AI Governance and Risk
Domain focus
AI governance and risk covers the direction and control system around AI: who is accountable, what risk is acceptable, how AI systems are inventoried, assessed, monitored, and retired. Governance sets direction; management executes it. The exam tests structures, risk processes, and source-backed frameworks.
Core rules
- Separate governance from management. A governing body sets AI principles, risk appetite, policies, and escalation routes. Product and service teams run the lifecycle.
- Maintain an AI system inventory: purpose, owner, data sources, model type, vendor, users, affected stakeholders, risk rating, review date.
- Assess risk by use and impact, not by technology label. Consider affected people, decision stakes, reversibility, data sensitivity, and dependency on third parties.
- Use recognized references: ISO/IEC 42001 for an AI management system, ISO/IEC 23894 for AI risk management guidance, and the NIST AI RMF functions Govern, Map, Measure, Manage. The EU AI Act takes a risk-tiered approach, with heavier obligations for high-risk uses.
- Require documentation, logging, testing, monitoring, and incident routes. Vendor assurance does not transfer accountability.
Worked example
A vendor chatbot answers HR policy questions. The team wants a quick launch. Reasoning: first classify the use. A policy Q&A bot is not automatically high-risk, but it processes employee data and can affect employment decisions if it gives wrong advice. Require a data protection assessment, vendor due diligence, answer logging, a human escalation route, and periodic content review. Set a review trigger for scope changes, such as redundancy or performance management advice.
Traps
- Writing an AI policy with no inventory or owner.
- Treating a vendor's compliance claim as the organization's assurance.
- Confusing security testing with broader AI risk assessment.
- Assuming all HR AI is high-risk, or that none is.
- Leaving model changes outside change enablement.