Do You Actually Know What AI Governance Is?

Question 1

An organization has a strong AI policy that everyone follows, but it was never written down, dated or approved. In governance terms, what do they have?

Accepted Answer

No governance — regulators, auditors, insurers and courts recognise only what is written, dated, approved and retrievable — The field guide's definition is load-bearing on the word documented: governance that exists only in someone's head, or in “the way we do things here,” is not governance. The entire point is that a third party can verify it happened.

Answer

Adequate governance, because the practice is consistent

Answer

Governance that would satisfy an auditor but not a regulator

Answer

Governance, provided the CISO can describe it accurately under questioning

Question 2

A company runs a SIEM, an AI security posture platform, DLP and a CASB. The auditor asks to see their AI governance. What have they actually got?

Accepted Answer

Observability and enforcement — necessary, valuable, and neither one governs — Observability sees what is happening at runtime. Enforcement controls what is technically allowed. Governance decides, documents and proves what is permitted and how risk is managed. A screenshot of a firewall rule is not an answer to “show me your acceptable use policy and risk assessment.”

Answer

Governance, since those tools enforce and monitor AI use

Answer

Governance for Layer 1 tools only

Answer

Enough to satisfy the request, because the tooling produces logs

Question 3

An organization completed a thorough AI risk assessment in January. By June, four new AI tools are in use and nothing has been re-assessed. Which standard have they failed?

Accepted Answer

Due diligence, because it is a motion standard and the surface changed — Due care is a snapshot standard: did you put reasonable safeguards in place. Due diligence is a motion standard: are you continuously verifying they still work. An organization can satisfy due care on Monday and lose due diligence by Friday if its AI surface changed and nothing was re-assessed.

Answer

Due care, because the original assessment is now invalid

Answer

Neither — an annual assessment is the accepted standard

Answer

Both, because a lapsed assessment voids the original

Question 4

In the field guide's RACI, exactly one role is Accountable for the AI Acceptable Use Policy. Which one?

Accepted Answer

The CEO, because the AUP is a leadership document that carries weight only if leadership signed it — The CISO is Responsible — they do the work — but the CEO is Accountable. The AUP carries weight because leadership signed it and consequences attach to violating it. Accountability is always one name, never a team or a committee.

Answer

The CISO, who owns security risk

Answer

General Counsel, because the policy has legal effect

Answer

The board, through its oversight duty

Question 5

Which layer of shadow AI is invisible to network log analysis, because it rides inside traffic the organization already sanctioned?

Accepted Answer

Layer 2 — embedded AI inside SaaS the company already pays for — Embedded AI — Microsoft 365 Copilot, Salesforce Agentforce, Slack AI, GitHub Copilot, Workday — travels inside sanctioned application traffic, so network tooling sees nothing unusual. Layer 3 is separately invisible to MDM, EDR and DLP simultaneously.

Answer

Layer 1 — direct AI tools such as ChatGPT or Claude

Answer

Layer 3 — unmanaged BYOD AI authentication

Answer

Layer 4 — autonomous agents acting on company data

Question 6

The field guide names one attribute as the most important property of any AI tool in a governance programme. Which is it?

Accepted Answer

The training-on-inputs policy — whether the tier in use retains the right to train on what employees paste in — Free tiers commonly retain the right to train on inputs; paid API tiers contractually do not. An employee pasting a customer contract into a free-tier chatbot may have contributed confidential terms to a commercial model's training data.

Answer

Whether the vendor holds SOC 2 certification

Answer

Whether the tool is hosted in the organization's own region

Answer

Whether the tool supports single sign-on

Question 7

The EU AI Act's Article 4 AI literacy duty — when did it become a live obligation?

Accepted Answer

It has been in force since February 2, 2025, and was not deferred — The 2026 Digital Omnibus split the EU AI Act timeline rather than delaying it. High-risk obligations moved to December 2027 and August 2028, but Article 4 literacy has been in force since February 2, 2025 and was not deferred.

Answer

December 2, 2027, with the high-risk regime

Answer

August 2, 2026, alongside Article 50 transparency

Answer

It takes effect when a member state adopts implementing legislation

Question 8

A reviewer challenges an AI output by asking the same model “are you sure?” and accepts the answer that survives. What does the research say about this control?

Accepted Answer

It is deprecated — challenged models tend to escalate persuasive rhetoric rather than correct the answer — Randazzo et al. (Harvard Business School Working Paper 26-021) documented persuasion bombing: challenged conversationally, models escalate across fourteen identified tactics spanning ethos, logos and pathos rather than correcting themselves. Effective oversight needs structurally independent checks — a second model from a different vendor, independent recomputation, or structured disconfirmation.

Answer

It is effective, because it forces the model to re-examine its reasoning

Answer

It is adequate for low-risk decisions and insufficient for high-risk ones

Answer

It works if the reviewer is sufficiently senior

Question 9

Which single artifact surfaces across all four consequence channels — the insurance renewal, the audit sample, the procurement questionnaire and legal discovery?

Accepted Answer

The Executive Risk Report — The AUP is the most-requested single artifact overall, but the Executive Risk Report is the one that appears in every channel: the exhibit an underwriter wants, the assessment an auditor samples, the document procurement now asks for, and the record discovery reads for evidence of care.

Answer

The AI Acceptable Use Policy

Answer

The board minute acknowledging AI risk

Answer

The AI tool registry

Question 10

Why can a once-a-year consulting assessment no longer satisfy the due-diligence standard?

Accepted Answer

Because due diligence has a denominator — the rate of change of the risk surface — now measured in hours — Due diligence is a ratio: your audit cadence over the rate of change of your risk surface. Time-to-exploit collapsed from 2.3 years in 2018 to roughly 10 hours in 2025, mean-time-to-exploit has gone negative, and threat-actor handoff is measured in seconds. An annual snapshot is stale on arrival.

Answer

Because regulators have set a mandatory quarterly review cycle

Answer

Because annual assessments are not accepted as evidence

Answer

Because consultants cannot sign attestations

Do you actually knowwhat AI governance is?

An organization has a strong AI policy that everyone follows, but it was never written down, dated or approved. In governance terms, what do they have?

Do you actually know
what AI governance is?