AI Governance, Risk & Compliance
The frameworks and roles that keep AI accountable

AI Center of Excellence (AI CoE)

• A centralized team/function that sets policies, standards, and best practices for AI adoption across an organization.

Key Roles

• Data Scientist — builds and evaluates models.
• AI/ML Engineer — develops and trains ML systems.
• MLOps Engineer — operationalizes, deploys, and monitors models in production.
• Platform Architect/Engineer — designs the infrastructure AI systems run on.
• Security Architect/Engineer — designs and implements security controls for AI systems.
• AI Governance / Risk / Audit roles — oversee policy compliance, risk assessment, and audits.
• Data Engineer — builds and maintains data pipelines feeding AI systems.

Responsible AI Principles

• Fairness, reliability & safety, transparency, privacy & security, explainability, inclusiveness, accountability, consistency, awareness.

Key Risks

• Bias introduction — unfair or skewed outputs from training data or design.
• Accidental leakage — sensitive data unintentionally exposed in model outputs.
• Reputational loss — damage from AI failures or controversies.
• Performance risk — models degrading or underperforming over time.
• IP risk — intellectual property exposure or infringement via AI tools.
• Autonomous systems risk — risks from systems acting with reduced human oversight.

Shadow IT / Shadow AI

• Use of AI tools or models that haven't been approved or reviewed by the organization's governance team.

• EU AI Act — risk-tiered regulation (unacceptable, high, limited, minimal risk) with corresponding legal obligations.
• OECD / ISO standards, including ISO/IEC 42001 — international standard for AI management systems.
• NIST AI Risk Management Framework — four core functions: Govern, Map, Measure, Manage (mnemonic: "GMMM").
• Corporate policy considerations — sanctioned vs. unsanctioned tools, private vs. public models, governance of sensitive data.
• Third-party compliance evaluations — assessing vendors before integrating their AI into regulated workflows.
• Data sovereignty — legal requirements that data be stored/processed within specific national borders.