Calibrate autonomy
Match AI freedom to consequence. Low-consequence drafting may run quickly; high-consequence decisions need explicit human approval.
Pathway 4 · Lesson 0390 min
AI Governance & Responsible AI
EU AI Act, NIST AI RMF, ISO 42001 — building guardrails that enable
Learning Objective
By the end of this lesson, you will be able to: Design a governance framework for your area aligned to EU AI Act risk tiers, choose between centralised/federated/hybrid governance models, and create an AI incident response plan.
55%
of organisations have established a formal AI board or oversight committee
Engage
"Governance is not the enemy of AI innovation. Organisations with strong AI governance achieve significantly greater business value than those without. Why does governance enable rather than block?"
Explore
An overview of the major AI governance frameworks — EU AI Act, NIST AI RMF, and ISO 42001 — and how they apply in practice.
Explain
The EU AI Act: Risk-Based Regulation
The EU AI Act (effective 2024-2026) classifies AI systems into four risk tiers:
Unacceptable Risk (Prohibited): Social scoring, real-time biometric surveillance in public spaces, manipulation of vulnerable groups. These are banned outright.
High Risk: AI in hiring, credit scoring, law enforcement, critical infrastructure, education assessment. Requires conformity assessment, human oversight, transparency, and registration.
Limited Risk: Chatbots, deepfakes. Requires disclosure that users are interacting with AI.
Minimal Risk: Spam filters, AI in games. No specific requirements.
For leaders: Classify every AI system in your area by risk tier. High-risk systems require significant governance investment before deployment.
Explain
NIST AI Risk Management Framework
The NIST AI RMF provides a practical governance structure with four functions:
Govern: Establish organisational policies, roles, and accountability for AI risk management.
Map: Identify and categorise AI risks in context — who is affected, what could go wrong, what's the impact?
Measure: Analyse and assess AI risks using quantitative and qualitative methods.
Manage: Prioritise and treat risks — accept, mitigate, transfer, or avoid.
The framework is voluntary but widely adopted as the practical standard for enterprise AI governance, particularly in the US and internationally.
Governance Models: Centralised vs. Federated vs. Hybrid
| Model | How It Works | Advantages | Disadvantages | Best For |
|---|---|---|---|---|
| Centralised | One AI governance team controls all AI decisions | Consistency, risk control, clear accountability | Slow, bottleneck, disconnected from business | Highly regulated industries |
| Federated | Each business unit governs its own AI | Speed, business alignment, local expertise | Inconsistency, shadow AI risk, duplicated effort | Innovative, fast-moving organisations |
| Hybrid | Central standards + local implementation | Balance of control and speed | Complexity, requires strong coordination | Most large enterprises |
⚠️
Shadow AI: The Governance Gap
Shadow AI — employees using unapproved AI tools without organisational knowledge — is the most common governance failure. 67% of employees report using AI tools not approved by their organisation (Gartner, 2025). Shadow AI creates data security risks, compliance violations, and inconsistent quality. The solution is not prohibition (which drives AI underground) but clear, enabling governance: approved tools, clear data rules, and a fast approval process for new tools.
Try It · Reflect & Apply
Design your governance framework: (1) List the AI systems in your area and classify each by EU AI Act risk tier. (2) Choose your governance model (centralised/federated/hybrid) and justify it. (3) Write a 3-step AI incident response plan for your area.
Your notes are saved in your browser for this session.
Evaluate · Knowledge Check
1 / 3Under the EU AI Act, which category of AI use is completely prohibited?
External video references
Keep Learning on YouTube
Open in a new tab
Architect Leadership Lab
Governance Design Lab
Leadership decision
Decide which AI uses need lightweight guardrails, formal oversight, or explicit prohibition before they scale.
Evidence to create
An AI Use-Case Register with risk tier, accountable owner, required evidence, human-oversight model, and escalation route for each use case.
Meeting retrieval prompt
Ask: ‘Could we explain, evidence, and defend this AI-enabled decision to an affected customer, colleague, or regulator?’
Spaced application: Return to this decision after 7 days, then after 30 days. Record what evidence changed your initial assumption and what you will do next.
Curated external references
Executive Resource Library
Select one this week
NIST AI RMF explainerNIST AI RMF learning resourceA video introduction to the NIST AI Risk Management Framework and its trustworthiness focus.Watch · 12 min AI GovernanceWorld Economic Forum Annual MeetingA senior-level discussion of fragmented governance approaches and responsible innovation.Watch · 42 min AI RMF PlaybookNISTThe official practical companion to the NIST framework; use it to operationalise Govern, Map, Measure, and Manage.Read · 20 min EU AI Act overviewEuropean CommissionThe official risk-based regulatory overview, including governance, enforcement, and deployer obligations.Read · 15 min
Human-centred work design
Human Oversight Check
Use this original practice tool to test whether an AI-enabled workflow supports real human judgment, rather than merely placing a person at the end of an automated process.
Self-check
0/5
Start by making the work and decision rights explicit
Keep context visible
Make the objective, inputs, constraints, source material, and current system state easy to inspect before anyone approves an output.
Design active review
Review should require informed judgment, a plausible override, and the authority to act—not a symbolic sign-off after the fact.
Route exceptions clearly
Specify what uncertainty, conflict, missing evidence, or risk looks like—and who receives the escalation with enough context to decide.
Maintain human capability
Protect deliberate practice in the work that people may one day need to verify, challenge, or perform without AI assistance.
Apply it to one workflow
Ready to move on?
Mark this lesson complete and continue to "Coaching People Through AI Change".