Recommended resources
The freely available resources this lesson will direct you to.
- Security & AI Governance: Reducing Risks in AI Systemswww.youtube.com
- How to Break Into AI Governance Without Any Experiencewww.youtube.com
- EU AI Act, NIST RMF and ISO/IEC 42000: A Plain English Comparisonwww.eccouncil.org
- Data Governance for AI: 2025 Challenges, Solutions & Best Practiceswww.quinnox.com
Hello! In our previous lesson, we established a clear understanding of the unique risks posed by AI systems, namely model bias, opacity, and data drift. This foundation is crucial, as you can't govern what you can't define.
This lesson directly builds on that knowledge to address the learning outcome: Map existing IT governance controls and processes to their AI governance counterparts. With your decade of experience in IT governance, you possess a robust toolkit of frameworks, controls, and processes. The goal today is not to discard that expertise but to adapt and extend it. We will explore how familiar concepts like asset management, risk assessment, and data governance are being reshaped to manage the specific challenges of AI.
1. The Hybrid Approach: Augmenting, Not Replacing, IT Governance
A common misconception is that AI governance requires starting from a blank slate. In practice, mature organizations are adopting a "hybrid approach"—integrating new, AI-specific frameworks with their existing, proven IT governance structures. This is excellent news, as it means your current skills are highly transferable.
Let's begin with a video that clearly articulates this real-world strategy.
How to Break Into AI Governance Without Any Experience
In this clip from the "Tech Woke" channel, the speaker, Marisha Snape, explains how practitioners are building AI governance programs in the real world.
Watch the segment from framework integration. Pay close attention to how she describes combining familiar frameworks like NIST 800-53 and the NIST Cybersecurity Framework (CSF) with newer, AI-focused ones like the NIST AI Risk Management Framework (RMF) and the EU AI Act.
The key takeaway here is that you don't throw away your NIST 800-53 control catalog. Instead, you use it as a foundation and map the new requirements from frameworks like the NIST AI RMF back to it. This approach ensures consistency and leverages the investment your organization has already made in its GRC (Governance, Risk, and Compliance) programs.
As the speaker notes, AI governance is essentially a subset of your broader GRC function, tailored to a new type of technology.
2. Mapping a Core Domain: From Data Governance to AI Data Governance
Let's start our mapping exercise with a domain you know well: data governance. In traditional IT, data governance focuses on ensuring data is accurate, available, and secure, primarily for reporting and business intelligence. When AI enters the picture, the scope and stakes change dramatically.
The following resource provides an excellent, direct comparison that highlights these changes.
Data Governance for AI: 2025 Challenges, Solutions & Best Practices
This article from Quinnox provides a clear definition of data governance for AI and a powerful comparative table.
Read the introduction and the sections "What is Data Governance for AI?" and "Traditional Data Governance vs AI-Driven Governance." Focus on the table, as it provides a direct mapping of the concepts.
As the table in the article illustrates, the shift is significant:
| Governance Aspect | Traditional IT Governance Counterpart | AI Governance Counterpart |
|---|---|---|
| Focus | Structured data, reporting accuracy | Unstructured & real-time data, model training |
| Goal | Data quality for compliance & reuse | Model fairness, trust, and explainability |
| Scope | Data cataloging, access control | Data lineage, annotation standards, AI ethics |
| Stakeholders | IT, compliance, data stewards | Data scientists, ML engineers, legal, ethics teams |
Your existing knowledge of data classification, access control, and quality management is the foundation. The "AI counterpart" builds upon it by adding new layers to address the risks we discussed in the last lesson. For example:
- Data Lineage becomes critical to combat opacity. You need to trace data from its source to the model's prediction to understand and explain outcomes.
- Data Quality now includes assessing for historical bias in addition to just checking for accuracy and completeness.
3. Mapping Specific Controls and Processes
Now let's move from a broad domain to specific controls and processes. How does a familiar control like "Access Control" or a process like "Change Management" translate to the world of AI?
Distinguishing Governance and Security Controls
First, it's helpful to organize our thinking. In your IT experience, security and governance are intertwined. In AI, it's useful to make a conceptual distinction. The following video draws a clear line between controls aimed at preventing internal, "self-inflicted" issues (governance) and those aimed at stopping external threats (security).
Security & AI Governance: Reducing Risks in AI Systems
This video from IBM Technology, "Security & AI Governance," breaks down the different concerns and controls for each discipline.
Watch these two key segments: Concerns and Causes: Notice the distinction between governance issues (responsibility, explainability, bias) and security issues (vulnerabilities, attacks). Governance vs. Security Controls: This section provides a list of specific controls for each area, which serves as a great mapping tool.
This distinction helps clarify where to focus. While a CISO is focused on prompt injection attacks, an AI governance professional is focused on ensuring the model was trained on appropriate data and its outputs are fair.
A Control Mapping Table
Let's synthesize this into a practical mapping table. This connects familiar IT governance controls to their new or expanded AI governance counterparts, linking them to the risks they help mitigate.
| IT Governance Control/Process | AI Governance Counterpart | Key AI Risk Mitigated |
|---|---|---|
| Asset Management (e.g., CMDB) | AI System Inventory & Model Cards: A registry of all AI models, their purpose, data sources, owners, and risk level. | Opacity, Bias |
| Access Control (e.g., RBAC) | Fine-grained Access to Models & Data: Controls not just on who can use the model, but who can retrain it, and what data can be used. | Bias, Data Drift |
| Change Management | Model Lifecycle Management: Formal processes for model retraining, validation, and retirement when performance degrades. | Data Drift |
| Risk Assessment | AI Impact/Fairness Assessment: Specific assessments to identify potential for discriminatory outcomes or societal harm before deployment. | Bias |
| System Monitoring | Continuous Model Monitoring: Automated checks for feature drift, concept drift, and fairness degradation in production. | Data Drift, Bias |
| SDLC / Secure Coding | Responsible AI by Design: Embedding checks for fairness, data quality, and explainability into the model development process. | Bias, Opacity |
| Third-Party Risk Management | Model Provenance & Lineage Tracking: Verifying the source and authenticity of third-party models and training data. | Opacity, Bias |
This isn't about replacing your existing controls. It's about enhancing them with new questions and requirements. For example, your existing third-party risk assessment process for a new software vendor would be adapted to ask new questions for an AI vendor: "Can you provide the model card for this API?" or "What data was this foundation model trained on, and what are its known limitations?"
4. Integrating Frameworks: The Crosswalk
As a governance professional, you know that mapping controls across different frameworks (e.g., ISO 27001 to NIST CSF) is a common and necessary task. The same principle applies in AI governance. An "AI crosswalk" is a document that maps the requirements of various regulations and standards to a central control framework, like the NIST AI RMF or ISO 42001.
This is how you build a program that can demonstrate compliance with multiple obligations simultaneously.
This cheat sheet is a great starting point. For a more detailed look, the table in the following resource provides a concrete example of a crosswalk for a high-risk AI system.
EU AI Act, NIST RMF and ISO/IEC 42000: A Plain English Comparison
This article from the EC-Council explains the concept of a crosswalk and provides a clear, tabular example.
Read the section "Mapping Frameworks: Toward Integrated Compliance." Focus on the table that aligns requirements from the EU AI Act, NIST AI RMF, and ISO 42001 for controls like "Data governance" and "Human oversight."
This mapping exercise is the core of practical AI governance. It translates legal and ethical principles into auditable controls, building directly on the methodologies you've used throughout your career in IT governance.
Conclusion
In this lesson, we have built a crucial bridge between your extensive IT governance background and the emerging field of AI governance. You don't need to start over; you need to adapt and extend what you already know.
Here are the key takeaways:
- AI governance augments, not replaces, IT governance. The most effective approach is a hybrid one, mapping new AI-specific requirements from frameworks like the NIST AI RMF back to established control sets like NIST 800-53.
- Familiar governance domains and controls have direct AI counterparts. Data governance expands to include fairness and lineage; asset management becomes model inventory management; and monitoring evolves to detect data and concept drift.
- The goal is to enhance existing processes with new questions. Your current vendor risk assessment process is still valid; it just needs new questions about model provenance and training data.
- Crosswalks are practical tools for mapping controls across multiple AI regulations and standards, ensuring comprehensive and efficient compliance.
You are now equipped to see how the puzzle pieces fit together. In our next lesson, we will continue this practical focus by outlining the key roles and responsibilities unique to an AI governance structure, such as the AI Ethics Board and the Model Risk Owner. This will answer the question of who owns and executes the processes we've mapped out today.