Start here
AI Governance in plain language
Governance turns “someone should check this” into an assigned responsibility and a recorded decision. It applies to purchased AI tools as well as internally built models.
The process should fit the use. Drafting an internal announcement and automatically changing customer entitlements warrant different scrutiny. A framework can organise risk management, but following a checklist does not by itself establish legal compliance.
How it works
An approval is the start of oversight
A practical governance lifecycle
- Register + assign
Record the use, data, owner and affected users.
- Evaluate + decide
Review evidence and set release conditions.
- Monitor + respond
Track incidents, review changes and retire when needed.
A material change or incident returns the use to evaluation.
Keep an inventory
Record the purpose, provider, data categories and accountable owner for each use.
Make the release decision explicit
Document the tests, limitations and conditions under which the system can operate.
Maintain a response path
Assign incident handling, change review and shutdown responsibility. Make the route usable by the people who encounter failures.
Illustrative example · Fictional data
Approving a fictional knowledge assistant
- Input
- A team proposes an assistant over internal product documentation, with no permission to edit records.
- Process
- The owner records the permitted document set, access tests, answer-quality tests and escalation route. Release is limited to the tested user group.
- Expected output
- A short approval record naming the owner, scope, evidence, unresolved limitations and review trigger.
- How to check it
- Adding customer documents or write tools changes the approved scope. The original approval should not silently cover those new capabilities.
Where it helps
- Assigning accountability for purchased or built AI systems.
- Making release decisions traceable.
- Managing incidents and material changes after launch.
Governance, implementation and compliance
- Governance
- Defines ownership, decision rights and oversight.
- Implementation
- Builds and operates the controls and tests required by those decisions.
- Compliance
- Assesses applicable obligations. Governance supports it but is not proof of it.
What a model card and a bias audit should contain
A model card records the model/version, intended uses, unsuitable uses, data context, evaluation results and known limitations. For an AI application, supplement it with prompts, retrieval sources, tools, permissions and human-review rules. A polished document is not a substitute for test evidence or a named owner.
A bias audit should identify affected groups, data coverage, label quality, relevant error rates, sample sizes, threshold choices and appeal routes. Record unresolved findings, who accepts residual risk and what change triggers another review. Preserve the dataset and model versions so the result can be reproduced.
India and sector context: establish applicability
For an India-based deployment, identify whether personal data is processed, which entity controls the processing, where data goes and which sector supervises the activity. Review the DPDP Act and notified rules together with their commencement provisions; do not assume every obligation took effect on one date.
Banking, insurance, securities and health uses can involve different authorities, contracts and domain requirements. A voluntary risk framework does not replace applicable law, and an AI use case is not automatically compliant because a vendor has a certification. Obtain an applicability review for the actual system and jurisdiction.
Related reading and learning pathways
Common pitfalls
- A policy without an owner or enforcement path is difficult to apply.
- One-time approval misses changes in data, models and use.
- A vendor’s assurance does not cover every configuration or downstream workflow.
Put the idea to work
Try it yourself
Create a one-page inventory entry for a fictional assistant: purpose, owner, data, actions, tests, escalation contact role and reassessment trigger.
Common questions
Is governance only for large organisations?
No. A small team can start with a clear owner, inventory, approval criteria and incident process, proportionate to its uses. Even a short register of AI tools in use, with their purpose, data access and owner, helps a small company spot risks early and respond quickly to problems.
Does buying an AI tool transfer all responsibility to the vendor?
No. The organisation still decides how it is configured, what data it receives and how its output is used. Review vendor documentation, data-processing terms and security controls, and set internal rules for acceptable use. Regulators and customers usually hold the deploying organisation accountable for outcomes.
Is NIST AI RMF a legal certification?
No. It is a voluntary risk-management framework, not a certificate that a deployment meets every applicable obligation. Organisations use it to structure how they map, measure and manage AI risks. Legal requirements, such as data protection laws, must be assessed separately.
Your next step
Continue learning
Connected concepts
Sources and further reading
Examples on this page are teaching exercises using fictional information. They are not client case studies or measured outcomes.