Scope
AI risk can arise from data, model behavior, prompts, tools, integrations, users, automated actions, suppliers, and the business decision that relies on the output.
Governance questions
- What use is authorized and who owns it?
- Which data may enter the system?
- What decisions may the system influence or perform?
- How are outputs evaluated and challenged?
- What security boundaries, logging, and access controls apply?
- How are incidents, drift, misuse, and vendor changes handled?
Security integration
AI governance should connect to identity, data protection, secure development, third-party risk, incident response, privacy, legal review, and change management rather than becoming an isolated committee.
Avoid two extremes
Treating AI as ordinary software can miss model-specific behavior and data risks. Treating it as completely unprecedented can delay practical controls that already exist.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: