AI Governance

AI governance is the operational discipline that applies to any organisation that trains, deploys or procures AI systems. It overlaps with privacy governance (training data is personal data; outputs can be personal data; AI processing is 'automated processing' under GDPR Article 22 and DPDP Section 10) but extends further — into model risk, bias, explainability, human oversight, and the specific regulatory frameworks for AI such as the EU AI Act, the US NIST AI RMF and the Colorado AI Act.

An AI governance programme typically includes: an AI system inventory covering every model in use; a model risk tiering that maps each system to applicable law (EU AI Act 'high-risk' categories, Colorado 'consequential decision' uses, DPDP SDF algorithmic risk assessment); a lifecycle control plane that covers data sourcing, training, validation, deployment, monitoring and decommissioning; and human-in-the-loop requirements for decisions that significantly affect individuals. In privacy-first programmes, the AI governance stack sits alongside — not inside — the privacy stack, with specific hand-offs between them.