All courses / AI Governance / Module 6 / Chapter 25
Learning objectives
After the lesson the participant can:
- Explain the three terms of the thesis: codified, evidenced and proportionate.
- State the eight cross-cutting conclusions and the chapter each rests on.
- Analyse one pair of conclusions that reinforce each other and one pair that conflict, with the recorded resolution.
- Draft a first-90-days plan with workstreams, evidence, due days and success measures.
Key concepts
- Codified, evidenced, proportionate
- Codified: intent, policy, decision rights and boundaries are artefacts a pipeline can check. Evidenced: proof of a control is generated by the systems that operate it. Proportionate: the weight of governance follows usage mode and risk tier.
- Eight cross-cutting conclusions
- The usage mode sets the governance; classification is triggered by change; decisions are tiered and evidence-driven; sovereignty is a risk-tiered choice; the contract is a deployer's main control; oversight is designed; evidence is a by-product of delivery; containment of agents must not depend on intent.
- Conclusions as a chain
- Triggered classification determines which obligations apply; evidence produced by delivery lets a forum decide on evidence it did not prepare; designed oversight and containment make autonomy affordable, because the worst case is bounded and those who can stop the system are named.
- Containment that does not depend on intent
- Instructions lower the rate of unwanted behaviour, but only boundaries cap its consequences: task-scoped credentials, default-deny egress, logs outside the workload's reach, and a stop path outside the system held by named people who may act alone.
- First, next, later
- Three horizons: in 0 to 6 months know what is in use, classify it and know who decides; in 6 to 18 months make high-risk systems ready for 2 December 2027 and the estate replaceable; in 18 to 36 months make assurance continuous and expand autonomy on evidence.
Interactive exercises
Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.
Interactive exercise 1 · Match
Each conclusion in the two organisations
Match each cross-cutting conclusion with the illustration the chapter gives for Nordvik Region or Hansa Mutual.
Interactive exercise 2 · Scenario
An overreach signal and a proposed instruction
Apply the chapter's conclusion that containment of agents must not depend on intent.
Teaching plan
| 10 min | Opening: participants write the thesis of the course in one sentence from memory; the teacher compares the answers with the chapter's wording. |
| 25 min | Eight pairs take one conclusion each and present it in two minutes: the claim, the chapter behind it and what it means for Nordvik Region and for Hansa Mutual. |
| 15 min | Teacher-led analysis of how the conclusions reinforce and conflict, the three tensions revisited, and what the chapter treats as close to certain and what rests on fewer sources. |
| 30 min | Exercise: each participant drafts a first-90-days plan for their own organisation in the form of the chapter's programme plan. |
| 10 min | Closing round: each participant names the first artefact they will create on returning to work and who will approve it. |
Discussion
- Tiered governance pulls against the speed of a stop, so stop authority is delegated in advance. Which other pair of conclusions conflicts most sharply in your organisation, and how is the conflict resolved today?
- The chapter says none of this is novel, and that is the point. If the practices are familiar, why do AI programmes so often fail to apply them?
- The two organisations are fictional and illustrate the application of the evidence, not additional evidence. How should a reader use the worked examples when arguing for change in a real organisation?
Written exercise
Exercise · 30 minutes
A first-90-days plan
Write a first-90-days plan for your own organisation in the form of the chapter's programme plan. Name the approving body and, if relevant, the jurisdictions. Define four workstreams, each with an identifier, the usage modes it covers, the outcome, the evidence file or record that proves it, and a due day. Cover at least: an inventory built from deployments and supplier notices with each entry's usage mode; classification with triggers wired to change; a decision-tier file with the owner of every high-risk system and named stop holders for every system that acts; and one workstream specific to your situation, such as supplier evidence gaps or market overlays. Add two success measures expressed as percentages, and one sentence on what the plan deliberately does not try to achieve.
Deliverable: A programme plan with approver, four workstreams with modes, outcome, evidence and due day, two success measures and a stated limit.
Self-test
Choose an answer to see whether it is right, or open the answer below each question.
What does proportionate mean in the book's thesis?
Show the answer
A. The weight of governance follows usage mode and risk tier
The thesis is that AI governance is effective when it is codified, evidenced and proportionate to usage mode and risk. Proportionate means that the weight of governance follows usage mode and risk tier.How does the chapter resolve the conflict between evidence and data minimisation?
Show the answer
B. By logging identifiers and hashes and enforcing retention by configuration
Article 12 of the AI Act requires lifetime logging for high-risk systems while the GDPR requires that personal data be kept no longer than necessary. Chapter 11's design logs identifiers and hashes and enforces retention by configuration.Which actions belong to the first horizon, 0 to 6 months, in the chapter's phased programme?
Show the answer
D. Build the inventory with usage modes, classify, write the decision-tier file and name stop holders
First: know what is in use, classify it and know who decides, including named stop holders and the containment baseline for agents. Contracts, impact assessments and a second source come next; continuous assurance and expanded autonomy come later.