Governance
AI governance
Definition
AI governance is the set of controls, records, and accountable owners that determine which AI systems may operate, on what data, with what authority, and who answers when one is wrong.
Governance fails when it is written as principles and succeeds when it is written as controls attached to named owners. The useful artefacts are an inventory of deployed systems, a stated delegation boundary for each, evidence that the boundary is tested, and a route for escalation that people actually use. A governance program judged by the quality of its policy document rather than the quality of its evidence will not survive its first serious audit.
Inventory before policy
You cannot govern a system you have not listed. Most organizations discover during their first inventory that the number of live AI systems is several times what the policy document assumed, because tools were adopted department by department without a central registration requirement. Writing a governance policy before completing that inventory is designing controls for a population of systems you have not actually counted, which means the policy is guaranteed to miss coverage on systems nobody knew to include. The inventory is unglamorous work, but it is the load-bearing step every subsequent control depends on.
Evidence, not attestation
A regulator, an auditor, or a plaintiff's counsel will ask what the system did in a specific case, on a specific date, using specific inputs. That question is answered by logs, reason codes, and eval records — not by a policy stating that the system is used responsibly, however well the policy is written. Organizations that can produce the specific answer quickly tend to have built logging and retention into the system from the start; those that cannot are usually discovering, in the middle of the request, that the record they need was never captured.
Owners, not committees
A governance committee that meets quarterly cannot answer an incident question at 2pm on a Tuesday. Each system needs a named individual accountable for its performance and its controls, whose job includes knowing the current eval result and the current escalation rate without having to ask around. Committees are useful for setting policy and resolving disputes between owners; they are the wrong structure for day-to-day accountability, and organizations that rely on committee ownership tend to have the slowest incident response when something actually goes wrong.
In practice
- Maintain a live inventory with an accountable owner per system
- Attach a written delegation boundary and eval record to each entry
- Retain decision traces long enough to answer a case-level question
- Assign a named owner per system, not a standing committee
