AI governance is widely described as if it were a management system, a control catalogue, or a software platform. Those things can support governance. They are not governance.
AI governance is the system by which a governing body exercises ethical and effective leadership to achieve four outcomes:
- an ethical culture;
- sustainable performance and value creation through strategic objectives and organisational purpose;
- adequate and effective control by the governing body of AI resources and risks; and
- trust in the organisation, its reputation and its legitimacy.
These four items are governance outcomes in the sense used by the King codes of corporate governance: results against which leadership is judged, not a list of tools. This article applies that outcomes model to the organisation's use of AI.
What the governing body actually does
The governing body steers the system by evaluating stakeholder needs, conditions and options; setting direction through prioritisation and decision-making; and monitoring performance and compliance against agreed objectives.
Accountability for the use of AI remains with the governing body. It cannot be assigned to a model, a vendor or a management tool. Software may execute delegated controls. It does not take that accountability.
Scope of "use of AI"
Use of AI includes systems the organisation develops, acquires, embeds or consumes:
- models, applications and agents;
- third-party or software-as-a-service AI; and
- systems whose components are owned or operated by different legal entities, including where intended purpose can change in development or deployment.
Outcomes first, then the process model, then software
Three layers sit under this definition. They are not interchangeable.
- Framework - the outcomes against which the governing body holds management to account.
- AI Control Objectives (AICOB) - the process model and workbench: forty control objectives in five families, mapped to law and standards.
- Platform - software that registers live AI uses, attaches policy, observes or enforces controls at runtime, and retains evidence.
Select outcomes first, then the process model, then software. A platform without agreed outcomes implements activity with no test of success.
AICOB puts the framework into day-to-day work. The AI Governance Platform applies that model to live AI uses. Neither replaces the governing body's duty to evaluate, direct and monitor.
The four outcomes, how they are tested, and how AICOB and the platform are used in operation are set out in the Institute's solutions for AI Governance and Management.