AI governance concepts
What the exam tests
This domain covers the vocabulary and operating logic of AI governance: accountability, risk appetite, model risk management, the three lines of defense, controls, and lifecycle evidence.
Core concepts
- AI governance is the system of policies, roles, processes, controls, and tools that makes AI use transparent, accountable, and aligned with risk appetite.
- Model risk management follows identify, measure, monitor, and mitigate; model risk arises from poor design, bad data, misuse, or unexpected behavior.
- The three lines of defense separate execution (first line), independent risk and compliance oversight (second line), and audit (third line).
- Controls can be preventive (approval gates, access limits) or detective (monitoring, drift alerts, fairness tests).
- Lifecycle stages include intake, development, validation, deployment, ongoing monitoring, and retirement; each stage should produce evidence.
Worked example
A credit-scoring model uses alternative data and makes automated adverse-action decisions. It should be high risk because of customer impact, data sensitivity, and limited human review. Controls include independent validation, fairness testing across protected groups, explainability for adverse actions, human appeal, and post-deployment monitoring. A low-risk internal forecasting model may need only owner attestation and periodic review. The reasoning is impact- and autonomy-based, not model-algorithm-based.
Traps that cost marks
- Equating governance with documentation; evidence must be produced by real controls and workflows.
- Reducing fairness to one statistical metric; context, legal standards, and explainability matter.
- Forgetting third-party and embedded models, which still need inventory and accountability.