AI compliance operations and accountability
Domain 4: AI compliance operations and accountability
This domain tests how compliance is run day to day: who is accountable, how obligations are operationalised, how monitoring and incidents work, and how evidence is maintained. Scenario questions often ask who should own a decision, what must be documented, or when to escalate.
Core rules and concepts
- Accountability cannot be delegated to a model. A named executive owns the AI compliance programme; the board provides oversight; an AI governance committee coordinates; business owners own first-line risk; compliance and risk functions provide second-line challenge; internal audit provides third-line assurance.
- Policies and procedures must cover AI inventory, classification, approval gates, procurement, data protection, human oversight, testing, change management, logging, incident response, third-party management and record retention.
- Monitoring should combine compliance testing, control self-assessments, key risk indicators, model performance monitoring and audit. Findings need owners, deadlines and verification of closure.
- Training must be role-based for developers, data scientists, business users, procurement and senior management.
- Incident management includes detection, containment, root-cause analysis, remediation, notification, documentation and lessons learned. Regulators may require reporting within fixed deadlines.
- Records must be reliable, retrievable and sufficient to show decisions and controls over time.
Worked example
A deployed recruitment model produces a sudden drop in female candidates progressing. The AI owner detects the drift through segment monitoring, freezes the model, escalates to the AI governance committee and compliance, preserves logs, investigates training-data and feature changes, retrains or rolls back, notifies affected parties and the regulator if required, updates the risk register, and reports to the board. The reasoning connects detection, containment, accountability, evidence and remediation.
Traps
- Saying 'the AI system is accountable'.
- Treating AI compliance as an IT-only project.
- No audit trail for model changes or human overrides.
- Delayed incident escalation or notification.
- Training once at launch with no refresher.
- Reporting metrics without decisions or actions.