AI Enterprise Governance
AI Enterprise Governance
This domain tests whether you can establish the decision rights, policies and oversight that make AI risk manageable at the organizational level - not whether you can build a model.
Core rules
- Accountability sits with the board and senior management. AI risk is an enterprise risk, reported through the ERM framework with its own appetite statement covering bias, safety, privacy, IP and third-party exposure.
- Apply the three lines model: the business or AI product owner owns the risk (first line), risk and compliance set the framework and challenge (second line), internal audit gives independent assurance (third line).
- Maintain an AI inventory/register as the control point for everything else - no inventory, no governance.
- Policies and standards turn principles into testable requirements: approved use cases, prohibited uses, model documentation, human oversight, procurement.
- Know your role-based obligations. Under the EU AI Act, duties differ for providers versus deployers, while prohibited practices apply regardless of role.
- Align with recognized frameworks - the NIST AI RMF Govern function and ISO/IEC 42001 management-system clauses - and map them onto existing controls rather than building parallel programs.
Worked example. A bank's HR team wants a CV-screening tool. Governance reasoning: (1) classify the use - recruitment is high-risk under EU AI Act Annex III, so deployer duties apply (human oversight, monitoring, record-keeping, informing candidates); (2) confirm it fits approved-use policy and the appetite for employment discrimination; (3) assign an accountable executive and first-line owner; (4) require vendor documentation and contract terms before any pilot; (5) define board reporting metrics. Skipping step 1 is the common failure - the team treats it as procurement, not a high-risk AI deployment.
Traps. Treating governance as an IT project; publishing ethics principles with no operational controls; assuming a vendor's compliance statement transfers your obligations; confusing model risk (performance) with AI risk, which includes harm to people and rights.