AI Governance, Risk, and Responsible AI
Governance as decision rights and evidence
AI governance is the system of accountability, policy, and evidence that lets an organization take AI risk deliberately. Candidates must know the core components: an inventory of AI systems, risk tiering, role definitions (system owner, model owner, data owner, independent reviewer), approval gates across the lifecycle, monitoring in production, and incident response. Understand three lines of defense: delivery teams own risk, an independent function sets standards and challenges, and audit provides assurance.
Responsible AI principles - fairness, transparency, accountability, safety, privacy, human oversight - are only real when operationalized as reviewable artifacts: datasheets, model cards, impact assessments, test results, and sign-off records. Know the difference between conformance (did we follow the process) and effectiveness (did risk actually go down).
Traps in questions
- Choosing "create an ethics committee" as the answer to an operational control gap; committees advise, controls enforce.
- Assuming high-risk classification is about model complexity rather than impact on people and rights.
- Forgetting that third-party and embedded AI (vendors, copilots, APIs) are in scope for inventory and review.
- Confusing human-in-the-loop with meaningful oversight; rubber-stamping is not oversight.
Rule of thumb
Tier by impact, then scale controls. Ask: who is affected, how severe and reversible is harm, and how much autonomy does the system have? A customer-facing credit decision with automated decline needs more control than an internal summarization tool. Worked example: two systems, both LLM-based - a marketing copy assistant (low tier: logging and content review) versus an agent that adjusts customer credit limits (high tier: impact assessment, bias testing, human approval, continuous monitoring, rollback plan).