All courses / AI Governance / Module 3 / Chapter 9
Learning objectives
After the lesson the participant can:
- Explain why a review board accumulates a backlog and what governance as code inverts.
- Map elements of ISO/IEC 42001 to a repository artefact and an enforcement point.
- Specify the conditions a deployment gate checks before a release reaches users.
- Draft a waiver record scoped to one rule and one system, with compensating controls and an expiry.
Key concepts
- Governance as code
- The committee decides the rules, approves the interpretation of regulation and reviews the evidence; the pipeline applies the rules identically to every change, refuses what does not comply and records what it did.
- Three policy families
- Model approval governs promotion in the model registry; data use governs what may train, fine-tune or ground a model; deployment governs release to users. Thresholds are data keyed by risk tier and changed through a reviewed commit.
- Derived inventory
- The inventory is generated from descriptors in the repository together with the deployment state the pipelines observe. A deployed system without a descriptor is a finding; a descriptor with no deployment is a candidate for retirement.
- Governance gate
- A point in the lifecycle where a policy is evaluated and a change proceeds, is blocked or is routed to a human. A gate asks for a human only when the policy says so and never asks the same question twice.
- Waiver as a record
- An exception with a schema, accepted by the gate only if valid, unexpired, approved by the role the policy names and scoped to the specific rule that failed. An expired waiver is a blocked deployment.
Interactive exercises
Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.
Interactive exercise 1 · Match
Gates and their triggers
Match each governance gate in the pipeline with the event that triggers it.
Interactive exercise 2 · Scenario
A blocked release and a request for a waiver
Apply Nordvik Region's governance policy and deployment policy to the request.
Teaching plan
| 10 min | Opening: participants describe how AI use cases are approved today and how long the queue is; the teacher presents the chapter's account of the review board with a backlog. |
| 25 min | Teacher presentation of the ISO/IEC 42001 mapping, Nordvik Region's governance policy with its tier table, the model approval and deployment policies and the seven gates. |
| 15 min | Group reading of the benefits-triage inventory entry and the staff acceptable-use policy; discussion of AI the organisation did not choose and how supplier changes surface as drift. |
| 30 min | Exercise in groups: write the tier and approval table of a governance policy, the conditions of a deployment gate in plain language, and one waiver record. |
| 10 min | Debrief: groups test each other's gate conditions by proposing a release that should be refused and checking that the gate refuses it. |
Discussion
- Nordvik Region's policy treats a system whose tier is unknown as high until classified. What behaviour does that default encourage, and what would the opposite default encourage?
- The CI job records the decision before it enforces it, so a blocked release leaves the same evidence as an approved one. Why does that ordering matter to an auditor?
- A policy with many waivers is either wrong or ahead of the organisation's capability. How would you tell which, and who should decide?
Written exercise
Exercise · 30 minutes
Write a gate, a policy table and a waiver
For your own organisation, or for Nordvik Region, produce three short artefacts. One: the risk tier and approval path table of an AI governance policy, stating for prohibited, high, limited and minimal tiers who approves before use and how often the system is reviewed, plus the rule for an unknown tier and the things no waiver may suspend. Two: the conditions of a deployment gate in plain language, covering approved models, input and output screening, logging with a retention minimum, and the oversight role for high-risk systems, each with the message shown when it fails. Three: one waiver record for a rule a real system cannot meet today, with justification, compensating controls, approver, expiry and the action that removes the need for it.
Deliverable: A tier and approval table, a list of deployment gate conditions with failure messages, and one waiver record with expiry and review action.
Self-test
Choose an answer to see whether it is right, or open the answer below each question.
In Nordvik Region's deployment policy, what logging retention must the gateway have for a release to be allowed?
Show the answer
C. At least 183 days
The policy requires logging to be enabled with retention of at least 183 days, reflecting the six-month minimum in Articles 19 and 26(6) of the AI Act.According to Nordvik Region's governance policy, what is the maximum expiry of a waiver, and what may no waiver suspend?
Show the answer
A. 90 days; a prohibition, a FRIA or human oversight
Waivers are scoped to one rule and one system, with compensating controls and an expiry of at most 90 days. No waiver may suspend a prohibition, a FRIA or human oversight, so the exception path cannot dismantle what the AI Act requires.How does governance as code treat an AI feature that a supplier switches on inside purchased software?
Show the answer
D. As an event to process: the feature gets a descriptor and a decision, and is an open risk until then
The organisation is now a deployer under Article 3(4). Tenant settings are compared with a baseline so the feature appears as drift, and the contract owner decides to keep, restrict or disable it. Until the decision is recorded, it is an open risk on the register.