The Governance Landscape

P15.governance-safety.01 · Audience: guest, it-ml, language-pro · Prerequisites: Where Bias Enters

Documenting Models — Cards & Datasheets LLM Safety — Failure Modes & Misuse

"Governance" sounds like the part of the work you hand to a lawyer and forget. It is not. Governance is the map a practitioner reads before building — the one that tells you which systems are allowed at all, which carry heavy obligations, and which you can ship with a light touch. Get the map wrong and you either over-engineer a harmless feature into paralysis, or ship a high-stakes system with none of the safeguards the law and common sense both demand. This module turns the headline framework — the EU AI Act's risk tiers, plus the two ideas that run underneath it, accountability and human oversight — into a working map you can actually navigate, in plain language, with the legal text left at the door.

🗺️ So far you have built: one worked story of where bias enters a system — data, labels, objective, deployment — end to end (fairness-privacy.01). You have seen that a model can be quietly, structurally unfair. This module steps up a level: from one system's fairness to the rules that decide which systems are allowed at all, and what safeguards each kind must carry.

In this module you will: governance as a map a practitioner reads, not legal text you defer to a lawyer. You will place any AI system into one of four risk tiers (unacceptable, high, limited, minimal), see why the tier — not the technology — sets the obligations, and meet the two ideas that hold the whole map together: accountability (someone must be answerable) and human oversight (a person must be able to intervene).

Step 1 / 5 — Governance is a map you read before building

Every practitioner already makes governance decisions — usually badly, because they make them implicitly. Deciding a chatbot "probably doesn't need a review" is a governance call; so is deciding a hiring filter "is just maths". Governance is what makes those calls explicit and defensible: a shared way to ask, before you build, how much could this system harm someone, and therefore what must be true before it ships?

ⓘ Concept: Governance: deciding what a system is allowed to do, and who answers for it

governance question = how much could this system harm someone? → what must be true before it ships?

Why it matters — Without a shared map, every team invents its own bar for 'safe enough', and the bar quietly tracks convenience rather than risk. A governance framework fixes the bar to the stakes: the more a system can affect a person's rights, safety or livelihood, the more it must prove before deployment. That is why regulators reach for governance rather than banning or blessing whole technologies — the same model is fine as a film recommender and dangerous as a parole predictor. The map grades the use, not the maths.

The rest of this module is one such map — the European Union's AI Act, the first broad law to grade AI systems by risk. You do not need to be in Europe for it to matter: it is becoming the reference other rules copy, and its central move — tier the system by how much harm it can do — is how every serious governance regime thinks. Learn the map's shape and you can read any of them.

✅ Key takeaways

Governance is a map you read before building — a shared, explicit way to ask 'how much could this system harm someone, and what must be true before it ships?' — not legal text to defer to a lawyer.
The EU AI Act grades systems into four tiers: unacceptable (banned), high (allowed with heavy obligations), limited (transparency duties), minimal (allowed freely). The tier is set by the use, not the technology — the same model can sit in different tiers.
Accountability means a named owner answers for the system: keeps the records that prove responsible operation and holds the power to stop it. 'The model did it' is never an acceptable answer, because a model cannot be held to account.
Human oversight means a person can understand, override and stop a consequential system — in practice, not on paper. Real oversight is a human who can say 'stop' and be heard, not a signature collected after the fact.
The working procedure: read the system's tier (what it decides, who it affects), check accountability is real not diffused, and confirm oversight exists in practice. That decides how much care the system is owed — the question you must answer before any other.

Next: P15.governance-safety.02 — LLM Safety: Failure Modes & Misuse

This is the map. The next three modules walk it in detail: what can go wrong inside an LLM specifically (module 02), how to evaluate for safety as a governance practice (module 03), and how to think when a system has already failed in production (module 04). Step back any time to the P15 pillar overview to see the fairness-privacy and governance-safety tracks together.

Ask the mentor about this module

Ask a question about this content. The mentor explains and grounds its answer in what you are studying; asking is recorded as a learning signal, not a grade.

Ctrl/Cmd + Enter to send

Try it yourself

A scratch console for this page's ideas — ungraded, nothing you run here is recorded.

Scratch console

A scratch console with the scientific stack (pandas, numpy, scikit-learn). Runs on the server — no network, resource-limited and measured.

Output appears here.

Where next?

Continue

LLM Safety — Failure Modes & Misuse →

Governance & Safety · P15

Later in Governance & Safety

Go up a level