IBM watsonx Governance Advisor flashcards

35 cards. Read the term and the definition here. The deck at the top of this page is optional.

AI governance definition

The policies, roles, processes, and controls that direct how AI systems are approved, built, operated, monitored, and retired, with accountability assigned to named owners throughout the lifecycle.

Governance evidence artifacts

Documents proving governance ran: model cards or factsheets, intended-use statements, evaluation results, approver sign-offs, monitoring logs, and change records. These are the primary audit deliverables auditors request.

Demographic parity difference

A fairness metric measuring the gap in positive selection rates between protected groups. A value near zero indicates similar selection rates, but it ignores outcome correctness and base rates.

Disparate impact ratio

The selection rate of the less-favored group divided by the more-favored group. A ratio below 0.8 is a common screening heuristic for adverse impact, though it is not itself a legal determination.

Data versus concept drift

Data drift is a shift in input distributions; concept drift is a shift in the input-to-output relationship. They require different detectors and imply different remediation actions.

Human oversight models

Human-in-the-loop requires approval before each action; human-on-the-loop monitors and can intervene; human-out-of-the-loop only logs. Risk tier determines which oversight pattern is mandatory.

Generative AI red-teaming

Adversarial probing of a generative AI application to surface harmful outputs, prompt-injection susceptibility, data leakage, and jailbreaks. Results are recorded as governed evaluation evidence.

watsonx.governance positioning

An AI governance console within the watsonx platform that inventories, assesses, monitors, and documents both classical models and generative AI use cases across their lifecycle.

Governance versus MLOps

MLOps optimizes model performance and delivery speed. Governance adds risk classification, approval gates, policy mapping, and defensible documentation that MLOps tooling does not provide.

Governance versus GRC platform

GRC platforms track obligations and controls manually. watsonx.governance attaches controls to live model metadata, evaluation results, and lifecycle events, producing evidence automatically.

Five governance value pillars

Risk and compliance visibility, lifecycle traceability and audit evidence, automated fairness and drift monitoring, policy enforcement with approval workflows, and one inventory spanning classical and generative AI.

Value narrative structure

A four-part sequence: regulatory driver, risk exposure without governance, the watsonx capability that addresses it, and a measurable outcome such as reduced audit preparation time.

Governance buyer personas

Chief AI Officer or CDO for inventory and value, Chief Risk Officer and compliance for regulatory evidence, model risk management for validation, and MLOps for monitoring and deployment gates.

EU AI Act risk tiers

Four tiers: prohibited practices, high-risk systems listed in Annex III, limited-risk systems with transparency duties, and minimal-risk systems. Obligations scale with the assigned tier.

EU AI Act high-risk obligations

Risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness, cybersecurity, and post-market monitoring for systems classified high-risk.

GPAI model obligations

General-purpose AI providers must supply technical documentation, information for downstream integrators, and a copyright policy. Systemic-risk models add evaluation, adversarial testing, and incident reporting.

NIST AI RMF functions

Govern, Map, Measure, Manage. The framework is voluntary and process-oriented, mapping well to policy and control design rather than prescribing specific technical tests.

ISO/IEC 42001 AIMS

An AI management system standard with Plan-Do-Check-Act structure covering organizational context, leadership, risk treatment, and continual improvement. ISO/IEC 23894 provides related risk guidance.

Model risk management drivers

Financial-sector expectations for model inventory, independent validation, ongoing monitoring, and documentation. Fair-lending concerns add scrutiny for credit and marketing models.

Risk scoring inputs

Use-case criticality, affected population vulnerability, autonomy level, data sensitivity, model type, reversibility of harm, and regulatory classification. These inputs assign the use case a risk tier.

Obligation-to-control mapping

Link each regulatory obligation to a control, then to an evidence artifact and an owner. Unmapped obligations and controls lacking evidence are the gaps auditors find first.

watsonx.governance capability map

AI use-case and model inventory, risk and compliance assessment, factsheet generation, evaluation and fairness testing, production monitoring, approval workflows, and alerting dashboards.

Governance console architecture

The console connects to model-serving and development environments through integrations and APIs to pull metadata and metrics, then stores assessments, evaluations, and approvals as governance records.

Inventory as system of record

Each governed asset records owner, risk tier, lifecycle stage, linked policies, evaluation results, and approval history. All other governance features reference these records.

Generative AI evaluation metrics

Faithfulness or grounding, answer relevance, toxicity, and PII leakage. These assess retrieval-augmented and foundation-model applications where classical accuracy metrics do not apply.

Monitoring threshold alerts

Scheduled evaluations run against production payloads; breaching a configured threshold raises an alert that can trigger approval or remediation workflows, not just a dashboard indicator.

Governance CI/CD gate

Registration, evaluation, and approval invoked through SDK or REST APIs during pipeline execution, blocking promotion when fairness, drift, or quality thresholds fail.

Discovery objective

Produce a quantified, prioritized AI use-case inventory and a governance gap assessment, rather than a product demonstration recap or an unvalidated wish list.

Discovery data inputs

AI use-case list by business unit, model types and hosting locations, current approval process, existing policies and frameworks, applicable regulations, and known incidents.

Discovery pain quantification

Measure model and generative AI use-case counts, hours spent assembling audit evidence, approval cycle time, percentage of models monitored in production, and shadow AI instances.

First-wave prioritization criteria

Regulatory exposure, use-case criticality, data readiness including available payloads and ground truth, stakeholder sponsorship, and integration feasibility determine which use cases go first.

Phased rollout pattern

Phase 1 inventory and risk classification for a pilot unit; Phase 2 evaluation and approval workflow; Phase 3 production monitoring; Phase 4 enterprise scale and framework mapping.

Pilot selection rule

Choose a use case with real regulatory or reputational exposure, an engaged business owner, and available evaluation data, so the pilot yields credible evidence rather than a synthetic demo.

Adoption success metrics

Percentage of AI assets inventoried, percentage with completed assessments, approval cycle time, monitoring coverage, mean time to remediate alerts, and audit findings count.

Governance adoption risks

Perceived slowdown of data science, duplicate spreadsheet inventories, unclear ownership between risk and engineering, and policies so strict that teams route around the process.