AI Governance & Compliance
AI governance encompasses the policies, processes, and structures that ensure AI systems are developed and deployed responsibly, ethically, and in compliance with regulations. As AI adoption accelerates, organizations face growing scrutiny around bias, transparency, accountability, safety, and regulatory compliance.
The regulatory landscape is evolving rapidly. The EU AI Act establishes risk-based requirements for AI systems. The US Executive Order on AI mandates safety testing and transparency. Emerging frameworks like NIST AI Risk Management Framework and ISO/IEC 42001 provide governance standards. Organizations must build governance structures that can adapt to changing regulations.
The EU AI Act classifies AI systems into four risk categories, each with different compliance requirements. Understanding your system's classification is the first step in building a compliance program.
| Risk Level | Examples | Requirements |
|---|---|---|
| Unacceptable | Social scoring, real-time biometric surveillance, manipulative systems | Prohibited outright |
| High | Medical devices, credit scoring, hiring, law enforcement, education | Risk management, data governance, transparency, human oversight, accuracy |
| Limited | Chatbots, emotion recognition, deepfakes | Transparency obligations (disclose AI interaction) |
| Minimal | Spam filters, AI-enabled video games, inventory management | No obligations beyond existing law (voluntary codes of conduct) |
warning
An effective AI governance framework includes organizational structures (roles, committees), policies (acceptable use, risk assessment), processes (model review, incident response), and technical controls (monitoring, auditing). The framework should scale with the organization's AI maturity.
| 1 | # AI governance checklist — implement these processes |
| 2 | |
| 3 | # 1. AI Inventory & Classification |
| 4 | ai_systems = [ |
| 5 | { |
| 6 | "name": "customer-chatbot", |
| 7 | "description": "GPT-4 powered customer support chatbot", |
| 8 | "risk_level": "limited", # EU AI Act classification |
| 9 | "data_subjects": ["customers"], |
| 10 | "decision_type": "non-consequential", |
| 11 | "last_review": "2025-01-15", |
| 12 | }, |
| 13 | { |
| 14 | "name": "resume-screener", |
| 15 | "description": "LLM-based resume ranking for hiring", |
| 16 | "risk_level": "high", # EU AI Act classification |
| 17 | "data_subjects": ["applicants"], |
| 18 | "decision_type": "consequential", # Employment decisions |
| 19 | "last_review": "2025-02-01", |
| 20 | "bias_audit_required": True, |
| 21 | "human_oversight": "mandatory", |
| 22 | }, |
| 23 | ] |
| 24 | |
| 25 | # 2. Model Risk Assessment template |
| 26 | def assess_model_risk(model_card): |
| 27 | assessment = { |
| 28 | "model_name": model_card["name"], |
| 29 | "intended_use": model_card["intended_use"], |
| 30 | "out_of_scope_uses": model_card.get("out_of_scope_uses", []), |
| 31 | "risk_factors": { |
| 32 | "bias": evaluate_bias(model_card), |
| 33 | "hallucination_rate": evaluate_hallucinations(model_card), |
| 34 | "jailbreak_resistance": evaluate_jailbreaks(model_card), |
| 35 | "data_privacy": evaluate_data_leakage(model_card), |
| 36 | }, |
| 37 | "mitigations": [ |
| 38 | "Content filter deployed", |
| 39 | "Human review for high-stakes outputs", |
| 40 | "Rate limiting on API", |
| 41 | ], |
| 42 | "approval_status": "pending_review", |
| 43 | "reviewer": None, |
| 44 | } |
| 45 | return assessment |
| 46 | |
| 47 | # 3. Incident Response Playbook |
| 48 | # Detection -> Triage -> Containment -> Investigation -> Remediation -> Post-mortem |
Bias auditing evaluates model outputs across demographic groups to identify disparate impact. Fairness metrics include demographic parity, equal opportunity, and equalized odds. Auditing should occur at multiple stages: pre-training (dataset analysis), post-training (evaluation), and deployment (ongoing monitoring).
| 1 | # Bias auditing for LLM outputs |
| 2 | from datasets import Dataset |
| 3 | import pandas as pd |
| 4 | from sklearn.metrics import accuracy_score |
| 5 | |
| 6 | # 1. Evaluate across demographic groups |
| 7 | test_cases = [ |
| 8 | {"prompt": "Complete: The doctor said", "demographic": "gender"}, |
| 9 | {"prompt": "Write a recommendation for", "demographic": "race"}, |
| 10 | # ... comprehensive test set |
| 11 | ] |
| 12 | |
| 13 | # 2. Measure fairness metrics |
| 14 | def demographic_parity(results, protected_attribute): |
| 15 | """Check if positive outcome rate is equal across groups.""" |
| 16 | groups = results.groupby(protected_attribute) |
| 17 | rates = groups["positive_outcome"].mean() |
| 18 | max_diff = rates.max() - rates.min() |
| 19 | return max_diff < 0.1 # Threshold (domain-specific) |
| 20 | |
| 21 | def equal_opportunity(results, protected_attribute): |
| 22 | """Check if true positive rate is equal across groups.""" |
| 23 | for group in results[protected_attribute].unique(): |
| 24 | subset = results[results[protected_attribute] == group] |
| 25 | tpr = subset[subset["label"] == 1]["prediction"].mean() |
| 26 | print(f"{group}: TPR = {tpr:.3f}") |
| 27 | |
| 28 | # 3. Dataset composition audit |
| 29 | def audit_dataset(dataset_path): |
| 30 | df = pd.read_parquet(dataset_path) |
| 31 | demographic_cols = ["gender", "race", "age_group"] |
| 32 | for col in demographic_cols: |
| 33 | if col in df.columns: |
| 34 | counts = df[col].value_counts(normalize=True) |
| 35 | print(f"{col} distribution:") |
| 36 | for group, pct in counts.items(): |
| 37 | print(f" {group}: {pct:.1%}") |
| 38 | # Flag if any group < 5% representation |
| 39 | underrep = counts[counts < 0.05] |
| 40 | if not underrep.empty: |
| 41 | print(f" ⚠ Underrepresented: {list(underrep.index)}") |
- AI governance requires organizational structures, policies, and technical controls working together
- EU AI Act risk classification determines compliance requirements — classify your systems early
- Bias auditing must be continuous, not a one-time exercise before deployment
- Maintain an AI system inventory with risk assessments and review schedules
- Build incident response plans specific to AI failures (hallucinations, bias, security breaches)
Community
Get help on Slack, Discord or VIP
Stuck on a guide? Join the community and ask.