AI regulation and governance frameworks
Domain 2: AI regulation and governance frameworks
This domain tests your ability to navigate the main regulatory and governance instruments, classify AI systems correctly, and explain how governance structures turn principles into accountable practice. Expect scenario questions on risk tiers, provider and deployer duties, and framework selection.
Core rules and concepts
- The EU AI Act is a risk-tiered, product-safety-style regulation. Prohibited practices include subliminal manipulation, social scoring, predictive policing based solely on profiling, untargeted facial-image scraping, emotion recognition in workplaces and education, and biometric categorisation of sensitive attributes. High-risk systems in Annex III areas trigger risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and cybersecurity duties, conformity assessment and registration. Limited-risk systems trigger transparency duties, such as AI interaction disclosure and labelling of synthetic content. General-purpose AI models have separate obligations.
- GDPR governs personal-data processing, not AI as such. It adds lawful basis, fairness, transparency, data minimisation, DPIA and automated-decision safeguards.
- The OECD AI Principles are voluntary policy principles: inclusive growth, human rights, transparency, robustness and accountability.
- The NIST AI Risk Management Framework is voluntary and organised around Govern, Map, Measure and Manage.
- ISO/IEC 42001 specifies an AI management system using Plan-Do-Check-Act; ISO/IEC 23894 gives AI risk-management guidance.
- Governance needs board oversight, an AI governance committee, a clear accountable executive, policies, a legal and standards register, and three-lines-of-defence assurance.
Worked example
An HR tool ranks job applicants. Under the EU AI Act it is high-risk because recruitment is an Annex III area. The provider must run a risk-management system, document data governance, keep logs, ensure human oversight, test accuracy and cybersecurity, and complete conformity assessment before placing it on the market. The deployer must use it according to instructions, assign competent human oversight and inform candidates. GDPR also requires a DPIA and fairness checks. The reasoning links classification to role-based duties.
Traps
- Treating OECD, NIST or ISO guidance as binding law.
- Confusing prohibited with high-risk.
- Applying the EU AI Act only to EU companies; it has extraterritorial reach.
- Ignoring sector regulators and product-safety law.
- Using one framework as a tick-box instead of mapping obligations.