AI Governance

AI Governance & Compliance

Overview

AI governance covers the policies, frameworks, and technical controls needed to deploy AI systems responsibly and in compliance with emerging regulations. As the EU AI Act, NIST AI Risk Management Framework, and industry-specific requirements take effect, organizations need structured approaches to AI risk assessment, model auditing, bias detection, and transparency reporting.

When to Use This Skill

• Establishing an AI governance program for an organization
• Conducting risk assessments for AI/ML systems
• Implementing bias detection and fairness testing
• Complying with EU AI Act risk classifications
• Building model audit trails and explainability frameworks
• Creating AI ethics review boards and approval processes

Core Concepts

Regulatory Landscape

EU AI Act Risk Classification

┌─────────────────────────────────────────────────┐
│              Unacceptable Risk                   │
│  Social scoring, real-time biometric mass        │
│  surveillance, manipulation of vulnerable groups │
│  → BANNED                                        │
├─────────────────────────────────────────────────┤
│              High Risk                           │
│  Employment decisions, credit scoring,           │
│  education, law enforcement, healthcare          │
│  → Conformity assessment, auditing, logging      │
├─────────────────────────────────────────────────┤
│              Limited Risk                        │
│  Chatbots, AI-generated content,                │
│  emotion recognition                             │
│  → Transparency obligations                      │
├─────────────────────────────────────────────────┤
│              Minimal Risk                        │
│  Spam filters, AI-enabled games,                │
│  inventory management                            │
│  → No specific obligations                       │
└─────────────────────────────────────────────────┘

NIST AI Risk Management Framework

┌───────────┐     ┌───────────┐     ┌───────────┐     ┌───────────┐
│  GOVERN   │────►│    MAP    │────►│  MEASURE  │────►│  MANAGE   │
│           │     │           │     │           │     │           │
│ Policies, │     │ Context,  │     │ Metrics,  │     │ Respond,  │
│ roles,    │     │ risk ID,  │     │ testing,  │     │ document, │
│ culture   │     │ stakehldrs│     │ monitoring│     │ improve   │
└───────────┘     └───────────┘     └───────────┘     └───────────┘

Implementation Guide

AI Risk Assessment Template

class AIRiskAssessment:
    """Structured risk assessment for AI/ML systems."""

    RISK_CATEGORIES = {
        "bias_discrimination": {
            "description": "System produces unfair outcomes for protected groups",
            "examples": ["Hiring tool disadvantaging women", "Loan model rejecting minorities"],
        },
        "privacy_violation": {
            "description": "System exposes or misuses personal data",
            "examples": ["Training on PII without consent", "Re-identification risk"],
        },
        "safety_harm": {
            "description": "System causes physical or psychological harm",
            "examples": ["Autonomous vehicle misclassification", "Medical misdiagnosis"],
        },
        "transparency_gap": {
            "description": "Stakeholders cannot understand system decisions",
            "examples": ["Black-box credit decisions", "Unexplainable content moderation"],
        },
        "accountability_gap": {
            "description": "No clear ownership for system failures",
            "examples": ["No incident response plan", "No human oversight"],
        },
    }

    def assess(self, system):
        assessment = {
            "system_name": system.name,
            "system_purpose": system.purpose,
            "eu_ai_act_category": self.classify_eu_risk(system),
            "risk_scores": {},
            "mitigations": [],
            "overall_risk": None,
        }

        for category, info in self.RISK_CATEGORIES.items():
            score = self.evaluate_risk(system, category)
            assessment["risk_scores"][category] = {
                "likelihood": score.likelihood,  # 1-5
                "impact": score.impact,          # 1-5
                "risk_level": score.likelihood * score.impact,
                "mitigations": score.mitigations,
            }

        assessment["overall_risk"] = max(
            r["risk_level"] for r in assessment["risk_scores"].values()
        )
        return assessment

Bias Detection Framework

from fairlearn.metrics import MetricFrame, selection_rate, demographic_parity_difference

class BiasDetector:
    """Detect and measure bias across protected attributes."""

    PROTECTED_ATTRIBUTES = ["gender", "race", "age_group", "disability_status"]

    def audit(self, y_true, y_pred, sensitive_features):
        results = {}

        for attribute in self.PROTECTED_ATTRIBUTES:
            if attribute not in sensitive_features.columns:
                continue

            metric_frame = MetricFrame(
                metrics={
                    "selection_rate": selection_rate,
                    "accuracy": lambda y_t, y_p: (y_t == y_p).mean(),
                    "false_positive_rate": lambda y_t, y_p: ((y_p == 1) & (y_t == 0)).sum() / (y_t == 0).sum(),
                },
                y_true=y_true,
                y_pred=y_pred,
                sensitive_features=sensitive_features[attribute],
            )

            results[attribute] = {
                "group_metrics": metric_frame.by_group.to_dict(),
                "demographic_parity_diff": demographic_parity_difference(
                    y_true, y_pred, sensitive_features=sensitive_features[attribute]
                ),
                "max_disparity": metric_frame.difference().max(),
                "passes_threshold": metric_frame.difference().max() < 0.1,  # 80% rule
            }

        return results

    def generate_report(self, audit_results):
        """Generate a human-readable bias audit report."""
        report = []
        for attr, result in audit_results.items():
            status = "PASS" if result["passes_threshold"] else "FAIL"
            report.append(
                f"{attr}: {status} (max disparity: {result['max_disparity']:.3f}, "
                f"demographic parity diff: {result['demographic_parity_diff']:.3f})"
            )
        return "\n".join(report)

Model Card Generator

class ModelCard:
    """Generate model cards for AI transparency and documentation."""

    def generate(self, model_info):
        return {
            "model_details": {
                "name": model_info.name,
                "version": model_info.version,
                "type": model_info.model_type,
                "owner": model_info.team,
                "date_trained": model_info.training_date,
                "framework": model_info.framework,
            },
            "intended_use": {
                "primary_use": model_info.primary_use,
                "out_of_scope": model_info.out_of_scope_uses,
                "users": model_info.intended_users,
            },
            "training_data": {
                "description": model_info.training_data_desc,
                "size": model_info.dataset_size,
                "preprocessing": model_info.preprocessing_steps,
                "known_biases": model_info.known_data_biases,
            },
            "performance": {
                "metrics": model_info.evaluation_metrics,
                "benchmarks": model_info.benchmark_results,
                "disaggregated": model_info.performance_by_group,
            },
            "ethical_considerations": {
                "risks": model_info.identified_risks,
                "mitigations": model_info.risk_mitigations,
                "fairness_report": model_info.bias_audit_results,
            },
            "limitations": model_info.known_limitations,
        }

AI Decision Audit Trail

class AIAuditLogger:
    """Immutable audit trail for AI system decisions."""

    def log_decision(self, decision):
        entry = {
            "timestamp": datetime.utcnow().isoformat(),
            "system_id": decision.system_id,
            "model_version": decision.model_version,
            "input_hash": hashlib.sha256(json.dumps(decision.input, sort_keys=True).encode()).hexdigest(),
            "output": decision.output,
            "confidence": decision.confidence,
            "explanation": decision.explanation,
            "human_override": decision.was_overridden,
            "override_reason": decision.override_reason,
            "affected_individual": decision.subject_id,  # pseudonymized
        }

        # Immutable append-only log
        self.audit_store.append(entry)
        return entry

Governance Checklist

Best Practices

1. Classify all AI systems by risk level before deployment
2. Conduct bias audits on every model that affects individuals
3. Maintain model cards as living documents, updated with each version
4. Log every decision for high-risk AI systems (immutable audit trail)
5. Establish an AI ethics review board with diverse stakeholders
6. Re-test for bias quarterly — data drift can introduce new biases
7. Design for human override — every AI decision should be reversible

Resources

• NIST AI Risk Management Framework
• EU AI Act Full Text
• Fairlearn Library
• Google Model Cards
• ISO/IEC 42001:2023

Changelog