AI Governance, Risk, and Compliance Frameworks
Domain 1 tests how well you can place an AI system inside a governance and compliance operating model: who is accountable, which framework applies, how risk is classified, and what evidence proves control operation. Expect questions that mix NIST AI RMF functions, ISO/IEC 42001 management-system clauses, ISO/IEC 23894 risk guidance, EU AI Act risk tiers, and sector rules.
Core rules and concepts
- Governance is not a policy PDF. It needs an AI inventory, named owners, decision rights, and a risk-acceptance route.
- Map obligations before selecting controls: legal and regulatory, contractual, internal risk appetite. Then map controls to frameworks, not the reverse.
- NIST AI RMF: Govern, Map, Measure, Manage. Govern is continuous; Map establishes context; Measure tests; Manage treats and monitors.
- ISO/IEC 42001 expects an AI management system: scope, leadership, planning, support, operation, performance evaluation, improvement.
- EU AI Act uses prohibited, high-risk, limited-risk, minimal-risk tiers; high-risk duties include risk management, data governance, technical documentation, logging, human oversight, and post-market monitoring.
- Evidence must be dated, scoped, and reproducible: model card, data sheet, test results, approval records.
Worked example
A bank deploys a CV-screening model in the EU. The exam wants classification first: employment is a high-risk area under Annex III, so high-risk duties apply. The team maps each duty to an owner and evidence: bias testing to model risk, data lineage to privacy, human review to HR operations. NIST AI RMF Map and Measure frame the assessment; ISO/IEC 42001 Clause 8 runs operation. Residual risk is accepted by the accountable business owner, not the data scientist.
Traps that cost marks
- Treating a vendor ISO certificate as proof your use is compliant.
- Confusing model risk with AI risk: AI adds autonomy, opacity, scale, and third-party dependencies.
- Skipping post-market monitoring and incident feedback.
- Using a framework as a checklist without mapping to legal obligations.