Introduction to AI Governance

All courses / AI Governance / Module 1 / Chapter 1

Learning objectives

After the lesson the participant can:

• Explain the working definition of AI governance and its five verbs: declare, classify and accept, assign, enforce and demonstrate.
• Distinguish AI governance from a committee, a policy binder, an ethics statement and legal compliance alone.
• Describe the five ways in which AI invalidates assumptions of classical IT governance.
• Analyse a governance decision as a position on one of the three recurring tensions.

Key concepts

AI governance

The system of decisions, controls and evidence through which an organisation declares what it uses AI for, classifies and accepts the risks, assigns accountability, enforces the rules where the systems run and demonstrates continuously that every AI system stays within its declared intent, its risk appetite and the law.

Five changes AI brings

Probabilistic behaviour, models derived from data, a supply chain the organisation cannot inspect, a dense European legal framework and adoption that outruns control. Each invalidates an assumption on which IT governance has long rested.

Three recurring tensions

Speed versus control, autonomy versus accountability and innovation versus sovereignty. The chapter holds that most governance decisions turn out to be a position on one of them, taken mode by mode and market by market.

Governance as code

The book's thesis: declared intent, classifications, policies, approvals, exceptions, decision records and evidence are held in version control and executed in pipelines, so that governance keeps pace with the systems it governs.

Group AI governance charter

Hansa Mutual's pipeline-readable charter. It declares scope across usage modes 0 to 5, labels per market whether AI Act controls are law or group policy, names the accountable board and chair, and states decision rules and evidence retention.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. Which of the five changes AI brings puts most strain on the governance your organisation already has, and what would a supervisor notice first?
2. The chapter says a board cannot approve that a system does X, only that it does X with at least a stated accuracy on a stated population. How would that change the way approvals are worded where you work?
3. Nordvik Region's sharpest tension is innovation against sovereignty and Hansa Mutual's strain lies in legal fragmentation and agents. Which organisation does yours resemble, and why?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Why does the chapter say that AI governance is not a committee?

   1. Because committees are not recognised by the AI Act as accountable bodies
   2. Because a forum that meets monthly cannot govern systems that change weekly
   3. Because committee members usually lack a background in machine learning
   4. Because ISO/IEC 42001 requires a single accountable executive instead
   Show the answer

   B. Because a forum that meets monthly cannot govern systems that change weekly
   The chapter rejects the committee as the whole of governance on grounds of pace: a monthly forum cannot keep up with systems that change weekly. Governance needs the forum, but it is the connection between decisions, controls and evidence.

2. In Hansa Mutual's charter, how are AI Act controls labelled for the UK and Swiss entities?

   1. As law, because the group is headquartered in Hamburg
   2. As not applicable, because both sit outside the Union
   3. As group policy, because the AI Act does not apply there
   4. As law from the date of EEA incorporation
   Show the answer

   C. As group policy, because the AI Act does not apply there
   The markets block labels honestly that for the UK and Swiss entities AI Act controls are group policy and not law. Norway is labelled group policy until EEA incorporation.

3. What follows, according to the chapter, from the fact that a model is derived from data and degrades silently as the world shifts?

   1. Governance must define when an approval lapses, and monitoring must say when it does
   2. Every model must be retrained on a fixed quarterly schedule that the governance board approves in advance
   3. Models may only be approved once the provider guarantees stable behaviour
   4. Change control can be limited to code, since data changes cannot be predicted
   Show the answer

   A. Governance must define when an approval lapses, and monitoring must say when it does
   Because the model is a derived artefact that drifts, an approval granted once is not an approval for ever. Change control must cover data as well as code, and decisions must be able to lapse.