Skip to content
AI Training

Governance and oversight

Safety · topic safety/governance

Once agents work inside an organization, individual care is not enough. This topic covers the shared controls: a policy that says what is allowed, logs that make agent actions reviewable, awareness that a model update can change behavior overnight, a clear route for escalating when something goes wrong, the regulation that applies to AI use, and a method for assessing a use case's risk before it starts.

Concepts

Policy
A written statement of which AI tools may be used, with what data, for what tasks, and with what checks before results are relied on. A good policy is short, names owners and gives examples of allowed and disallowed use. Without one, every person invents their own rules and the organization's exposure is the sum of the most careless choices. glossary
Logging and audit
Recording what an agent was asked, what it did, which tools it called and what changed, so that a person can later reconstruct and judge its actions. Logs turn an opaque incident into a traceable one and make patterns visible across many sessions. Store them where the agent itself cannot edit them, and review a sample even when nothing has gone wrong. glossary
Model change risk
Providers update models, and a workflow that behaved well can behave differently after an update: a format changes, a refusal appears, a shortcut is taken. Because the model is outside your control, treat each change like a dependency upgrade: pin versions where possible, keep a test set that represents your tasks, and re-run it when the model changes. glossary
Escalation
The agreed route for raising an AI-related problem: a leaked document, an agent that took a wrong action, output that harmed someone. It names who to tell, how fast and what to preserve. People report faster when the route is known and blameless, and the organization learns from near-misses instead of only from disasters. glossary
Regulation
Law that applies to how an organization builds and uses AI, with the EU AI Act as the main example. It defines what counts as an AI system, sorts uses into risk tiers from prohibited to minimal, and puts different duties on the provider who builds a system and the deployer who uses it. Deployers owe transparency to the people affected and must make sure their staff have enough AI literacy for the tools they use. glossary
Risk assessment
A short, written method for judging an AI use case before it starts. Name the domains it touches, such as personal data, money, safety or reputation, then rate impact and likelihood on agreed scales and combine them into a level. A level above the agreed threshold needs extra controls or a decision, in writing, from someone with the authority to accept the risk. The record is what makes the decision reviewable later. glossary

Lessons

Your reference

Each lesson above adds its takeaways and its example here once you finish it. Your reference lists every lesson you have finished.

Assessing the risk of a use case before it starts

Unlocks when you finish Assessing the risk of a use case before it starts.

Introduction to the EU AI Act

Unlocks when you finish Introduction to the EU AI Act.

Reading agent logs and rerunning after a model change

Unlocks when you finish Reading agent logs and rerunning after a model change.

Writing an AI policy a team can apply

Unlocks when you finish Writing an AI policy a team can apply.

Sources