AI Governance

Q.1 What is AI governance?

AI governance refers to the frameworks, policies, processes, and controls organizations put in place to ensure AI systems are developed and used responsibly, ethically, legally, and safely — covering things like risk management, accountability, transparency, and compliance with regulations.

Report This Question

Q.2 Why is AI governance important for organizations?

It helps organizations manage legal/regulatory risk, build public trust, avoid harms like bias or privacy violations, ensure accountability when things go wrong, and align AI use with ethical principles and business values.

Report This Question

Q.3 What is the difference between AI governance and AI ethics?

AI ethics deals with the principles and values guiding what is "right" or "responsible" in AI development and use (e.g., fairness, transparency). AI governance is the practical implementation layer — the policies, structures, and processes that operationalize those ethical principles within an organization.

Report This Question

Q.4 What is the EU AI Act, in simple terms?

It's a European Union regulation that classifies AI systems by risk level (unacceptable, high, limited, minimal) and imposes corresponding obligations — ranging from outright bans on certain uses to strict compliance requirements for high-risk systems, and lighter transparency obligations for lower-risk ones.

Report This Question

Q.5 What does "risk-based approach" mean in AI regulation?

It means regulatory requirements scale with the level of potential harm an AI system could cause — higher-risk applications (e.g., in healthcare, hiring, law enforcement) face stricter obligations, while low-risk applications face minimal or no additional requirements.

Report This Question

Q.6 What is meant by "bias" in an AI system?

Bias refers to systematic errors or unfair outcomes in an AI system's predictions or decisions, often stemming from unrepresentative training data, flawed model design, or historical inequalities embedded in the data, which can lead to discriminatory outcomes against certain groups.

Report This Question

Q.7 What is meant by "transparency" in AI governance?

Transparency means making an AI system's purpose, capabilities, limitations, and decision-making process understandable to relevant stakeholders — including users, regulators, and affected individuals — so they can understand how and why decisions are made.

Report This Question

Q.8 What is an AI system inventory, and why would an organization maintain one?

It's a centralized record of all AI systems an organization develops, deploys, or uses, including details like purpose, risk level, data used, and owner. It's maintained to enable oversight, risk assessment, and regulatory compliance across the organization.

Report This Question

Q.9 What role does "human oversight" play in AI governance?

Human oversight ensures a person can monitor, intervene in, or override an AI system's decisions or actions, especially in high-stakes contexts — acting as a safeguard against fully autonomous errors or harms going unchecked.

Report This Question

Q.10 What is meant by "accountability" in the context of AI governance?

Accountability means clearly assigning responsibility for an AI system's decisions and outcomes — identifying who is responsible for its design, deployment, monitoring, and any harms it causes — so there's a clear chain of ownership rather than diffused or absent responsibility.

Report This Question

Q.11 What is the NIST AI Risk Management Framework (AI RMF), and what are its core functions?

It's a voluntary U.S. framework providing guidance for managing risks in AI systems throughout their lifecycle. Its four core functions are: Govern (establish culture and policies), Map (understand context and risks), Measure (assess and track risks), and Manage (prioritize and respond to risks).

Report This Question

Q.12 Explain the difference between "high-risk" and "limited-risk" AI systems under the EU AI Act.

High-risk systems (e.g., those used in employment, credit scoring, critical infrastructure, law enforcement) are subject to strict obligations — conformity assessments, risk management systems, documentation, human oversight, and registration. Limited-risk systems (e.g., chatbots, deepfake generators) mainly face transparency obligations, such as disclosing that a user is interacting with AI or that content is AI-generated.

Report This Question

Q.13 What is a Data Protection Impact Assessment (DPIA), and when is it required?

A DPIA is a structured process to identify and mitigate privacy risks in a project involving personal data processing. Under regulations like GDPR, it's required when processing is likely to result in high risk to individuals' rights — which often applies to AI systems doing large-scale profiling or automated decision-making.

Report This Question

Q.14 What is an AI Impact Assessment, and how does it differ from a DPIA?

An AI Impact Assessment evaluates broader risks and impacts of an AI system — including fairness, safety, societal, and legal impacts — not just privacy. A DPIA is narrower, focused specifically on personal data protection risks, whereas an AI Impact Assessment covers the full spectrum of potential harms from an AI system.

Report This Question

Q.15 What is "algorithmic accountability," and how can organizations demonstrate it?

Algorithmic accountability means an organization can explain, justify, and take responsibility for the outcomes of its algorithms. Organizations demonstrate it through documentation (model cards, data sheets), audit trails, impact assessments, clear ownership structures, and mechanisms for redress when harm occurs.

Report This Question

Q.16 What is model documentation (e.g., "model cards"), and why is it important for governance?

Model cards are structured documents describing a model's intended use, training data, performance metrics, limitations, and known risks. They're important because they enable informed decision-making by downstream users, support auditability, and help ensure the model is used appropriately and within its intended scope.

Report This Question

Q.17 What is the difference between explainability and interpretability in AI systems?

Interpretability refers to how inherently understandable a model's internal mechanics are (e.g., a decision tree is interpretable by design). Explainability refers to the ability to provide after-the-fact explanations of a model's outputs, even if the model itself (e.g., a deep neural network) is a "black box" — often via techniques like SHAP or LIME.

Report This Question

Q.18 What are the "three lines of defense" model as applied to AI governance?

1st line: business/operational teams building and deploying AI, responsible for day-to-day risk management. 2nd line: risk, compliance, and governance functions setting policy and providing oversight. 3rd line: internal audit, providing independent assurance that controls are effective. This structure ensures layered accountability.

Report This Question

Q.19 What is meant by "algorithmic auditing"?

It's the systematic review and testing of an AI system to evaluate its performance, fairness, robustness, and compliance with policies/regulations — often conducted by an independent party — to identify issues like bias, drift, or non-compliance before or after deployment.

Report This Question

Q.20 What is "data governance," and how does it relate to AI governance?

Data governance is the management of data quality, lineage, access, and usage policies across an organization. It underpins AI governance because AI systems are only as trustworthy as the data they're trained and evaluated on — poor data governance leads to biased, inaccurate, or non-compliant AI outcomes.

Report This Question

Q.21 What is the purpose of an AI ethics board or AI governance committee?

It provides cross-functional oversight (legal, technical, ethical, business) for AI initiatives — reviewing high-risk projects, setting policy, resolving ethical dilemmas, and ensuring AI development aligns with organizational values and regulatory requirements.

Report This Question

Q.22 What does "conformity assessment" mean under the EU AI Act?

It's a formal process (self-assessment or third-party assessment, depending on system type) to verify that a high-risk AI system meets the regulatory requirements — around risk management, data quality, documentation, transparency, and human oversight — before it can be placed on the market.

Report This Question

Q.23 What is "purpose limitation," and why does it matter for AI systems?

Purpose limitation is a principle (rooted in data protection law) stating data/AI systems should only be used for the specific purpose they were designed/collected for. It matters because reusing an AI system or its training data for unrelated purposes can introduce unforeseen risks, bias, or legal violations.

Report This Question

Q.24 What is model drift, and why is it a governance concern?

Model drift occurs when a model's performance degrades over time because the real-world data distribution shifts away from the training data. It's a governance concern because an unmonitored model may silently produce increasingly inaccurate or unfair decisions without anyone noticing.

Report This Question

Q.25 What is the role of a "responsible AI" framework within a company?

It's an internal set of principles, policies, and processes (e.g., fairness checks, review gates, escalation paths) that guide how AI is designed, developed, and deployed responsibly across the organization, translating high-level ethical commitments into operational practice.

Report This Question

Q.26 How would you explain "informed consent" in the context of AI systems processing personal data?

Informed consent means individuals are clearly told how their data will be used by an AI system (e.g., for profiling, automated decisions) and voluntarily agree to it, with the ability to withdraw consent — requiring transparent, specific, and understandable disclosures rather than buried legal jargon.

Report This Question

Q.27 What is meant by "explainable AI" (XAI), and give an example use case where it's critical.

XAI refers to methods and techniques that make an AI model's decisions understandable to humans. It's critical in use cases like loan approval or medical diagnosis, where affected individuals and regulators need to understand why a particular decision was made, both for trust and legal compliance (e.g., right to explanation).

Report This Question

Q.28 What are some key differences between the EU AI Act and the U.S. approach to AI regulation?

The EU AI Act is a comprehensive, binding, risk-tiered regulation with specific compliance obligations and penalties. The U.S. approach has historically been more fragmented — relying on sector-specific regulations, executive orders, and voluntary frameworks like NIST AI RMF — with less centralized, binding legislation (though this landscape evolves and should be checked for current status).

Report This Question

Q.29 What is a "model card" versus a "datasheet for datasets"? How do they differ?

A model card documents a trained model's intended use, performance, and limitations. A datasheet for datasets documents the dataset itself — its composition, collection process, potential biases, and recommended uses — providing transparency at the data layer rather than the model layer.

Report This Question

Q.30 What is meant by "AI system lifecycle," and why does governance need to address every stage?

The AI lifecycle spans design, data collection, development, testing, deployment, monitoring, and decommissioning. Governance must address every stage because risks emerge at each phase (e.g., biased data at collection, drift during deployment) — a governance framework focused only on pre-deployment review misses ongoing risks.

Report This Question

Q.31 How would you design a risk classification framework for AI systems within a large enterprise, given regulatory frameworks may differ across jurisdictions?

Start with a common internal risk taxonomy (e.g., minimal/limited/high/unacceptable) mapped to multiple regulatory regimes (EU AI Act, sector-specific rules, NIST AI RMF), tag each AI use case with jurisdiction-specific flags, and build a "highest common denominator" compliance baseline for systems deployed across regions, while allowing jurisdiction-specific add-on controls where stricter local rules apply.

Report This Question

Q.32 How would you operationalize "human oversight" requirements for a high-risk AI system in a way that's meaningful rather than a rubber-stamp?

Design oversight touchpoints where the human genuinely has the authority, time, information, and competence to intervene — not just a button to click. This means providing interpretable outputs, setting realistic review time budgets (not overloading reviewers with volume), training reviewers on the system's limitations, and auditing override rates to detect automation bias (humans reflexively approving AI recommendations).

Report This Question

Q.33 How would you design an ongoing monitoring program to detect bias drift in a deployed high-risk AI system?

Establish baseline fairness metrics (e.g., demographic parity, equal opportunity) at deployment, set up automated periodic re-evaluation against fresh production data with the same metrics, define alert thresholds for significant deviation, and incorporate a feedback loop where flagged drift triggers a formal review/retraining process rather than just passive logging.

Report This Question

Q.34 Discuss the challenge of applying "right to explanation" requirements to deep learning models, and how you'd address it practically.

Deep learning models are often black-box, making direct mechanistic explanation infeasible. Practical approaches include post-hoc explainability techniques (SHAP, LIME, counterfactual explanations), providing simplified surrogate explanations for affected individuals, documenting known limitations of these explanation methods, and in some cases opting for inherently interpretable models in high-stakes contexts where explanation is legally mandated and post-hoc methods are deemed insufficient.

Report This Question

Q.35 How would you structure accountability when an AI system is built using a third-party foundation model (e.g., via API) but deployed by your organization for a custom use case?

Establish clear contractual delineation of responsibilities (model provider vs. deployer obligations under regulations like the EU AI Act, which distinguishes "provider" and "deployer" roles), conduct due diligence on the foundation model's documentation/known limitations, implement your own testing/monitoring for your specific use case, and maintain internal accountability for how the model is fine-tuned, prompted, and deployed even though you didn't build the base model.

Report This Question

Q.36 What are the key challenges in auditing a generative AI system (e.g., an LLM) compared to auditing a traditional classification model?

Generative outputs are open-ended and harder to benchmark against a single "ground truth," making traditional accuracy metrics less applicable. Challenges include evaluating hallucination rates, harmful/toxic content generation across a vast output space, consistency across prompts, emergent behaviors not present in smaller/related models, and the difficulty of exhaustively testing all possible inputs — requiring red-teaming, sampling-based evaluation, and continuous monitoring rather than one-time certification.

Report This Question

Q.37 How would you design a governance process to manage the risk of "shadow AI" — employees using unsanctioned AI tools?

Combine policy (clear acceptable use guidelines) with technical controls (network monitoring, approved-tool allowlists, DLP tools to detect sensitive data exfiltration to external AI services), provide sanctioned alternatives so employees aren't forced to use unapproved tools out of necessity, and run periodic audits/employee surveys to detect unsanctioned usage, treating discovery as an opportunity to educate rather than solely punitive enforcement.

Report This Question

Q.38 How would you reconcile conflicting requirements between GDPR's data minimization principle and an AI model's need for large, diverse training datasets to reduce bias?

Use techniques like synthetic data generation, differential privacy, and federated learning to reduce raw personal data exposure while still achieving diverse training coverage; apply purpose-specific data collection scoped tightly to the model's stated use; and document a documented risk-based justification balancing the need for representativeness against data minimization, potentially anonymizing/pseudonymizing where full identifiers aren't needed for bias mitigation.

Report This Question

Q.39 Design an incident response plan specifically tailored for AI system failures (e.g., a biased hiring algorithm causing discriminatory rejections).

Establish detection mechanisms (monitoring, user complaints, audit flags), a rapid triage process to assess scope and severity, immediate mitigation (e.g., pausing the system or reverting to human review), root cause analysis (data, model, or deployment issue), remediation for affected individuals (e.g., re-review of rejected applications), regulatory notification if required, and a post-incident review feeding lessons back into the governance framework to prevent recurrence.

Report This Question

Q.40 How would you evaluate whether a vendor's "AI compliance" claims (e.g., "our AI is GDPR/EU AI Act compliant") are credible during procurement?

Request concrete evidence: conformity assessment certificates (for high-risk EU AI Act systems), independent audit reports, model cards/documentation, details on training data provenance and bias testing, contractual liability terms, and right-to-audit clauses. Avoid taking marketing claims at face value — cross-check claims against the actual regulatory requirements for your specific use case and risk tier, since vendor claims of "compliance" don't always map to your specific deployment context.

Report This Question

Q.41 How would you design metrics to measure the "fairness" of an AI system when different fairness definitions (e.g., demographic parity vs. equalized odds) can be mathematically incompatible?

Acknowledge upfront that no single fairness metric works universally — select the definition(s) most relevant to the specific harm and legal context (e.g., equalized odds for outcomes where false negative/positive rate parity matters, demographic parity where equal representation in outcomes is the legal standard), document the trade-off rationale explicitly, and involve legal/ethics stakeholders in the choice rather than leaving it purely to data scientists, since it's a normative decision, not just a technical one.

Report This Question

Q.42 How should an organization approach governance for "agentic" AI systems that can autonomously take actions (e.g., execute transactions, send communications) as opposed to simple predictive models?

Apply stricter oversight proportional to the autonomy and reversibility of actions — mandatory human approval gates for high-impact/irreversible actions, sandboxed testing environments before production deployment, real-time monitoring/circuit breakers to halt runaway behavior, clear tool/permission scoping, and updated risk assessments that account for compounding errors across multi-step autonomous action chains (not just single-prediction risk).

Report This Question

Q.43 Discuss how you would handle cross-border data transfer requirements when training a global AI model that ingests data from multiple jurisdictions with differing privacy laws.

Map data flows and applicable regimes (e.g., GDPR's transfer mechanisms like Standard Contractual Clauses, adequacy decisions), consider data localization/regional model training where legally required, use privacy-enhancing technologies (federated learning, on-device processing) to avoid centralizing raw data unnecessarily, and maintain a data lineage record demonstrating compliance for each jurisdiction's data used in training.

Report This Question

Q.44 How would you design a governance framework to prevent "automation bias" among employees who rely on AI-assisted decision tools?

Include explicit uncertainty/confidence indicators in tool outputs, train staff on the tool's known failure modes and limitations, mandate periodic "blind" review exercises where employees make decisions without AI assistance to compare against AI-assisted outcomes, audit override rates (very low override rates can signal automation bias rather than high AI accuracy), and structure incentives so employees aren't penalized for disagreeing with the AI when justified.

Report This Question

Q.45 What is the concept of "AI liability," and how might it be allocated between model developers, deployers, and end users?

AI liability concerns who bears legal/financial responsibility when an AI system causes harm. Allocation typically depends on role and control: developers may bear responsibility for fundamental model flaws/inadequate testing, deployers for improper implementation or lack of oversight in their specific context, and end users for misuse outside intended parameters — often formalized through contracts, indemnification clauses, and emerging AI-specific liability regimes (e.g., proposed EU AI Liability Directive concepts), though this remains a developing legal area requiring current research.

Report This Question

Q.46 How would you structure a governance program that scales across an organization with hundreds of AI use cases at varying risk levels, without creating a compliance bottleneck?

Implement a tiered review process: lightweight self-assessment/checklist for low-risk use cases, moderate review for medium-risk, and full governance committee review with formal impact assessments only for high-risk systems. Automate intake triage (e.g., a questionnaire that auto-classifies risk tier), maintain a central AI inventory for visibility, and empower business units with clear guardrails/playbooks so they can self-serve on low-risk decisions rather than escalating everything centrally.

Report This Question

Q.47 Discuss the tension between model transparency (e.g., open-sourcing models/weights) and security/misuse risk — how would a governance framework address this?

Weigh the benefits of transparency (external audit, trust, innovation) against misuse risk (e.g., enabling malicious fine-tuning, bypassing safety training). A tiered release strategy can help — staged release, structured access (researcher-only APIs before full open release), red-teaming before broader release, and use-case-specific risk assessments (a text model has different misuse risk than a bio-design model) rather than a one-size-fits-all transparency policy.

Report This Question

Q.48 How would you approach governance for AI systems that are continuously learning/updating in production (as opposed to static, periodically retrained models)?

Continuous learning systems need real-time monitoring rather than point-in-time certification, versioning/rollback capability to revert problematic updates, guardrails to prevent the model from learning from poisoned/adversarial inputs, defined thresholds that trigger human review before an update goes live, and a re-certification process if governance frameworks (like EU AI Act conformity assessments) require re-assessment after "substantial modification."

Report This Question

Q.49 What role should red-teaming play in an AI governance program, and how would you institutionalize it (versus a one-off exercise)?

Red-teaming should be a recurring, structured practice — not a one-time pre-launch check — integrated into the release cycle for significant model updates, with defined scope (safety, bias, security, misuse scenarios), diverse internal/external red-team composition to avoid blind spots, documented findings feeding into a remediation tracking system, and periodic re-testing as the model or its usage context evolves.

Report This Question

Q.50 How would you design governance to address the risk of "model collapse" or quality degradation from AI systems increasingly trained on AI-generated (synthetic) data?

Implement data provenance tracking to distinguish human-generated from AI-generated data in training pipelines, set policies limiting the proportion of synthetic data used (or requiring quality-filtering/curation of synthetic data), maintain benchmark datasets of verified human-generated data for ongoing quality comparison, and monitor for degradation signals (loss of diversity, increasing repetitive patterns) as part of regular model evaluation before and after retraining.

Report This Question