Data Governance and AI Risk Management
Domain 3 tests governance and risk control for AI: who owns data, how quality and lineage are assured, and how AI risks are identified, assessed, treated, and monitored across the lifecycle.
Governance rules
- Assign data owners, stewards, and AI risk owners; accountability cannot be outsourced to a vendor.
- Govern quality dimensions: accuracy, completeness, consistency, timeliness, validity, and representativeness.
- Maintain lineage, metadata, access controls, retention rules, and lawful basis for personal data.
- Apply risk frameworks such as NIST AI RMF functions Govern, Map, Measure, Manage; document context, impacts, and controls.
- Classify use by harm and regulation; employment, credit, health, and safety uses usually demand stronger controls.
- Monitor drift, bias, security exposure, vendor changes, and incident response after deployment.
Worked example
An HR team wants AI to screen CVs. The risk assessment flags employment impact, protected attributes, and candidate rights. Controls include lawful basis, bias testing by group, human review, explainable criteria, adverse-impact monitoring, and a documented appeal route. The vendor's black-box score is not accepted as sole evidence.
Traps
- Treating governance as a one-time approval.
- Equating privacy with removing names.
- Ignoring third-party and training-data risk.
- Documenting controls without testing them.
- Assuming aggregate accuracy proves fairness.