AI Governance in Practice

governance_drivers:
  regulatory:
    - EU AI Act enforcement
    - Industry-specific requirements
    - Data protection laws
    - Emerging national frameworks

  business:
    - Risk management
    - Brand protection
    - Customer trust
    - Competitive advantage

  operational:
    - Quality assurance
    - Cost control
    - Security
    - Accountability

governance_failures:
  too_restrictive:
    symptoms:
      - AI projects blocked indefinitely
      - Shadow AI proliferates
      - Innovation moves elsewhere
    cause: "Governance designed to say no"

  too_permissive:
    symptoms:
      - Incidents and surprises
      - Compliance gaps
      - Uncontrolled costs
    cause: "No governance at all"

  wrong_focus:
    symptoms:
      - Checkbox compliance
      - Security theater
      - Real risks unaddressed
    cause: "Form over substance"

risk_based_governance:
  tier_1_low_risk:
    examples:
      - Internal tools with human oversight
      - Content drafting with review
      - Data analysis assistance

    requirements:
      - Basic documentation
      - Standard security
      - Usage monitoring

    approval: "Team level"

  tier_2_medium_risk:
    examples:
      - Customer-facing with guardrails
      - Automated workflows with checks
      - Data processing pipelines

    requirements:
      - Formal risk assessment
      - Testing and evaluation
      - Incident response plan
      - Regular review

    approval: "Department level"

  tier_3_high_risk:
    examples:
      - Autonomous decision-making
      - Sensitive data processing
      - Safety-critical applications

    requirements:
      - Comprehensive documentation
      - External review
      - Continuous monitoring
      - Human oversight mandatory

    approval: "Executive level"

class AIGovernanceSystem:
    """Implement AI governance processes."""

    async def submit_use_case(
        self,
        use_case: UseCase,
        submitter: User
    ) -> SubmissionResult:
        # Auto-classify risk tier
        risk_tier = await self._classify_risk(use_case)

        # Generate requirements
        requirements = self._get_requirements(risk_tier)

        # Create governance record
        record = await self.create_record(
            use_case=use_case,
            submitter=submitter,
            risk_tier=risk_tier,
            requirements=requirements
        )

        # Route for approval
        approvers = self._get_approvers(risk_tier)
        await self.notify_approvers(record, approvers)

        return SubmissionResult(
            record_id=record.id,
            risk_tier=risk_tier,
            requirements=requirements,
            estimated_approval_time=self._estimate_time(risk_tier)
        )

    async def _classify_risk(self, use_case: UseCase) -> str:
        risk_factors = {
            "customer_facing": 2,
            "automated_decisions": 3,
            "sensitive_data": 3,
            "safety_implications": 4,
            "regulatory_scope": 2,
            "no_human_oversight": 3,
        }

        score = sum(
            risk_factors.get(factor, 0)
            for factor in use_case.characteristics
        )

        if score >= 8:
            return "tier_3"
        elif score >= 4:
            return "tier_2"
        return "tier_1"

ai_system_card:
  overview:
    name: "Customer Support Assistant"
    owner: "Support Engineering"
    deployment_date: "2025-02-01"
    risk_tier: "tier_2"

  purpose:
    description: "AI assistant for customer support agents"
    use_cases:
      - Draft responses to customer inquiries
      - Summarize customer history
      - Suggest relevant documentation
    non_uses:
      - Autonomous customer communication
      - Decision on refunds/credits
      - Access to payment information

  data:
    inputs: ["Customer messages", "Support history", "Documentation"]
    data_classification: "Confidential"
    pii_handling: "Processed but not stored"
    retention: "Session only"

  model:
    provider: "Anthropic"
    model: "Claude 3.5 Sonnet"
    version_policy: "Pin to specific version"

  safeguards:
    input_filtering: "Yes - injection detection"
    output_filtering: "Yes - PII redaction"
    human_oversight: "Agent reviews all drafts"
    fallback: "Manual handling"

  monitoring:
    quality_metrics: ["Accuracy", "Helpfulness", "Safety"]
    review_frequency: "Weekly"
    incident_process: "Support escalation"

continuous_compliance:
  automated_checks:
    - Model version tracking
    - Usage pattern monitoring
    - Cost threshold alerts
    - Security scan integration

  periodic_reviews:
    tier_1: "Annual"
    tier_2: "Quarterly"
    tier_3: "Monthly"

  audit_trail:
    - All AI interactions logged
    - Governance decisions recorded
    - Changes tracked
    - Accessible for review