Lesson 6.5: Governance, Mitigation, and Stakeholder Roles
Governance, Mitigation & Stakeholder Roles
Principles and laws only work if someone is responsible for implementing them. This lesson teaches you who does what, how organizations govern AI over its entire lifecycle, and how to operationalize ethics beyond good intentions.
From principles to practice — who does what, and when
Unit 6 has taught you to identify ethical risks, apply responsible AI principles, navigate global regulations, and handle data privacy compliance. This final lesson ties everything together with the organizational structures that make it all real: AI governance.
Governance answers the question that every ethical framework leaves open: who, specifically, is responsible for making this happen? You'll learn the roles of the Data Protection Officer, CISO, compliance officer, data scientist, project manager, and ethics committee — what each one does, where they overlap, and how they work together. You'll explore specific mitigation strategies for each ethical risk type. And you'll walk through the AI system lifecycle to see where governance checkpoints belong at every stage — not just at launch.
AI governance is not a one-time checklist before launch — it's a continuous process across the entire system lifecycle. A model that was fair at deployment can become biased as data patterns shift. A system that was compliant when regulations were written may fall out of compliance when those regulations change. Governance structures must monitor, review, and adapt — not just approve and release.
The language of AI governance
These terms define the organizational structures and roles that translate ethical principles into operational practice. Know them precisely — especially the distinctions between DPO, CISO, and compliance officer.
| Term | Definition |
|---|---|
| AI Governance | The framework of policies, processes, oversight mechanisms, and accountability structures that guide how AI is developed, deployed, and monitored within an organization. Translates ethical principles and legal requirements into operational practice. Good AI governance makes responsible AI systematic — not dependent on individual goodwill. |
| AI Ethics Committee | A cross-disciplinary group within an organization that reviews AI projects for ethical considerations, particularly high-impact systems. Typically includes technical leads, compliance/legal, domain experts, and sometimes external advisors. Has authority to require changes or block deployment of AI systems that don't meet ethical standards. |
| Data Protection Officer (DPO) | A role required by GDPR for certain organizations (those doing large-scale systematic monitoring or processing sensitive data). The DPO oversees data privacy strategy, advises on DPIAs, trains staff, monitors compliance with GDPR, and acts as the contact point for the supervisory authority. Must be independent — cannot be subject to instructions on how to exercise their data protection tasks. |
| Chief Information Security Officer (CISO) | The senior executive responsible for an organization's information security strategy. For AI, the CISO ensures that AI systems and data are protected from unauthorized access, cyberattacks, and adversarial manipulation. Leads incident response for security breaches. May conduct security reviews of AI systems before deployment (penetration testing, vulnerability assessment). |
| Compliance Officer | A professional responsible for ensuring the organization meets all relevant laws, regulations, and internal policies — beyond just data privacy. In AI contexts, the compliance officer checks that AI deployments comply with sector-specific regulations (financial services, healthcare, employment law) and maintains documentation for regulatory audits. |
| Model Owner | A named individual or team responsible for a specific AI model in production — accountable for its performance, fairness, security, and compliance over its operational lifetime. The model owner monitors KPIs, coordinates retraining when needed, and is the point of escalation if the model causes problems. Assigning a model owner is fundamental to AI accountability. |
| AI Audit | A systematic evaluation of an AI system against defined criteria — ethical, legal, or performance-based. Can be internal (conducted by the organization) or external (conducted by a third party). A bias audit tests whether model outputs show disparate impact across demographic groups. A compliance audit verifies required documentation and processes exist. Regular auditing is a core governance mechanism. |
| Model Card | A standardized documentation format for AI models that describes: intended use, performance metrics across subgroups, training data sources, known limitations, ethical considerations, and recommended deployment conditions. Model cards make AI systems more transparent and help downstream users understand what a model can and cannot do safely. |
| AI Lifecycle | The full sequence of stages an AI system passes through: problem definition → data collection → model development → testing & validation → deployment → monitoring → update/retirement. Governance checkpoints should exist at every stage — not just before launch. Ethical risks can emerge at any point in the lifecycle. |
| Model Drift | Degradation in model performance over time as real-world data patterns shift away from the training distribution. A bias-free model at launch can develop bias if the population it serves changes and the training data no longer represents current reality. Monitoring for drift is a key ongoing governance responsibility. |
Who does what in AI governance
Effective AI governance requires multiple roles working together — each with distinct responsibilities. Click each stakeholder to explore their specific role in AI ethics and compliance, what they focus on, and how they interact with others.
Data Protection Officer (DPO) — the privacy conscience of the organization
Core responsibilities in AI governance
- Reviews AI projects for GDPR compliance before and during deployment
- Mandates and guides Data Protection Impact Assessments (DPIAs) for high-risk AI
- Advises on lawful basis for personal data used in AI training and inference
- Educates developers on what data can and cannot be used
- Acts as contact point for the supervisory authority (e.g., ICO, CNIL) in case of investigation
- Manages individual rights requests related to AI-processed data (access, deletion, explanation)
When to involve the DPO
- Before any new AI project that processes personal data — bring DPO in at scoping
- When considering new data sources for AI training
- Before deploying AI that makes automated decisions affecting individuals
- Immediately upon discovering a data breach involving AI-processed data
- When users exercise GDPR rights (access requests, right to explanation)
- When regulators contact the organization about AI practices
CISO / IT Security Team — protecting AI systems and the data they use
Core responsibilities in AI governance
- Ensures AI training data and inference data are stored securely (encryption, access controls)
- Assesses AI systems for adversarial vulnerabilities (model inversion, data poisoning attacks)
- Conducts security reviews (penetration testing, vulnerability assessment) before AI deployment
- Leads containment and investigation in data breach incidents involving AI systems
- Enforces policies on third-party AI tool use (e.g., which cloud AI services are approved)
- Monitors AI systems for anomalous behavior that could indicate security compromise
AI-specific security threats to watch
- Data poisoning — attackers manipulate training data to influence model behavior
- Model inversion — extracting training data from model outputs
- Adversarial examples — inputs crafted to fool the model (e.g., fool a fraud detector)
- Prompt injection — manipulating LLM inputs to bypass safety measures
- Supply chain attacks — compromised third-party models or libraries
- Model theft — extracting a model's behavior through repeated queries
Compliance Officer — ensuring AI meets every applicable rule
Core responsibilities in AI governance
- Maps AI deployments to applicable regulations (ECOA for lending AI, EEOC for hiring AI, FDA for medical AI, etc.)
- Maintains compliance documentation and model risk management records
- Conducts or commissions compliance audits of AI systems
- Tracks evolving regulatory requirements and updates internal policies accordingly
- Ensures AI vendors have appropriate contractual obligations (data processing agreements, liability clauses)
- Advises on state AI law compliance (Colorado, NYC, Illinois, California)
Key questions a compliance officer asks about any AI deployment
- Which regulations apply to this AI's use case and geography?
- Does the AI make decisions that require explanation to affected individuals?
- Has the system been tested for disparate impact under anti-discrimination law?
- Are required disclosures in place (e.g., notifying job candidates AI was used)?
- Is documentation sufficient to demonstrate compliance in an audit?
- Are vendor contracts appropriately allocating responsibility for compliance?
Data Scientist / ML Engineer — ethical design built into the model itself
Core responsibilities in AI governance
- Tests training data for representation gaps and potential sources of bias
- Applies fairness-aware training techniques and post-processing corrections
- Implements XAI methods (SHAP, LIME) to generate explainability for model outputs
- Writes model cards documenting intended use, limitations, performance across subgroups
- Monitors model performance for drift and degradation after deployment
- Raises ethical concerns about training data, model design, or use cases to governance structures
Ethical design choices data scientists make
- Selecting model type: accuracy vs. interpretability trade-off based on use case risk level
- Feature selection: identifying and removing or flagging proxy attributes for protected characteristics
- Fairness metric choice: which definition of fairness to optimize for (individual, group, equalized odds)
- Data augmentation: adding synthetic examples to improve representation of underrepresented groups
- Threshold setting: adjusting decision thresholds to reduce disparate impact
- Differential privacy: applying noise to protect training data privacy in the model itself
AI Product Manager — bridging ethics, compliance, and delivery
Core responsibilities in AI governance
- Champions ethics-by-design: makes ethical requirements part of product specifications, not afterthoughts
- Coordinates between technical teams, DPO, compliance, and ethics committee
- Ensures governance timelines are built into project plans (bias testing, ethics review, DPIA)
- Assembles documentation for ethics committee review of high-impact AI deployments
- Manages user-facing transparency requirements (disclosure of AI involvement, explanation features)
- Tracks post-deployment performance metrics and escalates governance issues
Governance questions a PM must answer before deployment
- Who is the named model owner for this system post-deployment?
- Has the DPIA been completed and approved by the DPO?
- Has the ethics committee reviewed the system (if required by policy)?
- Are bias testing results documented and within acceptable thresholds?
- Are user-facing disclosures and explanation features implemented?
- Is there a monitoring plan and incident response plan for this AI system?
AI Ethics Committee — organizational conscience for high-stakes AI
Core responsibilities in AI governance
- Reviews high-impact AI systems before deployment — can require changes or veto deployment
- Sets organizational AI ethics standards and policies
- Evaluates AI projects for alignment with organizational values and societal impact
- Provides cross-disciplinary perspective: technical, legal, ethics, and sometimes community representation
- Reviews post-incident reports and recommends systemic changes
- Advises on emerging ethical questions as AI capabilities evolve
What an ethics committee review covers
- What is the AI doing and who does it affect? What are the potential harms?
- Has the system been tested for bias and disparate impact? Results?
- Is the decision-making explainable to affected individuals?
- Is there meaningful human oversight — can humans review, override, or halt the system?
- Are affected communities represented in the design process?
- What is the plan if the AI causes harm? Who is responsible?
Match strategies to risks — then apply them across the lifecycle
Mitigation Strategy Library
Every ethical risk type has specific mitigation strategies. Select a risk category to see the primary strategies, supporting tools, and which stakeholder owns each.
Mitigation Strategy Library
Select a risk type to see targeted mitigation strategies
Bias Mitigation Strategies
Diverse & representative training data
Audit training data for demographic representation gaps. Augment underrepresented groups. Remove or reweight historical bias embedded in labels. Owner: Data Scientist.
Proxy attribute identification
Identify variables that correlate strongly with protected characteristics (ZIP code, name patterns). Decide whether to remove, transform, or monitor them. Owner: Data Scientist + Compliance Officer.
Fairness-aware training
Apply algorithmic fairness constraints during model training — penalizing disparate impact in the loss function. Techniques: adversarial debiasing, fairness regularization. Owner: Data Scientist.
Disparate impact testing
After training, test outcome rates across demographic groups. If disparate impact is found, adjust decision thresholds for different groups or retrain. Apply the 4/5ths rule as a baseline check. Owner: Data Scientist + Compliance Officer.
Fairness toolkits
IBM AI Fairness 360, Microsoft FairLearn, Google What-If Tool. These libraries provide metrics for multiple fairness definitions and mitigation algorithms. Owner: Data Scientist.
Regular bias audits
Scheduled testing (quarterly or annually) of live model outputs for emerging bias — especially after retraining with new data. External audits for high-stakes AI. Owner: Compliance Officer + Data Scientist.
Transparency Mitigation Strategies
Choose interpretable models where stakes are high
For high-stakes, high-explanation-need contexts (lending, hiring), consider decision trees, scorecards, or logistic regression over deep neural networks. Accept some accuracy loss for interpretability. Owner: Data Scientist + Product Manager.
SHAP / LIME explainability
For complex models that can't be simplified, apply post-hoc explainability tools. SHAP for rigorous feature attribution. LIME for fast local approximations. Output plain-language reason codes for affected individuals. Owner: Data Scientist.
Model cards & datasheets
Publish model cards documenting: intended use, training data, performance across subgroups, known limitations, ethical considerations. Give downstream users the information they need to deploy safely. Owner: Data Scientist + Product Manager.
Disclosure & explanation features
Inform users when AI is involved in decisions that affect them. Provide reason codes for significant automated decisions (especially denials). Implement "why am I seeing this?" features for recommendation AI. Owner: Product Manager + DPO.
Accountability Mitigation Strategies
Named model ownership
Every production AI system must have a named model owner accountable for performance, fairness, and compliance over its operational lifetime. No anonymous models. Owner: Executive leadership + Product Manager.
Human-in-the-loop for high-stakes decisions
For consequential decisions (hiring, lending, medical diagnosis, parole), require human review before action. Design override mechanisms. Document when humans agree or disagree with AI recommendations. Owner: Product Manager + Compliance Officer.
Ethics committee review for high-impact AI
Require ethics committee sign-off before deploying AI that significantly affects people's lives. Define clear criteria for what triggers review. Keep records of committee decisions. Owner: Ethics Committee.
AI incident response plan
Define in advance: who is notified when AI causes harm? Who investigates? Who has authority to suspend the system? What's the communication plan for affected parties? Practice the plan before you need it. Owner: Product Manager + CISO + Legal.
Regular audits & recertification
Schedule periodic reviews of live AI systems — internal audits or third-party assessments. For high-risk AI, consider annual recertification where the system is re-evaluated against current standards. Owner: Compliance Officer.
Privacy Mitigation Strategies
Data minimization from the start
Before collecting any data, define exactly what's needed and why. Don't collect "just in case." Design AI systems to function on the minimum personal data required for the purpose. Owner: Data Scientist + DPO + Product Manager.
Anonymization & pseudonymization
Anonymize training data where possible. Pseudonymize inference data when full anonymization isn't feasible. Store pseudonymization keys separately with strict access controls. Consider differential privacy for sensitive training sets. Owner: Data Scientist + DPO.
DPIA for high-risk processing
Conduct Data Protection Impact Assessments before deploying AI that processes personal data at scale, uses sensitive categories, or makes significant automated decisions. Document findings and mitigations. Owner: DPO.
Rights management infrastructure
Build systems that can respond to GDPR requests: access requests (what data do you have on me?), deletion requests, correction requests, explanation requests. Test before launch. Owner: Product Manager + DPO + Engineering.
Security Mitigation Strategies
Encryption at rest & in transit
Encrypt all personal data in AI databases and during network transmission. Manage encryption keys securely. If breached data is encrypted, GDPR notification burden may be reduced. Owner: CISO + Engineering.
Principle of least privilege
Only authorized personnel have access to training data, model weights, and inference systems — and only the minimum access needed for their role. Audit access logs regularly. Owner: CISO + Engineering.
Robustness testing
Test AI systems against adversarial inputs before deployment — inputs crafted to fool the model. For fraud detection AI: test whether simple input modifications can evade detection. For LLMs: test for prompt injection vulnerabilities. Owner: CISO + Data Scientist.
Anomaly detection on AI inputs & outputs
Monitor production AI systems for unusual input patterns (possible data poisoning or adversarial attack) and unexpected output distributions (possible model compromise). Alert and investigate anomalies. Owner: CISO + Data Scientist.
AI Governance Lifecycle — checkpoints at every stage
Governance is not a pre-launch checklist. Click each lifecycle stage to see what governance activities belong there and who owns them.
AI System Governance Lifecycle
Click any stage to see governance requirements and responsible owners
Select a lifecycle stage above
Click any stage button to see the governance activities, required documentation, and stakeholder responsibilities at that point in the AI system's life.
Who should handle this — and what should they do?
Real governance decisions require knowing both which role is responsible and what specific action they should take. For each scenario below, select the best response — identifying both the right stakeholder and the right action.
Governance Scenario Challenge
Read each scenario · Select the best governance response · Check your answer
Ask the AI Governance Advisor
Practice the governance conversations you'll have with executives, technical teams, and clients. Use the prompts or type your own question about roles, mitigation strategies, or governance structures.
5-Question Quiz
Test your mastery of Lesson 6.5. Select the best answer, then submit for your score and detailed feedback.