AI/ML Governance, Frameworks, and Regulation
What this domain tests
Governance, frameworks, and regulation questions test whether you can map obligations to roles, documents, and controls, not just recite principles.
Core rules
- Governance assigns accountability: the board and senior management own risk appetite; an AI or model risk committee sets policy; three lines of defense separate execution, oversight, and audit.
- The NIST AI Risk Management Framework organizes work into Govern, Map, Measure, and Manage. Govern is continuous and enables the other functions.
- ISO/IEC 42001 specifies an AI management system covering policy, roles, risk assessment, operational controls, performance evaluation, and improvement.
- The EU AI Act uses risk tiers. Prohibited practices are banned; high-risk systems face requirements for risk management, data governance, technical documentation, logging, human oversight, accuracy, robustness, and cybersecurity. Credit scoring and employment screening are high-risk examples.
- Provider and deployer duties differ. A deployer can still owe human oversight, monitoring, and record-keeping.
Worked example
A bank buys a vendor credit-scoring system for EU retail lending. The vendor is provider; the bank is deployer. High-risk classification triggers the bank obligation to use the system per instructions, assign competent human oversight, keep logs, monitor, and report serious incidents. The bank cannot rely on vendor documentation alone; it must test in its own population and retain accountability.
Traps
Treating a voluntary framework as a legal safe harbor; confusing provider and deployer; using a checklist without evidence; and missing sector regulators such as banking or insurance authorities.