AI governance, risk, and compliance with watsonx.governance
Domain 5 - AI governance, risk, and compliance with watsonx.governance
Governance questions test whether you can produce evidence and controls across the whole model lifecycle, not just at go-live.
Building blocks
- Model inventory - every model, owner and risk classification in one register.
- AI Factsheets - auto-generated, versioned documentation: purpose, training data, evaluations, lineage, deployment details. They attach to the model and travel with it.
- Risk assessment - likelihood and impact scoring mapped to controls and approvals.
- Monitoring - fairness, drift, quality and generative-AI evaluations.
- Workflow - propose → develop → validate → approve → operate → decommission, with named approvers.
Generative AI specifics
Traditional accuracy metrics are not enough. Evaluate HAP (hate, abuse, profanity), PII leakage, jailbreak and prompt-injection resistance, faithfulness and answer relevance. Granite Guardian models can screen prompts and responses at runtime.
Frameworks and regulation
watsonx.governance supports mapping to the NIST AI RMF, ISO/IEC 42001 and EU AI Act obligations, and integrates with OpenPages for enterprise risk and OpenScale for monitoring.
Worked example
A credit-scoring model is high-risk under the EU AI Act. Required: documented risk assessment, bias testing across protected groups, explainability of adverse decisions, human oversight, and a factsheet recording all of it before approval. Reasoning: high-risk classification raises evidence and oversight obligations, not just accuracy targets.
Traps
- Treating governance as a one-time approval instead of continuous monitoring.
- Confusing the factsheet (documentation) with the risk assessment (scoring and controls).
- Applying only classical ML metrics to a generative use case.
- No decommission step, leaving retired models in the inventory unmonitored.