# Responsible AI and AI governance The practices and rules that make machine learning and AI systems accountable: knowing which systems exist, documenting how they were built, checking them for unfair or unsafe behaviour, keeping people in control, and meeting legal obligations such as the EU AI Act. > [!NOTE] > > **Before reading** > > [The ML lifecycle and MLOps]() ยท [PII and data classification]() ## Why it matters Models make or influence decisions about people: who gets credit, which applicant is shortlisted, which transaction is blocked. They can be wrong in systematic ways, such as performing worse for one group, and their reasons are often opaque. Data governance is the foundation: most AI risks start with the data a model was trained on. ## How it works An AI inventory is the starting point: a register of every model and AI application in use, including those built with external models and those bought from vendors. Each entry has an owner, a purpose, the data it uses, the decisions it affects, and a risk level. Without it, nobody can say where AI is used or which rules apply. Documentation travels with each system. A model card describes what a model is for and not for, how it was trained and evaluated, its performance overall and per group, and its known limitations. A datasheet does the same for a training dataset: where it came from, what it contains, who is represented, and what it may be used for. Both live with the model in the registry and are updated with each version. Fairness checks look for unequal performance or outcomes across groups, such as error rates by age band or region. Which measure matters depends on the use, and different fairness measures can conflict, so the choice is a documented decision by the owner, not a library default. Checking fairness may require sensitive attributes, which must be handled under privacy rules. Explainability gives reasons for predictions. Global explanations show which features matter most overall; local explanations, such as feature attributions, show why one prediction came out as it did. They help developers debug and reviewers challenge decisions, and may be legally required. Human oversight keeps people in control where it matters: reviewing low-confidence or high-impact predictions, being able to override the model, and monitoring for problems after launch. Rights to data are part of governance: whether purpose, consent and licences permit training, and how erasure requests affect models. The EU AI Act classifies AI systems by risk. Some practices are prohibited, such as social scoring, since 2 February 2025. High-risk systems, including AI used in hiring, credit scoring and education, must meet requirements for risk management, data governance, documentation, logging, human oversight and accuracy. Obligations for providers of general-purpose AI models apply since 2 August 2025. Transparency obligations, such as telling people they are interacting with AI, apply from 2 August 2026, with marking of AI-generated content delayed to 2 December 2026 for systems already on the market. The Digital Omnibus on AI, in force since 27 July 2026, moved the high-risk obligations for standalone systems to 2 December 2027 and for AI in regulated products to 2 August 2028 (checked October 2026). Many of the requirements are data platform capabilities: lineage, data quality, versioning, logging and access control. ``` flowchart LR INV[AI inventory:
owner, purpose,
risk level] --> DOC[Model card and
datasheet] DOC --> CHK[Pre-launch checks:
accuracy, fairness,
explainability] CHK --> APP{Owner and
reviewer approve?} APP -->|yes| LIVE[Launch with
human oversight
and monitoring] APP -->|no| FIX[Fix data or model] LIVE -->|incidents, drift| CHK ``` ## Key terms - AI inventory A register of all AI systems with owners, purposes and risk levels. - Model card Documentation of a model's purpose, performance, evaluation and limits. - Datasheet for datasets Documentation of a dataset's origin, content and permitted uses. - Fairness check Comparing a model's performance or outcomes across groups. - Explainability The ability to give reasons for a model's predictions. - Human oversight People able to review, override and monitor an AI system. - High-risk AI system Under the EU AI Act, a system in a listed sensitive area with strict requirements. ## Example The shop reviews its churn model before letting it decide who gets retention discounts. - Inventory entry: owner head of CRM; purpose retention offers; data order history and support contacts; risk level medium, as it affects prices offered to people but is not a high-risk use under the AI Act. - Model card: trained on 2024 to 2026 data, AUC 0.81 overall; performance by region and by customer tenure; not to be used for credit or account restrictions. - Fairness check: recall is similar across regions, but for customers over 65 it is half the average, so fewer of those about to leave receive an offer they would have benefited from. The owner adds the age band to monitoring and sets a per-group threshold, documented in the model card. - Oversight: discounts above 20% need a CRM manager's approval; weekly monitoring compares offer rates by region. ## Pitfalls - No inventory. AI in vendor tools and side projects escapes every control. - Documentation written once. Model cards must change with each version. - Fairness by library default. The right measure depends on the decision and must be chosen. - Oversight on paper. Reviewers who approve everything are not oversight. - Treating the AI Act timeline as a reason to wait. The data capabilities it requires take time to build. ## Learn more - [Mitchell et al., Model Cards for Model Reporting]() - [NIST AI Risk Management Framework]() - [Hunton Andrews Kurth, EU Digital Omnibus on AI enters into force]() ## Related [Governance roles]() [Training data management]() [LLM applications and evaluation]() [Privacy lifecycle]()