11 AI Governance, Controls and Responsible AI for GRC Professionals

Organizations are rapidly introducing Artificial Intelligence into:

customer services
cybersecurity
software development
HR
finance
marketing
legal operations
risk management
compliance
business analytics
enterprise decision-making

This creates tremendous opportunity.

It also creates new governance questions.

Which AI Systems
Are We Using?

Who Owns Them?

What Data
Do They Use?

What Decisions
Do They Influence?

What Risks
Do They Create?

What Controls
Are Required?

How Do We
Monitor Them?

Who Is
Accountable?

This is where GRC professionals become critical.

AI governance connects:

Business
      +
Technology
      +
Risk
      +
Compliance
      +
Security
      +
Privacy
      +
Responsible AI

The objective is not to prevent AI adoption.

The objective is to ensure AI is:

Authorized

Risk-Assessed

Controlled

Secure

Transparent

Monitored

Accountable

throughout its lifecycle.

Lesson Objectives

By the end of this lesson, you will understand how to:

understand enterprise AI governance.
define AI governance principles.
establish an AI governance operating model.
create AI policies and standards.
build an enterprise AI system inventory.
classify AI systems and use cases.
perform AI risk assessments.
understand AI-specific risks.
establish AI control objectives.
build an AI control library.
govern AI models and data.
establish human oversight.
manage generative AI risks.
govern AI agents.
assess third-party AI providers.
manage AI incidents.
monitor AI systems continuously.
establish AI change management.
collect AI governance evidence.
perform AI assurance.
support AI audits.
understand responsible AI principles.
map AI governance to major frameworks.
understand NIST AI RMF.
understand ISO/IEC 42001.
understand ISO/IEC 23894.
integrate AI governance with enterprise GRC.

1 — What Is AI Governance?

AI Governance is the system of:

Policies

Roles

Responsibilities

Processes

Controls

Standards

Oversight

Monitoring

used to ensure AI systems are developed and used responsibly.

A simplified model is:

AI Use Case
      ↓
Business Purpose
      ↓
Risk Assessment
      ↓
Governance Requirements
      ↓
Controls
      ↓
Deployment
      ↓
Monitoring
      ↓
Human Oversight

2 — Why AI Governance Is a GRC Responsibility

AI creates risks across traditional organizational boundaries.

An AI system may simultaneously create:

Cybersecurity Risk

Privacy Risk

Operational Risk

Legal Risk

Compliance Risk

Third-Party Risk

Model Risk

Reputational Risk

Strategic Risk

No single technical team can govern all of these areas alone.

GRC provides the coordination layer.

3 — AI Governance Is Enterprise Governance

AI governance should not exist as an isolated technology program.

It should connect with:

Enterprise Risk Management

Cybersecurity

Privacy

Compliance

Legal

Internal Audit

Third-Party Risk

Data Governance

Change Management

Incident Management

4 — AI Governance Principles

Organizations should establish approved principles for AI.

Common principles may include:

Accountability

Transparency

Security

Privacy

Fairness

Reliability

Safety

Human Oversight

Traceability

These principles must eventually become:

Principle
      ↓
Policy
      ↓
Control
      ↓
Evidence

Otherwise they remain aspirational statements.

5 — AI Governance Operating Model

A mature operating model may involve:

Board / Executive Oversight
            ↓
AI Governance Committee
            ↓
GRC / Risk / Legal
            ↓
AI System Owners
            ↓
Technology Teams
            ↓
Control Owners

6 — AI Governance Committee

Organizations may establish an:

AI Governance Committee

with representatives from:

Business

Technology

Security

Risk

Compliance

Legal

Privacy

Data

Internal Audit

Its responsibilities may include:

approving governance standards.
reviewing high-risk AI use cases.
resolving risk escalations.
reviewing exceptions.
monitoring material AI risks.
reviewing AI incidents.
overseeing responsible AI.

7 — Roles and Responsibilities

Important roles may include:

AI System Owner

Business Owner

Model Owner

Data Owner

Risk Owner

Control Owner

Security Owner

Privacy Owner

Compliance Owner

One person may perform multiple roles depending on the organization.

8 — RACI for AI Governance

Organizations can define:

Responsible

Accountable

Consulted

Informed

for activities such as:

AI Approval

Risk Assessment

Model Deployment

Data Approval

Security Testing

Monitoring

Incident Response

Retirement

9 — AI Policy

An enterprise AI policy establishes:

What AI
May Be Used

How AI
May Be Used

Who May
Use It

What Controls
Are Required

10 — AI Policy Structure

A policy may contain:

Purpose

Scope

Definitions

Approved AI Usage

Prohibited Usage

Risk Classification

Data Requirements

Security Requirements

Human Oversight

Third-Party Requirements

Incident Reporting

Monitoring

Exceptions

Enforcement

11 — Acceptable AI Use

Organizations should define acceptable uses.

Examples might include:

Document Summarization

Code Assistance

Research Support

Data Analysis

Customer Support

Security Analysis

subject to approved controls.

12 — Prohibited AI Use

Organizations may prohibit:

Uploading Restricted Data
to Unapproved AI Services

Unapproved Automated
High-Impact Decisions

Disabling Human Oversight

Circumventing Security Controls

Using Unapproved Models
for Sensitive Workloads

13 — Shadow AI

One major enterprise risk is:

Shadow AI

This occurs when employees use AI systems without:

Approval

Risk Assessment

Security Review

Privacy Review

Governance

Shadow AI is similar to:

Shadow IT

but can introduce additional data and decision risks.

14 — AI System Inventory

You cannot govern what you do not know exists.

Organizations therefore need an:

Enterprise
AI Inventory

15 — AI Inventory Fields

A useful inventory may contain:

AI System ID

System Name

Business Purpose

Business Owner

Technical Owner

Model

Provider

Data Used

Users

Deployment Environment

Risk Classification

Approval Status

Review Date

Lifecycle Status

16 — AI Inventory Example

AI-001

System:
Customer Support Assistant

Business Owner:
Customer Operations

Provider:
External AI Provider

Data:
Customer Support Records

Risk Tier:
High

Status:
Approved with Controls

17 — AI Use-Case Inventory

Sometimes one AI platform supports multiple use cases.

Example:

Enterprise LLM Platform
        ↓
Marketing Assistant

Security Assistant

HR Assistant

Developer Assistant

Each use case may have:

Different Data

Different Users

Different Risks

Different Controls

Therefore:

AI Platform Inventory
        ≠
AI Use-Case Inventory

18 — AI Discovery

AI systems may be identified through:

Procurement

Vendor Management

Cloud Discovery

SaaS Discovery

Application Inventory

Employee Surveys

Security Monitoring

Expense Records

19 — AI Classification

Not every AI use case creates the same level of risk.

Organizations can classify AI systems based on:

Business Impact

Decision Impact

Data Sensitivity

User Population

Autonomy

External Exposure

Regulatory Impact

Security Impact

20 — Example AI Risk Tiers

Tier 1
Low Risk

Tier 2
Moderate Risk

Tier 3
High Risk

Tier 4
Critical / Restricted

The exact methodology should be organization-specific.

21 — Low-Risk Example

AI Used to
Summarize Public
Marketing Material

may present relatively limited risk.

22 — Higher-Risk Example

AI Used to
Recommend Employee
Hiring Decisions

may require significantly greater governance.

23 — AI Risk Classification Matrix

Data Sensitivity
        +
Decision Impact
        +
Autonomy
        +
External Exposure
        ↓
AI Risk Tier

24 — AI Risk Assessment

Before deployment, organizations should ask:

What Can
Go Wrong?

Why?

What Would
the Impact Be?

What Controls
Exist?

What Residual
Risk Remains?

25 — AI Risk Categories

An AI risk taxonomy may include:

Security Risk

Privacy Risk

Data Risk

Model Risk

Bias Risk

Accuracy Risk

Reliability Risk

Legal Risk

Compliance Risk

Third-Party Risk

Operational Risk

Reputational Risk

26 — Hallucination Risk

Generative AI may produce:

Confident
but
Incorrect Output

This is particularly important where AI supports:

Legal

Compliance

Security

Financial

Operational

decisions.

27 — Bias Risk

AI systems may produce outcomes that create:

Unfair

Inconsistent

Discriminatory

Unintended

effects.

GRC should ensure the organization has processes to:

Identify

Assess

Test

Monitor

Escalate

potential bias risks.

28 — Privacy Risk

AI systems may process:

Personal Data

Sensitive Data

Employee Data

Customer Data

Behavioral Data

Privacy governance should consider:

Purpose

Lawful Processing

Minimization

Retention

Access

Disclosure

Data Subject Impact

29 — Security Risk

AI systems introduce security concerns including:

Prompt Injection

Data Leakage

Unauthorized Access

Model Abuse

Insecure Integrations

Supply Chain Risk

Credential Exposure

30 — Model Risk

AI models may behave differently due to:

Model Updates

Prompt Changes

Data Changes

Configuration Changes

Provider Changes

Context Changes

Therefore model behavior must be monitored.

31 — Data Risk

AI depends heavily on data.

Poor data may create:

Incorrect Outputs

Bias

Privacy Exposure

Incomplete Decisions

Unreliable Analytics

The principle remains:

Poor Input
      ↓
Poor Output

32 — Explainability Risk

Some AI decisions may be difficult to explain.

This becomes especially important when AI affects:

Individuals

Customers

Employees

Financial Decisions

Regulated Processes

33 — Autonomy Risk

AI systems increasingly move from:

Recommendation

toward:

Action

An AI agent may:

Send Email

Modify Records

Execute Code

Call APIs

Create Tickets

Change Infrastructure

Autonomy increases governance requirements.

34 — AI Risk Assessment Template

AI System

Business Purpose

Owner

Users

Data

Model

Provider

Decision Impact

Autonomy

Security Risk

Privacy Risk

Compliance Risk

Operational Risk

Third-Party Risk

Existing Controls

Residual Risk

Approval

35 — AI Risk Statement

Example:

There is a risk that
the customer-support
AI assistant generates
incorrect guidance
because model output
is not consistently
validated, resulting in
customer harm or
service disruption.

36 — AI Risk Register

AI risks should integrate with:

Enterprise
Risk Management

rather than remain isolated in technical documentation.

37 — AI Control Framework

Once risks are identified:

AI Risk
      ↓
Control Objective
      ↓
Control
      ↓
Evidence

38 — AI Control Domains

An enterprise AI control library may include:

AI Governance

AI Inventory

Risk Assessment

Data Governance

Security

Privacy

Model Governance

Human Oversight

Testing

Third-Party AI

Monitoring

Incident Management

Change Management

Documentation

39 — Example AI Control

Control ID:
AI-GOV-001

Control:
All production AI
systems must be
registered in the
enterprise AI inventory.

Owner:
AI Governance

Frequency:
Continuous

Evidence:
Approved AI inventory

40 — Another AI Control

Control ID:
AI-RISK-002

Control:
High-risk AI use cases
must complete an
AI risk assessment
before production
deployment.

41 — Human Oversight Control

Control ID:
AI-HUM-001

High-impact AI
decisions must include
defined human
oversight mechanisms.

42 — Human-in-the-Loop

AI
Generates
Recommendation
      ↓
Human
Reviews
      ↓
Human
Decides

This is commonly called:

Human-in-the-Loop

43 — Human-on-the-Loop

Some systems operate automatically while humans:

Monitor

Intervene

Override

when required.

This is often described as:

Human-on-the-Loop

44 — Human Oversight Must Be Meaningful

A human clicking:

Approve

without reviewing the AI output is not meaningful oversight.

Oversight requires:

Information

Authority

Competence

Time

Ability to Override

45 — Automation Bias

Humans may over-trust AI because:

The System
Sounds Confident

This creates:

Automation Bias

Training and controls should address this risk.

46 — AI Data Governance

Organizations should understand:

What Data
Enters AI?

Where Does
It Go?

How Long
Is It Retained?

Who Can
Access It?

Is It Used
for Training?

47 — Data Classification

Before sending information to AI:

Data
      ↓
Classification
      ↓
Permitted AI Use

Example:

Public
      ↓
Approved

Internal
      ↓
Approved with Controls

Restricted
      ↓
Prohibited or
Special Approval

48 — Data Minimization

AI systems should receive:

Only the Data
Necessary

for the approved purpose.

49 — Sensitive Data Leakage

Employees may accidentally paste:

Passwords

API Keys

Customer Data

Source Code

Contracts

Security Findings

into unapproved AI systems.

Controls may include:

Policy

Training

DLP

Access Restrictions

Approved AI Platforms

Monitoring

50 — Model Governance

Organizations should maintain information about:

Model

Version

Provider

Purpose

Configuration

Limitations

Testing

Approval

51 — Model Versioning

Model v1
      ↓
Testing
      ↓
Approved
      ↓
Model v2
      ↓
Reassessment

A model update can create:

New Risk

even when the application has not changed.

52 — Model Change Management

Material changes may include:

New Model

New Provider

New Training Data

New System Prompt

New Tools

New Data Sources

Changed Autonomy

These may require reassessment.

53 — AI Change Management Workflow

Proposed Change
      ↓
Impact Assessment
      ↓
Testing
      ↓
Risk Review
      ↓
Approval
      ↓
Deployment
      ↓
Monitoring

54 — AI Testing

Testing may include:

Accuracy Testing

Security Testing

Bias Testing

Privacy Testing

Safety Testing

Performance Testing

Adversarial Testing

Human Oversight Testing

55 — AI Test Evidence

Maintain evidence such as:

Test Plan

Test Dataset

Results

Failures

Exceptions

Remediation

Approval

56 — Generative AI Governance

Generative AI introduces specific risks including:

Hallucination

Prompt Injection

Sensitive Data Leakage

Unsafe Output

Copyright Risk

Over-Reliance

Untrusted Content

57 — Generative AI Controls

Possible controls include:

Approved Models

Input Restrictions

Output Validation

Content Filtering

Access Controls

Logging

Human Review

Prompt Security

Data Classification

58 — Prompt Governance

Prompts can become part of:

Application Logic

for AI systems.

Critical prompts may therefore require:

Version Control

Testing

Approval

Change Management

59 — System Prompt Risk

Changing:

System Prompt

may materially change:

AI Behavior

Therefore significant prompt changes may require governance review.

60 — AI Agent Governance

AI agents introduce a major shift.

Traditional AI:

Input
      ↓
Output

AI agent:

Goal
      ↓
Reasoning
      ↓
Tool Selection
      ↓
Action
      ↓
Environment Change

61 — Agent Risk

Agents may be able to:

Read Files

Send Messages

Execute Commands

Modify Systems

Create Accounts

Call APIs

Access Databases

This increases:

Operational
and
Security Risk

62 — Agent Permission Governance

Follow:

Least Privilege

An agent should receive only the permissions necessary for its approved purpose.

63 — Agent Control Model

AI Agent
      ↓
Approved Tools
      ↓
Restricted Permissions
      ↓
Action Guardrails
      ↓
Human Approval
      ↓
Logging

64 — High-Risk Agent Actions

Actions such as:

Deleting Data

Changing Infrastructure

Sending Payments

Creating Accounts

Changing Permissions

Deploying Code

may require explicit human authorization.

65 — AI Third-Party Risk

Many organizations do not build their own AI.

They consume:

AI SaaS

Cloud AI Services

Foundation Models

AI APIs

Embedded AI

This creates third-party risk.

66 — AI Vendor Assessment

Assess:

Security

Privacy

Data Use

Retention

Training Practices

Model Governance

Incident Response

Availability

Subprocessors

Compliance

Contractual Protections

67 — Critical Vendor Question

Ask:

Does the Provider
Use Our Data
to Train Models?

The answer may materially affect:

Privacy

Confidentiality

Intellectual Property

Security

risk.

68 — AI Supply Chain

Organization
      ↓
AI Application
      ↓
AI Platform
      ↓
Foundation Model
      ↓
Cloud Provider
      ↓
Data / Tools

Multiple dependencies may exist.

69 — Fourth-Party AI Risk

Your AI provider may rely on:

Another Model Provider

Another Cloud Provider

External Data Sources

creating:

Fourth-Party
Dependencies

70 — AI Vendor Monitoring

Assessment should not end at onboarding.

Monitor:

Model Changes

Terms Changes

Privacy Changes

Incidents

Security Changes

Subprocessor Changes

Compliance Changes

71 — AI Incident Management

AI incidents may include:

Sensitive Data Disclosure

Unsafe Output

Unauthorized Action

Model Failure

Prompt Injection

Bias Event

Incorrect High-Impact Decision

Third-Party AI Failure

72 — AI Incident Workflow

AI Event
      ↓
Detection
      ↓
Triage
      ↓
Containment
      ↓
Impact Assessment
      ↓
Investigation
      ↓
Remediation
      ↓
Lessons Learned

73 — AI Incident Classification

Organizations should define:

What Constitutes
an AI Incident?

Otherwise events may not reach the correct governance teams.

74 — AI Incident Register

Fields may include:

Incident ID

AI System

Date

Event

Impact

Affected Data

Affected Users

Root Cause

Containment

Remediation

Owner

Status

75 — AI Monitoring

AI systems should be monitored for:

Performance

Accuracy

Security Events

Policy Violations

Data Drift

Model Drift

User Complaints

Control Failures

Incidents

76 — Model Drift

Model behavior may change over time because:

Environment Changes

Data Changes

User Behavior Changes

Model Changes

This is commonly described as:

Model Drift

77 — Data Drift

Input data may change compared with the data expected by the system.

Expected Data
      ↓
Environment Changes
      ↓
New Data Pattern
      ↓
Performance Changes

78 — Continuous AI Monitoring

AI System
      ↓
Telemetry
      ↓
Control Signals
      ↓
Risk Monitoring
      ↓
GRC Dashboard
      ↓
Human Review

79 — AI KRIs

Potential AI KRIs may include:

AI Systems
Without Owners

High-Risk AI
Without Assessment

AI Incidents

Unapproved AI Usage

Failed Model Tests

Overdue AI Reviews

High-Risk Vendor Findings

80 — AI KPIs

Potential AI governance KPIs may include:

Percentage of AI Systems
Registered

Percentage of High-Risk AI
Assessed Before Deployment

AI Reviews
Completed on Time

AI Findings
Remediated on Time

81 — AI Governance Evidence

GRC should maintain evidence including:

AI Inventory

Risk Assessments

Approvals

Policies

Control Tests

Model Documentation

Data Assessments

Vendor Assessments

Monitoring Reports

Incident Records

Training Records

82 — AI Evidence Chain

AI Requirement
      ↓
Control
      ↓
Implementation
      ↓
Evidence
      ↓
Testing
      ↓
Assurance

83 — AI Assurance

AI assurance asks:

Are the
Governance Controls
Designed Appropriately?

Are They
Operating?

Is Evidence
Available?

Are Risks
Being Managed?

84 — AI Control Testing

Example:

Control:

All high-risk AI
systems require
risk assessment.

Testing:

Population:
20 High-Risk Systems

Sample:
5 Systems

Expected:
Approved Risk Assessment

Observed:
4 Available
1 Missing

Result:

Potential
Control Exception

85 — AI Audit

Internal Audit may evaluate:

Governance

Inventory Completeness

Risk Assessments

Control Design

Control Operation

Human Oversight

Vendor Governance

Monitoring

Incident Management

86 — AI Audit Trail

For important AI actions, preserve:

User

AI System

Input

Relevant Context

Output

Action

Approval

Timestamp

subject to privacy and retention requirements.

87 — AI Explainability

Organizations may need to explain:

What AI
Was Used?

Why?

What Data?

What Output?

How Was
the Decision Made?

What Human
Oversight Existed?

88 — Responsible AI

Responsible AI is the practice of designing, deploying and using AI in ways aligned with organizational values and governance expectations.

Common themes include:

Fairness

Transparency

Accountability

Privacy

Security

Reliability

Safety

Human Oversight

89 — Responsible AI Must Become Controls

Weak approach:

We Value
Transparency

Stronger approach:

Principle:
Transparency

      ↓

Policy Requirement

      ↓

AI Documentation Control

      ↓

Evidence

90 — AI Accountability

Every production AI system should have:

Named
Accountability

Avoid:

The AI
Made the Decision

The organization remains accountable for how AI is used.

91 — NIST AI Risk Management Framework

The NIST AI Risk Management Framework provides a structured approach to managing AI risks.

Its core functions are:

GOVERN

MAP

MEASURE

MANAGE

92 — GOVERN

GOVERN establishes:

Policies

Roles

Responsibilities

Culture

Risk Processes

Accountability

93 — MAP

MAP helps organizations understand:

Context

Purpose

Users

Impacts

Dependencies

Potential Risks

94 — MEASURE

MEASURE focuses on:

Testing

Assessment

Metrics

Risk Analysis

Performance Evaluation

95 — MANAGE

MANAGE focuses on:

Prioritizing Risk

Risk Treatment

Monitoring

Response

Improvement

96 — NIST AI RMF Lifecycle

GOVERN
   ↓
MAP
   ↓
MEASURE
   ↓
MANAGE
   ↺

Governance operates across the lifecycle.

97 — ISO/IEC 42001

ISO/IEC 42001 provides requirements for an:

Artificial Intelligence
Management System

or:

AIMS

It helps organizations establish systematic governance around AI.

98 — AI Management System

Conceptually:

AI Policy
      ↓
Objectives
      ↓
Risk Management
      ↓
Controls
      ↓
Operation
      ↓
Monitoring
      ↓
Improvement

99 — Management System Thinking

This is similar to other management-system approaches:

Plan
      ↓
Do
      ↓
Check
      ↓
Act

100 — ISO/IEC 23894

ISO/IEC 23894 provides guidance related to:

AI
Risk Management

It can help organizations integrate AI-specific risk considerations with broader risk management practices.

101 — Framework Integration

Organizations do not necessarily need separate governance programs for every framework.

Instead:

Enterprise AI
Governance Program
        ↓
Common Controls
        ↓
NIST AI RMF

ISO/IEC 42001

ISO/IEC 23894

Internal Policies

Applicable Regulations

102 — Common AI Control Framework

Example:

AI-INV-001
AI Inventory

may support multiple:

Frameworks

Policies

Regulatory Requirements

103 — AI Compliance Mapping

External Requirement
        ↓
AI Requirement
        ↓
Common AI Control
        ↓
Evidence

This reduces duplicate compliance work.

104 — AI Regulatory Governance

AI regulations may introduce requirements concerning:

Risk Management

Transparency

Documentation

Human Oversight

Data Governance

Monitoring

Incident Reporting

GRC teams should incorporate these into the regulatory change process.

105 — AI Regulatory Inventory

Maintain:

Jurisdiction

Regulation

Requirement

Applicability

Affected AI Systems

Control Mapping

Owner

Effective Date

Status

106 — AI Use-Case Approval Workflow

Business
Proposes AI
      ↓
AI Inventory
      ↓
Risk Classification
      ↓
Risk Assessment
      ↓
Security Review
      ↓
Privacy Review
      ↓
Compliance Review
      ↓
Approval
      ↓
Deployment
      ↓
Monitoring

Not every use case requires every review.

Risk determines governance depth.

107 — Risk-Based Governance

Avoid treating:

AI Summarizing
Public Documents

exactly the same as:

AI Making
High-Impact Decisions

Governance should be:

Proportionate
to Risk

108 — AI Exception Management

Sometimes a system cannot fully meet a control.

Use:

Exception Request
      ↓
Risk Assessment
      ↓
Compensating Controls
      ↓
Approval
      ↓
Expiration
      ↓
Review

109 — Avoid Permanent Exceptions

A common risk pattern is:

Temporary
Exception
      ↓
Renewal
      ↓
Renewal
      ↓
Permanent Exposure

AI governance dashboards should identify repeated exceptions.

110 — AI Lifecycle Governance

Governance should cover:

Idea

Design

Development

Testing

Approval

Deployment

Operation

Change

Retirement

111 — AI Retirement

Retirement should address:

Access Removal

Data Retention

Model Access

Vendor Termination

Evidence Preservation

Inventory Update

112 — AI Governance Dashboard

Leadership may monitor:

Total AI Systems

High-Risk AI Systems

Unapproved AI

Open AI Risks

AI Control Findings

AI Incidents

Vendor Issues

Overdue Reviews

Exceptions

113 — AI Risk Dashboard

Example:

AI Systems
     ↓
Risk Tier

Owners

Assessments

Controls

Findings

Incidents

Monitoring

114 — AI Governance Metrics

Potential metrics:

AI Inventory Coverage

Risk Assessment Coverage

Control Testing Coverage

Review Completion

Incident Trend

Exception Aging

Vendor Review Status

High-Risk AI Exposure

115 — AI Governance Reporting

Executives should understand:

Where Are We
Using AI?

Where Is
Risk Highest?

Are Controls
Working?

What Is
Changing?

What Requires
Decision?

116 — Board-Level AI Reporting

Board reporting may focus on:

AI Adoption

Material AI Risks

High-Risk Use Cases

Regulatory Exposure

Major AI Incidents

Management Response

Strategic Opportunities

117 — AI Governance Documentation

A mature program may maintain:

AI Policy

AI Standard

AI Inventory

AI Risk Methodology

AI Control Library

AI Assessment Template

AI Vendor Questionnaire

AI Incident Procedure

AI Monitoring Standard

AI Exception Process

118 — Three Lines and AI Governance

A simplified model:

First Line
Business / Technology
Own AI Risk

Second Line
Risk / GRC / Compliance
Provide Oversight

Third Line
Internal Audit
Provides Independent Assurance

119 — First Line

Business and technology teams should:

Own AI Systems

Implement Controls

Manage Risks

Maintain Evidence

Monitor Performance

120 — Second Line

GRC and risk functions may:

Define Framework

Challenge Assessments

Monitor Risk

Review Exceptions

Provide Oversight

121 — Third Line

Internal Audit may independently assess:

Governance

Risk Management

Control Design

Control Operation

Evidence

122 — AI Governance Is Not Only a Technology Problem

A technically secure AI system can still create:

Privacy Risk

Legal Risk

Bias Risk

Operational Risk

Compliance Risk

Therefore:

Secure AI
      ≠
Fully Governed AI

123 — AI Governance Is Not Only Compliance

Similarly:

Compliant AI
      ≠
Risk-Free AI

Governance should consider:

Risk

Security

Privacy

Reliability

Business Impact

Ethics

Compliance

124 — GRC Professional’s Role

GRC professionals may help:

Build AI Policies

Maintain AI Inventory

Assess AI Risk

Design Controls

Map Frameworks

Review Vendors

Monitor Compliance

Manage Exceptions

Support Assurance

Report to Leadership

125 — AI Governance Maturity Model

Level 1 — Uncontrolled AI Adoption

Ad Hoc AI

Shadow AI

No Inventory

No Formal Governance

Level 2 — Basic Governance

AI Policy

Approved Tools

Basic Inventory

Basic Reviews

Level 3 — Risk-Based Governance

AI Classification

Risk Assessments

AI Controls

Human Oversight

Level 4 — Integrated AI Governance

AI Risk
+
Enterprise Risk
+
Security
+
Privacy
+
Compliance
+
Vendor Risk

Level 5 — Continuous AI Assurance

AI Inventory
      ↓
Continuous Monitoring
      ↓
Control Signals
      ↓
Risk Intelligence
      ↓
Human Governance

126 — Enterprise AI Governance Architecture

Board / Executives
        ↓
AI Governance Committee
        ↓
Enterprise AI Policy
        ↓
AI Inventory
        ↓
Risk Classification
        ↓
AI Risk Assessment
        ↓
Control Framework
        ↓
Testing / Approval
        ↓
Deployment
        ↓
Continuous Monitoring
        ↓
Assurance

127 — Complete AI Governance Lifecycle

AI Idea
      ↓
Business Purpose
      ↓
Inventory
      ↓
Classification
      ↓
Risk Assessment
      ↓
Controls
      ↓
Testing
      ↓
Approval
      ↓
Deployment
      ↓
Monitoring
      ↓
Change Management
      ↓
Incident Management
      ↓
Reassessment
      ↓
Retirement

Practical Exercise 1 — Build an AI Inventory

Create a fictional enterprise with:

15 AI Systems

Include:

System

Purpose

Owner

Provider

Data

Users

Risk Tier

Approval Status

Identify systems missing:

Owner

Risk Assessment

Approval

Practical Exercise 2 — Classify AI Use Cases

Classify these examples:

Marketing
Content Assistant

Developer
Coding Assistant

Security
Investigation Assistant

Customer
Support Assistant

Employee
Recruitment AI

Using:

Data Sensitivity

Decision Impact

Autonomy

External Exposure

Assign candidate risk tiers.

Practical Exercise 3 — AI Risk Assessment

Perform an AI risk assessment for:

Customer Support
AI Assistant

Identify:

Security Risk

Privacy Risk

Hallucination Risk

Operational Risk

Third-Party Risk

Controls

Residual Risk

Practical Exercise 4 — Build an AI Control Library

Create controls across:

Governance

Inventory

Risk

Security

Privacy

Data

Human Oversight

Third Parties

Monitoring

Incident Management

Create at least:

20 AI Controls

Practical Exercise 5 — Generative AI Risk Assessment

Assess an enterprise GenAI assistant for:

Prompt Injection

Data Leakage

Hallucination

Unsafe Output

Unauthorized Access

Over-Reliance

Map controls to each risk.

Practical Exercise 6 — AI Agent Assessment

Scenario:

AI Agent
Can Read Email,
Create Tickets
and Call APIs

Assess:

Permissions

Autonomy

Human Approval

Logging

Security

Failure Scenarios

Practical Exercise 7 — AI Vendor Assessment

Assess a fictional AI SaaS provider.

Evaluate:

Security

Privacy

Data Retention

Training Use

Subprocessors

Incident Management

Compliance

Contract Terms

Practical Exercise 8 — AI Incident

Scenario:

Employee Uploads
Sensitive Customer Data
to an Unapproved
AI Platform

Create:

Incident Record

Impact Assessment

Containment Plan

Root Cause

Corrective Actions

Practical Exercise 9 — AI Control Test

Test:

AI-RISK-002

High-Risk AI
Must Complete
Risk Assessment
Before Deployment

Create:

Population

Sample

Evidence

Exceptions

Test Result

Practical Exercise 10 — NIST AI RMF Mapping

Take the AI governance controls created earlier and map them to:

GOVERN

MAP

MEASURE

MANAGE

Practical Exercise 11 — AI Governance Dashboard

Create a fictional dashboard containing:

40 AI Systems

8 High Risk

3 Unapproved

6 Open Risks

4 Open Findings

2 AI Incidents

5 Overdue Reviews

Prepare an executive summary.

Practical Exercise 12 — AI Governance Committee

Design an:

AI Governance Committee

Define:

Members

Responsibilities

Meeting Frequency

Escalation Criteria

Approval Authority

Reporting

Practical Exercise 13 — AI Governance Program

Build an enterprise AI governance program containing:

AI Policy

AI Inventory

Risk Methodology

Control Library

Approval Workflow

Vendor Assessment

Incident Procedure

Monitoring

Assurance

Executive Reporting

Knowledge Check

What is AI governance?
Why is AI governance relevant to GRC?
Why should AI governance integrate with enterprise risk management?
What is an AI governance operating model?
What is the purpose of an AI policy?
What is Shadow AI?
Why is an AI inventory necessary?
Why should AI platforms and AI use cases sometimes be inventoried separately?
What factors can be used to classify AI risk?
What is an AI risk assessment?
What are common AI risk categories?
What is hallucination risk?
What is automation bias?
What is autonomy risk?
Why is AI data governance important?
Why should model versions be tracked?
What AI changes may require reassessment?
What is meaningful human oversight?
What risks are introduced by generative AI?
Why should critical prompts be governed?
Why do AI agents require stronger governance?
How does least privilege apply to AI agents?
What should an AI vendor assessment cover?
What is fourth-party AI risk?
What constitutes an AI incident?
What is model drift?
What is data drift?
What evidence supports AI governance?
What is AI assurance?
What is Responsible AI?
What are the four NIST AI RMF functions?
What is ISO/IEC 42001?
What is ISO/IEC 23894?
Why are common AI controls useful?
How does risk-based AI governance work?
What should happen when an AI system changes?
Why must AI exceptions expire?
What should AI retirement address?
How do the Three Lines apply to AI governance?
Who remains accountable for AI decisions?

Key Takeaways

AI governance connects:

AI
      +
Business
      +
Risk
      +
Security
      +
Privacy
      +
Compliance
      +
Human Oversight

The fundamental lifecycle is:

AI Use Case
      ↓
Inventory
      ↓
Classification
      ↓
Risk Assessment
      ↓
Controls
      ↓
Testing
      ↓
Approval
      ↓
Deployment
      ↓
Monitoring
      ↓
Assurance

Remember:

AI Adoption
      ≠
AI Governance

and:

AI Policy
      ≠
AI Control

and:

AI Output
      ≠
Human Decision

and:

Secure AI
      ≠
Fully Governed AI

and:

Compliant AI
      ≠
Risk-Free AI

A mature governance model establishes:

Principle
      ↓
Policy
      ↓
Risk
      ↓
Control
      ↓
Evidence
      ↓
Monitoring
      ↓
Assurance

The objective is not:

Stop AI

The objective is:

Govern AI
According to Risk

Career Connection

AI governance is becoming an important capability for:

GRC Analysts

AI Governance Analysts

Cyber Risk Analysts

Technology Risk Professionals

Privacy Professionals

Compliance Analysts

IT Auditors

Third-Party Risk Analysts

Security Assurance Professionals

GRC Managers

AI Risk Consultants

Traditional GRC professionals understand:

Risk

Controls

Compliance

Audit

Governance

AI governance professionals extend this knowledge into:

AI Systems

AI Models

AI Data

AI Agents

AI Vendors

AI-Specific Risks

This creates an increasingly important professional capability:

Traditional GRC
      +
AI Understanding
      ↓
AI Governance
Professional

What’s Next?

➡️ Next: 12 — Building an Enterprise AI-Enabled GRC Operating Model

You have now learned how AI can support individual GRC activities and how organizations can govern AI itself.

The next step is to bring everything together.

In the next lesson, you will design an enterprise operating model connecting:

Policies

Risk

Controls

Compliance

Evidence

Audit

Third Parties

Regulatory Change

AI Governance

Executive Reporting

with:

People
      +
Process
      +
Technology
      +
Data
      +
AI

You will learn how to establish:

GRC Roles and Responsibilities

GRC Data Architecture

AI-Assisted Workflows

Human Approval Gates

GRC Knowledge Architecture

Control Ownership

Evidence Automation

GRC Integration Patterns

AI Governance Boundaries

Continuous Monitoring

GRC Metrics

Management Oversight

Three Lines Integration

Implementation Roadmap

The goal is to move from:

Individual
AI-Assisted
GRC Tasks

toward:

Enterprise
AI-Enabled
GRC

where AI supports the entire lifecycle:

Requirement
      ↓
Policy
      ↓
Risk
      ↓
Control
      ↓
Implementation
      ↓
Evidence
      ↓
Testing
      ↓
Finding
      ↓
Remediation
      ↓
Reporting
      ↓
Decision

while humans retain:

Judgment

Authority

Oversight

Accountability

➡️ Next: 12 — Building an Enterprise AI-Enabled GRC Operating Model