SECTION 09
09Governance: the decisive factor
Governance is the brakes on a fast car. The stronger engine is useless without reliable brakes — not because speed is bad, but because speed without the ability to stop becomes danger. Organisations with formal governance convert their security capability into resilience more efficiently than peers without it.
Governance is not the writing of a policy. It is the answer to four questions with names and dates. If any question has no name attached, governance exists only on paper.
Text in this figure
Q1 · DEPLOY · Who decides to deploy the model? · → · Q2 · MONITOR · Who monitors it afterwards? · → · Q3 · STOP · Who owns stopping it? · → · Q4 · INFORM · Who is informed when it fails? · Each answer is a name and a date · withdrawal: one person, not a committee
| DECISION · OWNER · CONSULTED / INFORMED |
|---|
| Approving deployment of a high-impact model AI governance committee Consulted: model owner · security · legal |
| Classifying training-data sensitivity Data owner Consulted: security · privacy |
| Withdrawing a model from service CISO — sole authority Informed: CEO · business owner |
| Accepting residual risk Executive business owner, in writing Informed: committee · internal audit |
| Escalating to the board Risk committee Informed: the board · audit |
| INDICATOR |
|---|
| Inventory coverage — Registered AI systems as a share of those in use. |
| Pre-deployment review rate — Models that passed the gate out of all deployed. |
| Time to detect — Median from incident to discovery. |
| Time to recover — Median return to trusted operation. |
| Observed model drift — Models past the permitted degradation threshold. |
| Maturity by dimension — Four numbers and the date of the last assessment. |
One page, every quarter, each indicator with its trend. An indicator that has driven no decision across four consecutive meetings is removed from the report.
Common governance failures
A committee without authority. It meets, it recommends, and it cannot stop a deployment. The result is risk documentation, not risk management.
Authority without information. Whoever holds the decision cannot see the monitoring indicators, so decides on impression.
Collective accountability. “The team is responsible” means in practice that nobody is. Accountability needs one name.
ONE PRACTICAL TEST
Ask five leaders: “who owns stopping a model in production right now?” If the answers differ, the authority does not exist — however well it is written down.
Tip: use ← → to move between sections.