Internal oversight

An AI governance record connects the information needed to explain how an AI system is managed. It covers responsibilities, risks, controls, evidence, decisions, issues, reviews and applicable requirements.

The connections matter. A reviewer should be able to see which control addresses a risk, what evidence supports that control and who approved the relevant decision.

HumanWox maintains these connected records for customer assurance, internal oversight and audit readiness.

Start with the system’s purpose, intended users and named owners. Add the information needed to understand its operation and assess its governance:

• Models, providers and relevant data use.
• Risks and potential impacts.
• Controls and supporting evidence.
• Decisions, including approvals and accepted risks.
• Issues and corrective work.
• Reviews and applicable requirements.

The level of detail should reflect the system’s use and potential consequences. Each entry should help someone make, review or explain a decision.

Assign a named accountable owner and define the responsibilities of the people contributing to its governance. Product, engineering, security, data protection and other functions may each own different parts of the work.

Make decision rights explicit: who can approve deployment, accept a risk, authorise a material change or suspend use?

HumanWox records responsibilities against each AI system, making ownership available to the people maintaining and reviewing its governance record.

Use scheduled reviews and reviews triggered by significant changes. The frequency should reflect the system’s potential impact, operating conditions and relevant commitments.

Review when the system’s purpose, model, provider, data access, autonomy or human oversight changes. A serious incident or an unexpected evaluation result may also require review.

Record the review’s findings, decisions and follow-up work. A completed review should explain what was considered and what happens next.

A leadership report should show the material risks, significant issues and decisions requiring attention. It should also identify accountable owners, progress on agreed actions and changes affecting customers or operations.

Explain the implications. An overdue review matters because a system may have changed without its risks being reassessed.

Use the governance record to support the report, and distinguish confirmed information from gaps requiring further work.