DR. JOHN VOURGANAS
MSc · PhD · CEng
AI Governance
Executive
AI systems in regulated environments don't fail because the technology is wrong.
Risk
Assurance
I design that layer. Then I build what sits beneath it.
Governance
Information systems, AI integration, and digital transformation, governed at the level where they actually carry regulatory and operational risk.
The Regulatory Environment I Work In
AI governance does not exist in isolation. Every system I design, every framework I build, and every advisory engagement I lead operates within a specific regulatory architecture, one that is becoming more complex, more enforceable, and more consequential every year.
Below is a structured map of the key regulatory instruments, supervisory frameworks, and technical standards that shape AI governance across the jurisdictions where I operate, EU, Switzerland, UK, and beyond.
Key Regulatory Anchors Influencing AI System Design
Global Multilateral Governance
Global multilateral frameworks establish the foundational principles shaping national AI regulation and institutional governance models. While not always legally binding, these instruments influence legislative drafting, supervisory expectations, and cross-border policy alignment.
European Union AI & Digital Governance Framework
The European Union has established the most comprehensive and enforceable AI governance architecture globally. Its regulatory model integrates risk classification, data protection, cybersecurity resilience, and sector-specific oversight into a unified supervisory framework.
This positioning makes the EU AI ecosystem a structural reference point for multinational AI deployment and compliance strategy.
National Security & Critical Infrastructure
OECD AI Principles
Adopted in 2019, the OECD Principles define internationally recognized standards for trustworthy AI, emphasizing transparency, accountability, human oversight, and risk management across member states.
UNESCO Recommendation on the Ethics of AI
Adopted in 2021, this global normative framework establishes human rights-centered AI governance principles, influencing regulatory discourse across both developed and emerging economies.
The objective remains consistent: ensuring that AI enhances operational intelligence without compromising democratic accountability, security assurance, or public trust.
Council of Europe AI Convention
The first binding international treaty addressing AI governance, establishing enforceable obligations related to fundamental rights, democratic values, and rule of law in AI system deployment.
Core AI Regulation
EU Artificial Intelligence Act
Establishes a risk-tier classification model for AI systems, defining obligations for high-risk deployments including conformity assessment, technical documentation, human oversight, and post-market monitoring.
General Data Protection Regulation (GDPR)
Provides binding data governance requirements impacting AI system training, processing, automated decision-making, and cross-border data transfers.
Digital Operational & Financial Resilience
Digital Operational Resilience Act (DORA)
Imposes ICT risk management and incident reporting obligations on financial institutions using AI-driven systems.
PSD2 (Payment Services Directive 2)
Establishes regulatory parameters for digital financial services and AI-driven payment authentication systems.
Sector-Specific & Supervisory Layer
European AI Board
Coordinates implementation and cross-border supervision of the AI Act across member states.
European Data Protection Board (EDPB)
Issues guidance and enforcement standards relevant to automated decision-making and AI data processing.
United States AI Governance Landscape
The United States AI governance model is decentralized and agency-driven. Oversight authority is distributed across executive directives, federal regulators, and sector-specific statutes, creating a layered compliance environment for AI systems operating within U.S. jurisdiction.
Federal Policy & Executive Direction
Executive Order on Safe, Secure, and Trustworthy AI (2023)
Establishes federal requirements for AI safety testing, national security safeguards, reporting obligations, and inter-agency coordination for high-impact AI systems.
AI Bill of Rights (White House Blueprint)
Provides non-binding principles addressing algorithmic discrimination, data privacy, notice, and human alternatives in automated decision-making systems.
Regulatory & Enforcement Authorities
Federal Trade Commission (FTC) AI Guidance
Applies consumer protection and unfair practice enforcement to algorithmic systems, including deceptive, discriminatory, and opaque AI-driven decisions.
Cybersecurity & Infrastructure Security Agency (CISA) AI Guidance
Addresses AI-related cyber risk, infrastructure resilience, and operational security considerations in national critical systems.
Financial & Credit Regulation
Fair Credit Reporting Act (FCRA)
Governs automated credit decision systems, requiring explainability, dispute mechanisms, and data accuracy controls in algorithmic scoring models.
Equal Credit Opportunity Act (ECOA)
Mandates non-discriminatory lending practices, directly impacting AI-based underwriting and credit assessment systems.
Switzerland AI & Data Governance Architecture
Switzerland applies a risk-based and sector-aligned governance model for AI, anchored in federal data protection law and coordinated supervisory oversight. While not adopting a standalone AI Act equivalent to the EU, Swiss governance integrates data protection, financial supervision, and strategic digital policy into a coherent regulatory environment.
Core Legal Framework
Federal Act on Data Protection (FADP)
Establishes binding requirements for data processing, automated decision-making, transparency, and cross-border data transfers affecting AI system deployment in Switzerland.
Ordinance on Data Protection
Provides operational detail for implementation of the FADP, including technical and organizational security measures.
Supervisory Authority
Federal Data Protection and Information Commissioner (FDPIC)
Oversees enforcement of Swiss data protection law and provides regulatory guidance relevant to automated processing and AI-based decision systems.
Access Framework →
Strategic & Policy Direction
Swiss AI Strategy
Defines the federal government’s approach to innovation, risk management, international coordination, and ethical AI deployment.
International Technical & Risk Standards
Beyond statutory law, AI governance is shaped by international standards and risk management frameworks that define operational controls, security posture, and system accountability. These instruments influence procurement eligibility, certification requirements, and supervisory expectations across sectors.
Information Security & AI Management
Defines information security management system (ISMS) requirements relevant to AI infrastructure, data governance, and operational resilience.
ISO/IEC 42001 (AI Management Systems)
Establishes structured governance requirements for AI lifecycle management, risk assessment, monitoring, and accountability controls.
NIST AI Risk Management Framework
Provides structured guidance for identifying, measuring, and mitigating AI-related risks across development and deployment stages.
Financial Sector Standards
Basel Committee on Banking Supervision — AI & Model Risk Guidance
Addresses supervisory expectations for model validation, documentation, and risk oversight in AI-driven financial systems.
FATF Risk-Based Approach Guidance
Influences AI deployment in anti-money laundering (AML) and transaction monitoring systems.
Healthcare & Interoperability Standards
Defines quality management requirements relevant to AI-enabled medical devices and clinical decision systems.
Establish interoperability protocols for clinical data exchange in AI-supported healthcare systems.