TL;DR: A governance program makes AI accountable and auditable across its lifecycle: documentation (model cards, datasheets, intended use and limits), an inventory of deployed models with named owners, risk classification (the EU AI Act tiers controls by risk), lifecycle gates (approval, bias/safety testing, human oversight for high-risk uses), monitoring, and audit trails. It maps technical practice to obligations (SOC 2, GDPR/DPDP, EU AI Act) and pins clear accountability to each model.
How to approach it. Frame governance as the operating system for responsible AI: documentation, accountability, risk-tiered controls, and audit, not a one-time legal checkbox. Walk the components, anchor to the major regimes (especially the EU AI Act's risk tiers), and stress lifecycle coverage and a named owner per model.
A strong answer. What it is for. Governance ensures every deployed model is documented, owned, risk-assessed, controlled in proportion to that risk, monitored, and auditable, so the organization can demonstrate responsibility to regulators, customers, and itself. The components:
- Documentation. Model cards (intended use, performance across subgroups, limitations, training-data summary, ethical considerations) and datasheets for datasets (provenance, collection, consent, known biases). This is the artifact auditors and enterprise buyers ask for first.
- Model inventory and ownership. A registry of which models run where, each with a named accountable owner. You cannot govern what you cannot enumerate, and clear ownership is the backbone.
- Risk classification (EU AI Act). The Act scopes obligations to risk, so you classify each system first and then apply proportional controls instead of one-size-fits-all.
- Lifecycle controls. Approval gates before deployment (review of evals, bias and fairness testing, safety testing), human oversight for high-risk decisions (the model is never the sole gate), change management, and decommissioning.
- Monitoring and audit trails. Ongoing tracking of performance, drift, and fairness in production, plus immutable logs and lineage (which data and code produced a model, who accessed what) so any decision can be reconstructed.
- Mapping to regimes. SOC 2 (security controls and evidence), GDPR/DPDP (consent, access, erasure), the EU AI Act (risk-tiered AI obligations). Design to the strictest applicable, and keep the evidence.
The EU AI Act tiers are the part interviewers want you to make concrete:
| Tier | Examples | What you owe |
|---|---|---|
| Unacceptable | Social scoring, manipulative systems | Banned outright |
| High-risk | Hiring, credit, critical infrastructure | Risk management, data governance, documentation, human oversight, transparency, robustness |
| Limited-risk | Chatbots, synthetic media | Disclosure (tell users it is AI / synthetic) |
| Minimal | Spam filters, game AI | Largely unregulated |
A model moves through governance like a release pipeline:
Key takeaways
- Classify risk first, then scope controls to the tier; uniform controls over-burden low-risk systems and under-protect high-risk ones.
- No inventory and no named owner means nothing is actually accountable, the most common real-world gap.
- Lineage, evals, monitoring, and immutable audit logs are the engineering substrate governance runs on, not paperwork bolted on later.
- Design to the strictest applicable regime and retain the evidence, because audits and incidents arrive without warning.
What interviewers probe next.
- "What is in a model card?" Intended and out-of-scope uses, performance including per-subgroup, limitations and failure modes, training-data summary, and ethical or safety considerations.
- "How do the EU AI Act tiers change what you build?" High-risk demands risk management, data governance, documentation, human oversight, robustness, and transparency; lower tiers need far less. Classify first, then scope controls.
- "Who is accountable when a model causes harm?" A named owner per model, plus the governance process. "The model decided" is not an answer, which is exactly why human oversight and documentation exist.
- "How does this connect to engineering practice?" Reproducibility and lineage (registry), bias and safety evals, monitoring, and audit logs are the technical layer governance sits on.
Common mistakes.
- Treating governance as a legal afterthought rather than a lifecycle engineering practice.
- No model inventory or owners, so nothing is genuinely accountable.
- One-size-fits-all controls instead of risk-tiered, over-burdening low-risk and under-protecting high-risk.
- Documentation and audit trails that do not exist until an auditor or incident demands them.