. And a cluster in leadership.

No single area dominates. No single team gets the work.

Every rule before AI landed on a department that owned it and had the authority to act.

AI governance lands on all of them at once, with no one to own it.

15 areas of the business. All at the same time.

What has not arrived yet

The map shows one more thing, and it is about what is still missing.

Of the 1,700 controls those 51 documents call for, 127 are brand new. No earlier rule ever asked for them.

Almost all of them sit in operational management and risk. They are about monitoring, and rules for how teams use AI.

Not about how to technically lock an AI system down.

System hardening, the area with the most controls for every other technology, is still thin for AI.

Brian's read is that the industry has not caught up with the technology it is trying to configure, track and monitor. The specifics are starting to land in late 2026 as the technical standards catch up with the high-level ones. Mobile and cloud followed the same path. First the principles, then the detailed configuration rules. And the detailed rules are where most of the work is.

The map you see today is not finished. More technical controls are on the way.

What to do with it

Our guest, Ulla-Maija Jäske of Fujitsu, said ownership follows the work. Decide what has to get done, and the owner of each piece becomes obvious.

The map is a reasonable place to start. Operational management, audit and risk, leadership, technical security.

Those four areas carry most of the AI controls today. When no one owns them, who makes sure every control in each area has a policy behind it?

The 51 documents behind this map are not all equal.

We picked the 23 we think belong on your 2027 radar, with who issued each one, what it covers, and why it matters.

Get the 2027 AI Governance Shortlist.

‍