What AI governance is

AI governance is the set of policies, processes, and controls ensuring AI systems are built and operated legally, ethically, and accountably — covering compliance, bias/fairness, transparency, and human oversight. For a consultant it's a deliverable and a differentiator: clients in regulated sectors (finance, health, HR, public services) can't deploy without it, and "we handled the governance" is often what closes an enterprise deal. It's cheapest designed in from the start and ruinous to bolt on after a compliance failure.

The EU AI Act — risk-based tiers

The EU AI Act regulates AI by risk to people's rights and safety, in four tiers. It applies to systems placed on the EU market regardless of where the provider is based — so it reaches any client selling into France/Belgium.

Tier	Examples	Obligation
Unacceptable	social scoring, manipulative or exploitative systems, most real-time biometric ID in public	Banned outright
High-risk	AI in hiring, credit scoring, education, medical devices, critical infrastructure, law enforcement	Strict: risk management, data governance, documentation, human oversight, accuracy/robustness, conformity assessment, registration
Limited-risk	chatbots, emotion recognition, deepfakes/generated content	Transparency: users must be told they're interacting with AI / that content is AI-generated
Minimal-risk	spam filters, AI in games, most productivity tools	No specific obligation (voluntary codes)

The heavy compliance load lands on high-risk systems. Most business chatbots and productivity assistants are limited or minimal — but the moment AI influences a hiring, credit, education, or health decision, it's likely high-risk and the obligations jump sharply. General-purpose AI (GPAI) models (the foundation models themselves) carry their own provider obligations (documentation, copyright, systemic-risk rules for the largest).

Bias and fairness

AI systems can produce systematically unfair outcomes for particular groups. Bias enters from several places, and naming the source points to the fix:

• Training-data bias — the model learned from data reflecting historical/societal inequities (the dominant source for foundation models).
• Representation bias — some groups are under-represented in the data, so the system performs worse for them.
• Your-pipeline bias — your prompts, examples, retrieval corpus, or labels encode skew.

You measure bias with disaggregated evaluation — run your eval set (Track 5) sliced by group and compare, rather than trusting a single aggregate:

# The same golden-set eval as Track 5, but sliced by a sensitive attribute to expose disparity:
def fairness_eval(feature, dataset) -> dict:
    by_group = {}
    for case in dataset:                                  # each case tagged with a group attribute
        score = score_case(feature, case)
        by_group.setdefault(case.group, []).append(score)
    return {g: mean(v) for g, v in by_group.items()}     # compare scores ACROSS groups
# A large gap between groups (e.g. 0.92 vs 0.68) is a fairness problem the aggregate would have hidden.

Mitigations: balance/augment the dataset, adjust prompts, add fairness constraints or post-processing, and keep a human in the loop for consequential decisions. This is the same "slice your evals" discipline from Track 5 — pointed at protected groups.

Transparency and disclosure

People affected by AI have a right to know and, sometimes, to understand:

• Disclosure — tell users when they're interacting with AI, and label AI-generated/manipulated content (deepfakes). This is an explicit limited-risk obligation under the Act.
• Explainability — for consequential decisions, be able to explain why (which is hard with LLMs; citations and structured rationales from earlier topics help).
• Documentation — model cards / system cards describing intended use, limitations, data, and evaluation results; high-risk systems require formal technical documentation.

Accountability and human oversight

Governance ultimately requires a human who is accountable — AI is not a liability shield. In practice:

• Human oversight — a person can review, override, or halt the system, especially for high-risk decisions (the human-in-the-loop gates from Track 4).
• Audit trails — log decisions and their basis (the observability traces from Track 5 double as the audit record) so actions can be reviewed after the fact.
• Clear ownership — a named owner for the system's behavior, incidents, and compliance.

Notice the through-line: the technical controls you built across this course — human-in-the-loop, evals, tracing, tenant isolation — are also the governance controls. Responsible AI isn't a separate bolt-on; it's your existing engineering discipline, documented and made accountable.

The consultant's role

For your practice: raise governance early, help clients classify risk, build the transparency and oversight in from day one, and know when to bring in legal. Framed right, governance is not friction — it's how you win regulated clients and de-risk their deployment. "We shipped it responsibly and can prove it" is a competitive advantage in the EU market.

Pitfalls

• Treating governance as an afterthought. Bolting on compliance after a failure is far costlier than designing it in.
• Guessing a high-risk classification. Spot plausibly-high-risk use cases and escalate to legal — don't self-certify.
• A single aggregate fairness number. Bias hides in the aggregate; evaluate disaggregated by group.
• No AI disclosure. Failing to tell users they're talking to AI (or that content is generated) breaches limited-risk transparency duties.
• No accountable human. AI can't own a decision — name a human owner with real oversight and an audit trail.

Recap

• AI governance (compliance, fairness, transparency, oversight) is a consultant deliverable, cheapest designed in from the start.
• The EU AI Act tiers systems as unacceptable (banned), high-risk (strict), limited (transparency), minimal (none) — and applies to anything on the EU market; escalate plausibly-high-risk cases to legal.
• Bias enters via training data, representation, and your pipeline — measure it with disaggregated evaluation, not aggregates.
• Meet transparency (disclose AI, label generated content, document with model/system cards) and accountability (human oversight, audit trails, named owner) duties.
• The technical controls from Tracks 4–6 (HITL, evals, tracing, isolation) are the governance controls, documented and made accountable.
• Worked examples map to the exercises: risk-tier classification (Ex 1), disaggregated fairness eval (Ex 2), transparency requirements (Ex 3), a governance checklist (Ex 4).

from statistics import mean
def fairness_eval(feature, dataset):
    by_group = {}
    for c in dataset:
        by_group.setdefault(c.group, []).append(score_case(feature, c))
    return {g: mean(v) for g, v in by_group.items()}

print(fairness_eval(assistant, dataset))   # {'A': 0.91, 'B': 0.67}