AI Governance, Privacy, and Compliance
Governance is the structure of policies, roles, and controls that make AI use accountable. Core elements: an AI inventory/registry (what models exist, owners, purpose, risk tier), risk classification (low to high, based on impact on people and legal exposure), approval gates, documentation, and ongoing monitoring. Assign clear ownership and define escalation paths for incidents.
Privacy fundamentals: personal data is any information relating to an identifiable person. Key principles include lawful basis, purpose limitation, data minimization, retention limits, and subject rights (access, deletion, correction). Know anonymization (irreversible, outside scope) versus pseudonymization (reversible with a key, still personal data). Differential privacy adds calibrated noise to protect individuals in aggregates.
Regulatory awareness: GDPR (EU, data protection, rights, penalties), CCPA/CPRA (California consumer rights), sector rules (HIPAA for health, financial regulations), and emerging AI-specific regulation that classifies systems by risk and imposes transparency, documentation, and human-oversight duties. Know that model training on personal data raises purpose-limitation and lawful-basis questions.
Traps: equating pseudonymization with anonymization; assuming a vendor's compliance transfers to you (the deployer often retains responsibility); or thinking governance ends at deployment.
Worked example: a resume-screening tool is high-risk because it affects employment. Governance requires a documented purpose, bias testing, human review of rejections, retention limits on applicant data, and an audit trail - plus a named accountable owner.
Rule of thumb: if you cannot name the owner, the purpose, and the data retention period for a model, it is not governed.