What AI governance is
A school has rules, a principal, a bell schedule and a lost-and-found box. That is how everyone knows what to do and who to ask. AI governance is the same thing for AI at work: the rules, the people in charge, and the way you check that the rules are followed.
- AI governance means the policies, roles, processes and records that guide how an organization chooses, uses and watches AI. Course 1.8.2 gave you the one-page risk check; governance makes it repeatable across a whole organization.
- The U.S. National Institute of Standards and Technology (NIST) published its AI Risk Management Framework (AI RMF 1.0) on January 26, 2023. It is voluntary. Its four core functions are Govern, Map, Measure and Manage. NIST also published a Generative AI Profile on July 26, 2024.
- Canada's Government of Canada guide on generative AI for federal institutions sets out six principles, summarized as FASTER: Fair, Accountable, Secure, Transparent, Educated, Relevant. The guide is written for public servants, but a business can borrow the ideas.
- The Government of Canada's Voluntary Code of Conduct on advanced generative AI systems (launched September 2023) has six principles: accountability, safety, fairness and equity, transparency, human oversight and monitoring, and validity and robustness. It is voluntary and aimed at organizations that build or run advanced generative AI systems.
- This course uses one simple map that fits all of the above:
| Job | The question | Where it appears in this course |
|---|---|---|
| Govern | Who is responsible, and what are the rules? | Lesson 4 (policy), Lesson 7 (roles, review) |
| Map | What AI do we use, for what, with whose data? | Lesson 5 (inventory and tiers) |
| Measure | Is it working fairly and safely? | Lesson 6 (audit) |
| Manage | What do we do about problems? | Lesson 6 and 7 (fixes, records, incidents) |
- The four jobs are this course's plain-language map of the NIST function names. For what NIST actually says, read the framework itself.
- Write the name of your organization or team at the top of a page (a small business, club or class project is fine).
- Write the four words Govern, Map, Measure, Manage in a column.
- Next to each word, write one thing your team already does that fits (for example "Govern: we have a Do and Don't sheet from course 1.8.2").
- Next to each word, write one thing that is missing.
- Circle the word with the biggest gap. This is where you start.
- Check: every word has one thing you have and one thing you lack, and one word is circled.
Videos by other creators on YouTube, for reference. They are not made by or affiliated with The Future Market.
Read the video script
[Host] "Good rules for AI are not just a document. They are rules, people and checks that work together."
[Text on screen: Govern · Map · Measure · Manage] "NIST, a U.S. standards body, names four jobs: govern, map, measure and manage."
[Text on screen: Who is responsible? What AI do we use? Is it working? What do we fix?] "Who is responsible? What AI do we use? Is it working fairly? What do we fix?"
[Host] "Find the biggest gap in your team and start there."
Fill in the four-word page for one real team. Write one thing you have and one thing you lack for each job, and circle the biggest gap.
ClaudeStuck? Copy a ready-made prompt for Claude
Copy this, open Claude, paste it, and Claude will walk you through the lesson step by step.
For a grown-up: Claude is for adults (18+). Copy this, paste it into Claude, and use the answer to explain the lesson to your child.
I'm learning "AI Governance Basics: policies, audits and compliance" on The Future Market. Lesson 1: "What AI governance is". What the lesson teaches: - AI governance means the policies, roles, processes and records that guide how an organization chooses, uses and watches AI. Course 1.8.2 gave you the one-page risk check; governance makes it repeatable across a whole organization. - The U.S. National Institute of Standards and Technology (NIST) published its AI Risk Management Framework (AI RMF 1.0) on January 26, 2023. It is voluntary. Its four core functions are Govern, Map, Measure and Manage. NIST also published a Generative AI Profile on July 26, 2024. - Canada's Government of Canada guide on generative AI for federal institutions sets out six principles, summarized as FASTER: Fair, Accountable, Secure, Transparent, Educated, Relevant. The guide is written for public servants, but a business can borrow the ideas. - The Government of Canada's Voluntary Code of Conduct on advanced generative AI systems (launched September 2023) has six principles: accountability, safety, fairness and equity, transparency, human oversight and monitoring, and validity and robustness. It is voluntary and aimed at organizations that build or run advanced generative AI systems. - This course uses one simple map that fits all of the above: - Job - The question - Where it appears in this course - Govern - Who is responsible, and what are the rules? - Lesson 4 (policy), Lesson 7 (roles, review) The exercise I'm working on: Fill in the four-word page for one real team. Write one thing you have and one thing you lack for each job, and circle the biggest gap. I'm stuck. Please: 1. Explain the main idea in plain, simple words with one everyday example. 2. Walk me through the exercise one small step at a time. Ask me what I've done so far before giving the next step. 3. Don't just give me the final answer. Help me do it myself, and check my work when I share it.
I'm a parent helping my child (about 8 years old) with a lesson called "What AI governance is" from the course "AI Governance Basics: policies, audits and compliance". Here's what the lesson says: A school has rules, a principal, a bell schedule and a lost-and-found box. That is how everyone knows what to do and who to ask. AI governance is the same thing for AI at work: the rules, the people in charge, and the way you check that the rules are followed. The activity: Fill in the four-word page for one real team. Write one thing you have and one thing you lack for each job, and circle the biggest gap. Please explain this so an 8-year-old understands: short sentences, a fun everyday example, and no hard words. Then give me 3 simple questions I can ask my child to check they understood, and a way to do the activity together, one tiny step at a time.
Sources
- NIST, AI Risk Management Framework: www.nist.gov/itl/ai-risk-management-framework
- Government of Canada, Guide on the use of generative artificial intelligence: www.canada.ca/en/government/system/digital-government/digital-governme
- Innovation, Science and Economic Development Canada, Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems: ised-isde.canada.ca/site/ised/en/voluntary-code-conduct-responsible-de
Privacy law in plain words (Canada's PIPEDA as the worked example)
This lesson is part of full access: every course and every level for one payment.
Where AI rules stand (Canada as the worked example)
This lesson is part of full access: every course and every level for one payment.
Draft an AI use policy
This lesson is part of full access: every course and every level for one payment.
Inventory and risk tiers
This lesson is part of full access: every course and every level for one payment.
Run a use-case audit
This lesson is part of full access: every course and every level for one payment.
Records, training and knowing when to call for help
This lesson is part of full access: every course and every level for one payment.
Final project
This lesson is part of full access: every course and every level for one payment.
Quiz
What are NIST's four core AI risk management functions?
Govern, Map, Measure and Manage.
Why check whether a proposed AI bill is in force before relying on it?
Proposed bills can fail or change; only a law that has passed applies.
A new privacy bill is read in parliament for the first time. What is its status?
Proposed, not law; check your parliament's official bill tracker.
Name three common fair information principles in privacy law.
For example accountability, consent, limiting collection, safeguards, openness.
Why check which privacy law covers your customers?
Countries, and sometimes states or provinces, have different laws; check where your customers live.
What is good practice when a decision about a person is based only on automated processing?
Tell the person, and let them ask someone who can review it.
What does an AI impact assessment produce?
A risk level that sets the checks needed for an automated decision system.
Name four sections of a short AI use policy.
For example purpose and scope, approved tools, data rules, human review, high-impact uses, disclosure, reporting, owner and review date, exceptions.
In the course's three-tier model, what makes a use High risk?
It affects a person's job, home, money, health, school results or rights.
In an audit, how do you treat a missing piece of evidence?
As a Fail, with a fix, an owner and a date.
Why keep a record of every data breach, and for how long?
To show what happened and how it was handled; keep it for as long as your country's law requires.
Name two situations where you should call a privacy officer or lawyer.
For example a leak, a complaint, decisions about people, a vendor contract, unsure which law applies.
Final exam
This lesson is part of full access: every course and every level for one payment.
Certificate
This lesson is part of full access: every course and every level for one payment.