AI Risk Governance and Frameworks
Core concepts
Governance is the system of accountability, policy, and oversight that makes AI risk management repeatable. Candidates should know the three-lines-of-defense model: the first line owns and operates AI, the second provides independent risk and compliance oversight, and the third (internal audit) provides independent assurance. Understand the governing body's role (board or committee) in setting risk appetite and approving high-risk use cases, and the AI risk owner role.
Know the major framework families conceptually: the NIST AI Risk Management Framework (Govern, Map, Measure, Manage), ISO/IEC 42001 (AI management systems), ISO/IEC 23894 (AI risk management guidance), the OECD AI Principles, and the EU AI Act's risk-tiered approach (unacceptable, high, limited, minimal). You should be able to map a control to a framework function without memorizing clause numbers.
Key governance artifacts: AI inventory/register, use-case intake and tiering, model risk policy, acceptable use policy, human oversight requirements, and escalation paths.
Traps
Questions often imply that adopting a framework equals compliance; frameworks are guidance unless regulation makes them binding. Another trap: confusing accountable with responsible; accountability cannot be delegated to a vendor. Watch for governance questions answered with technical controls, or vice versa.
Rule of thumb
When unsure, ask who owns this risk and who can stop the system. If no named owner and no kill switch, governance is absent.
Worked example
A business unit wants to deploy an HR screening tool. Governance requires intake, tiering as high-risk, second-line review, documented human oversight, and board-level risk appetite alignment before launch. The vendor's SOC 2 report does not substitute for internal accountability.