AI Governance, Regulation and Compliance
Regulatory and governance landscape
Candidates must understand governance as the structures, policies, and accountability mechanisms that direct AI use. Know the distinction between binding regulation, standards, and voluntary frameworks, and how they interact. Be familiar with risk-based regulatory approaches that tier obligations by use case (prohibited, high-risk, limited-risk, minimal-risk), and with the concept of a general-purpose or foundation model provider versus a deployer. Understand core compliance obligations: documentation and technical files, conformity assessment, record-keeping, incident reporting, transparency to users, and data protection duties. Know that roles (provider, deployer, importer, distributor) carry different responsibilities, and that governance requires clear ownership, policies, training, and audit trails.
Traps that appear in questions
A frequent trap is assuming one jurisdiction's rules apply globally, or that voluntary frameworks are legally enforceable. Another is confusing the provider (who places a system on the market or puts it into service under its own name) with the deployer (who uses it), which changes obligations substantially. Watch for questions that ignore prohibited practices, or that assume documentation is optional for lower-risk systems. Also be alert to claims that compliance is a one-time certification rather than an ongoing duty with post-market monitoring.
Worked example / rule of thumb
Rule of thumb: first identify your role, then the risk tier, then the obligations - in that order. Example: a hospital using a vendor's diagnostic AI is typically a deployer with duties around human oversight, monitoring, and incident reporting, while the vendor as provider carries conformity assessment and technical documentation duties.