How to run AI governance at scale
A practical guide for compliance officers, general counsel, GRC teams, and risk managers navigating the operational realities of enterprise AI governance. Questions every compliance team needs to answer.
Not sure where to start? Answer 3 questions and get a tailored compliance action plan.
What applies to me? →How do we ensure third-party AI vendors meet our standards?
Extending vendor due diligence to cover model transparency, data handling, bias testing, and contractual liability for AI outputs.
How do we handle AI-generated content and hallucinations?
Defining responsibility when AI produces inaccurate outputs used in contracts, reports, or customer communications, and the controls that prevent harm.
How do we maintain data privacy compliance when using AI?
Addressing training data sourcing, data minimization, cross-border transfers, and the right to explanation under GDPR and CCPA.
How are we managing third-party AI risks?
Governing the use of external AI APIs and vendor-embedded models, including data handling, documentation requirements, and ongoing monitoring.
Do we have a complete AI inventory?
Building and maintaining a centralized registry of every AI tool in use, including shadow AI discovered through procurement, network, and employee channels.
How do we apply a three lines of defense model to AI risk?
The three lines of defense model translates directly to AI governance, with first-line business ownership, second-line risk oversight, and third-line independent assurance each requiring AI-specific adaptations.
What does audit-ready AI documentation look like in practice?
Organizations facing regulatory scrutiny, board inquiries, or litigation need to produce evidence that AI systems were built, deployed, and monitored responsibly. Audit readiness is not a documentation exercise. It is an evidence-management discipline built into the AI lifecycle.
What does AI governance look like for a company with under 50 employees?
A lean governance framework for startups that covers the essentials without the overhead — focused on what actually protects you at an early stage.
How do we perform an AI risk assessment?
A practical methodology for assessing AI system risk before deployment, covering data sensitivity, decision impact, regulatory exposure, and the controls each risk level requires.
What AI regulations apply to a US-based SaaS company?
Mapping the federal, state, and international AI regulatory requirements that apply to US SaaS companies offering AI features, based on use case and customer location.
How do we build an AI governance program from scratch?
A sequenced guide to standing up an AI governance program — from initial inventory through ongoing operations — for organizations that are starting with nothing.
How do we manage third-party AI vendors safely throughout the vendor lifecycle?
End-to-end guidance for managing external AI vendor relationships from initial due diligence through ongoing monitoring, covering data handling, contractual protections, and what to do when vendors change their models.
What do we do when an AI system causes harm or fails?
A structured incident response process for AI failures — from initial detection through containment, root cause investigation, regulatory notification, and prevention.
How do we intake and govern open-weight and self-hosted AI models?
A governance framework for organizations that download, fine-tune, or self-host open-weight models — covering intake review, deployment controls, and ongoing maintenance obligations that differ from API-based vendor relationships.
How do we map AI compliance obligations across multiple jurisdictions?
A structured process for organizations operating AI systems across multiple regulatory environments — identifying overlapping obligations, resolving conflicts, and building a unified compliance posture that satisfies the most stringent applicable requirements.
How do we monitor voluntary AI safety commitments and respond when they change?
A process for tracking the voluntary safety commitments and pledges made by AI vendors and foundation model providers — and for reassessing vendor relationships when those commitments are downgraded, abandoned, or fail to be honored.
How do we govern our AI supply chain and manage upstream model dependencies?
A governance framework for managing the risks introduced by upstream AI dependencies — foundation models, third-party datasets, AI-enabled development tools, and compute infrastructure — as components of the organization's AI supply chain.
How do we govern agentic coding assistants and AI developer tools?
A governance framework for evaluating, approving, and monitoring agentic coding assistants and AI developer tools, with specific focus on data boundary controls, the distinction between transmission and retention opt-outs, and the unique risks posed by tools that operate with codebase-level access.
New guidance, every week
We publish practical guidance as governance questions come up in the field — plus everything else changing in AI regulation. Every Thursday.