The base layer of AI governance: legal requirements, trustworthy AI policy, risk tolerance, transparent documentation, periodic review, the AI inventory and decommissioning.
Understanding, managing and documenting the laws and regulations that apply to an organization's AI: tracking sector and use-specific requirements, aligning risk management to them and training staff on them. It is the legal baseline the other GOVERN 1 policies build on.
Building the characteristics of trustworthy AI into organizational policies, processes, procedures and practices, including what an AI risk management policy should cover, from key definitions and data standards to testing, monitoring, whistleblowing and incident response.
Processes for deciding how much risk management each AI system needs based on the organization's risk tolerance: impact and likelihood scales, risk tiers, and uniform scoring across the AI portfolio.
Making the AI risk management process and its outcomes transparent through documented policies, procedures and controls tied to risk priorities: standardized model documentation, a documentation inventory and rules for public disclosure.
Planning ongoing monitoring and periodic review of the AI risk management process, with clear roles and a defined review frequency, plus AI incident response and feedback, recourse and opt-out mechanisms for affected people.
Keeping an inventory of AI systems that is resourced according to risk priorities: who maintains it, which models and systems are in scope, and which attributes each entry records.
Decommissioning and phasing out AI systems safely, without increasing risk or reducing trust: dependencies, data retention, preserved artifacts and migration to a replacement system.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.