AI Governance
AI Governance
The AI Governance domain tests how AI assets are controlled across their lifecycle: intake, risk tiering, documentation, approval, monitoring evidence, and retirement. DataRobot governance content centers on the AI Catalog and Model Registry, lineage, access control, approval workflows, and auditability. The exam asks who approved what, on what evidence, and whether that evidence is current.
Core rules
- Register every use case, including shadow and third-party models; unregistered assets cannot be governed.
- Assign a risk tier from impact, autonomy, and data sensitivity. Higher tiers need stronger evidence and more approvals.
- Maintain model documentation: purpose, owner, training data lineage, evaluation results, limitations, and intended use.
- Enforce role-based access and separation of duties between builders, approvers, and operators.
- Record approvals, changes, and exceptions in audit logs; link evidence to the model version.
- Re-review on material change: new data, new model version, new tool access, or new jurisdiction.
- For GenAI and agents, govern prompts, retrieval sources, tool permissions, and evaluation sets as assets.
Worked example
A credit-limit model is proposed. Impact is high, so it is tiered high-risk. The governance lead requires out-of-time validation, explainability, and a fairness test by protected group. The disparate-impact ratio is 0.78 against a 0.80 internal threshold. The model is not approved; the team removes a proxy feature and adds a group-specific review, reaching 0.83. The approval record links the new version, test evidence, and reviewer. Reasoning: governance is an evidence gate, not a document archive. The failed test changed the model, and the registry preserves the versioned decision.
Traps
- Treating governance as post-deployment paperwork rather than a gate before release.
- Confusing monitoring dashboards with governance; observability supplies evidence, not approval.
- No named owner or stale documentation after a model change.
- Approving a model once and never re-reviewing after data or vendor changes.
- Ignoring non-deterministic GenAI and agentic risks: prompt changes, retrieval updates, and tool scopes.
- Leaving shadow AI outside the registry.