AI Governance and Program Management
This domain tests whether you can stand up and run an AI security management program: who decides, what gets documented, how AI systems are inventoried and approved, and how oversight continues after deployment. Questions often ask for the first or best action in a governance scenario, so separate program design from project execution.
Core rules
- Governance is ongoing, not a one-time approval. Establish a charter, executive sponsor, cross-functional AI governance committee, RACI, and a policy hierarchy that connects acceptable use, data, security, privacy, and procurement. Anchor the program to a recognized framework such as the NIST AI Risk Management Framework (Govern, Map, Measure, Manage) or ISO/IEC 42001, then map controls to your own processes.
- Maintain an AI system inventory and use-case intake. Classify each use by data sensitivity, autonomy, affected population, and regulatory exposure; higher tiers require more evidence, approvals, and monitoring.
- Use lifecycle gates: intake, design, data acquisition, build/train, validation, deployment, monitor, retire. Each gate needs entry/exit criteria and a named accountable owner.
- Document intended use, limitations, data sources, evaluation results, approvals, model/system cards, and exceptions with expiry and compensating controls.
- Manage third parties through due diligence, contractual security/privacy/AI clauses, audit rights, incident notification, model provenance, and concentration risk.
- Report program metrics to management and the board; maintain training, audit trails, incident handling, and exception management.
Worked example
An HR team wants a generative AI assistant to draft performance feedback from manager notes. The first action is not to buy a tool. Require use-case intake and risk tiering. Because the system processes employee personal data and influences employment decisions, it is high tier: complete a DPIA, legal review, bias and accuracy testing, human-review requirement, vendor due diligence, and committee approval. Then pilot with logging and a rollback plan.
Traps that cost marks
- Treating a published policy as an operating program.
- Letting the business sponsor self-approve a high-risk use.
- Forgetting post-deployment monitoring and retirement.
- Confusing the model owner with the risk owner.
- Granting exceptions without expiry or compensating controls.