Establish and communicate organizational expectations for AI governance.
- ✓Create the structure first: check what exists, name a champion, decide who maintains it. Then implement.
- ✓Key roles: board, executive champion, governance committee, governance lead, system owners, specialist functions, internal audit.
- ✓Accountability needs one named owner per decision plus cross-functional oversight. Use RACI to make it explicit.
- ✓Three lines: owners manage risk, oversight functions set and challenge, internal audit assures.
- Executive champion:
- A senior leader who sponsors AI governance and gives it visible backing, authority and budget.
- AI governance committee:
- A cross-functional body that approves AI policy, reviews higher-risk use cases and resolves escalations.
- AI system owner:
- The business leader accountable for a specific AI system's purpose, performance and compliance.
- RACI:
- A chart that marks who is Responsible, Accountable, Consulted and Informed for each decision or task.
- Three lines model:
- A governance pattern splitting risk ownership (first line), oversight (second line) and independent assurance (third line, internal audit).
Exam tips: Creating the structure = (1) does one already exist? (2) name an executive champion (3) decide who maintains and implements it. Mapping laws, data lineage and training are implementation, so on a NOT question they're your answer. · Privacy and security experts are core stakeholders from day one. Options that leave them out, or add them 'later', are wrong. · 'One AI owner, no committee' and 'everyone is responsible' are opposite traps. The IAPP answer pairs an accountable executive with a cross-functional body. · Independent assurance comes from internal audit, not from the team that designed or runs the controls.
- ✓The BoK's two reasons for cross-functional governance: efficacy, and diversity of expertise and perspective.
- ✓Privacy and security are permanent seats; other functions join as AI reaches their territory.
- ✓Social scientists surface non-obvious bias that metrics and legal checks miss.
- ✓Go faster with tiered review, not by removing perspectives.
- Cross-functional collaboration:
- Bringing legal, privacy, security, technical, business, HR and other functions together to govern AI jointly.
- Diversity of expertise and perspective:
- Including different disciplines and backgrounds so the group spots risks a single viewpoint would miss.
- Non-obvious bias:
- Unfairness that standard technical and legal checks miss, such as culturally loaded language or subtle proxies.
- Tiered review:
- Scaling the depth of governance review to a use case's risk, so low-risk uses move fast and high-risk ones get full scrutiny.
Exam tips: When a competent technical and legal team keeps missing subtle bias, the IAPP answer is to add social scientists (psychologists, sociologists, linguists). · Watch for the true-but-irrelevant option: an executive sponsor or bigger budget sounds responsible but doesn't fix a detection gap. · Collapsing review into one executive is the LEAST effective way to speed up. Tiered, risk-based review keeps the diversity.
- ✓Train all stakeholders: board to contractors, not just the people who build models.
- ✓Cover AI terminology, strategy, governance and ethics; tailor depth by role on a shared baseline.
- ✓Training builds role skills; awareness keeps AI risk visible every day.
- ✓The EU AI Act expects providers and deployers to take measures to build staff AI literacy. Treat it as the floor.
- AI literacy:
- The skills, knowledge and understanding people need to use and oversee AI appropriately and to recognize its risks.
- Role-based training:
- Training whose depth and content match what a person's role requires, layered on a shared baseline.
- Awareness program:
- Ongoing communication that keeps AI risks, rules and reporting channels front of mind for everyone.
- Automation bias:
- The human tendency to over-trust an automated output instead of exercising independent judgment.
Exam tips: Any option that limits training to IT, data science or a committee is the too-narrow trap. The IAPP answer is all stakeholders, organization-wide. · The BoK's content list is AI terminology, strategy and governance, plus ethics. An option missing most of these isn't 'comprehensive'. · One-off launch training, or training only after an incident, is reactive. Look for continuous awareness and periodic refreshers.
- ✓PROMIS: products and services, risk tolerance, objectives, maturity, industry, size.
- ✓Centralized, decentralized or hybrid: hybrid fits large multinationals.
- ✓Leverage existing governance programs and add AI-specific pieces.
- ✓Maturity grows from ad hoc to optimized; start with inventory, policy, owner and risk triage.
- Risk tolerance:
- How much AI-related risk an organization is willing to accept in pursuit of its objectives.
- Proportionality:
- Scaling governance effort to the organization's context and the risk of each AI use.
- Centralized governance:
- One central function sets AI policy and makes AI decisions for the whole organization.
- Decentralized governance:
- Each business unit governs its own AI with little central coordination.
- Hybrid (federated) governance:
- Central policy and oversight combined with local assessment of use cases; the usual fit for large multinationals.
Exam tips: When two options sit at opposite extremes (centralize everything vs. every unit for itself) and a third reinvents the wheel, the IAPP answer is the balanced one that leverages existing structures. · 'Build AI governance from a blank page' is a trap when mature privacy, security or risk programs exist. Extend them. · Proportionate never means 'none'. Watch for options that exempt small or 'low-stakes' businesses entirely.
- ✓Developer builds, provider makes available, deployer puts to work, user interacts.
- ✓Each role has its own responsibilities, opportunities and needs, and information must flow between them.
- ✓One organization often holds several roles; duties attach to every role it holds.
- ✓Under the EU AI Act, provider and deployer are legal roles, and Art. 25 can turn a deployer into a provider.
- Developer:
- The party that designs, builds, trains and tests an AI model or system.
- Provider:
- The party that makes an AI system available to others; under the EU AI Act, it places the system on the market or puts it into service under its own name.
- Deployer:
- An organization that uses an AI system under its own authority, outside purely personal use.
- User:
- The individual who interacts with an AI system or acts on its outputs.
- Substantial modification:
- A significant change to an AI system after it reaches the market; under EU AI Act Article 25 it can turn a deployer into a provider.
Exam tips: Developer, provider, deployer and user are task labels, not exclusive identities. The IAPP answer usually says an organization holds several roles and owes each role's duties. · Integration or configuration is deployment, not development. Options that 'promote' integration work into development are traps. · Rebrand, substantially modify, or repurpose into high-risk = becomes the provider (EU AI Act Art. 25). · Deployers can't offload all responsibility onto the vendor, and calling yourself a 'mere user' doesn't change that.
Independent study aid, not affiliated with the IAPP. Written with AI from primary sources; laws change, so check the sources. Last updated 7 Nov 2026.
