About

analytics, paper, hand, holding, business, plan, results, marketing, concept, management, accounting, market, businessman, man, element, infographic, audit, report, chart, data, information, numbers, check, reading, blue paper, blue marketing, blue data, blue reading, blue information, blue businessman, blue numbers, blue plan, blue planning, blue accounting, blue check, blue management, blue market, audit, audit, audit, audit, audit

Measuring Governance Effectiveness – Moving from Policy to Evidence

AI governance that exists only in policy documents is not governance – it is documentation. Effective programs generate evidence of their operation: metrics that demonstrate what is actually happening, maturity assessments that identify gaps and prioritize remediation, and board-ready reporting that translates technical performance into executive accountability. This chapter covers the measurement infrastructure that separates operational governance from governance theater. KPIs for AI Governance Programs The following KPIs represent the core measurement set for a Read more

The People Side – AI and the Workforce: AI Literacy as a Legal Obligation

Article 4 of the EU AI Act entered into force on February 2, 2025 – making AI literacy the first EU AI Act obligation to apply in practice. It requires providers and deployers of AI systems to “take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, Read more

AI Governance in the Public Sector

Private-sector advisors who work with government clients – or whose clients sell products and services to governments – have a direct interest in public-sector AI governance. Government AI procurement requirements frequently cascade to vendors: if an agency must demonstrate that its AI tools meet certain standards, the vendor supplying those tools must meet those standards too. Understanding public-sector governance requirements is competitive intelligence for anyone operating in or adjacent to the government market. Canada: Federal Read more

AI Governance for Small and Mid-Sized Organizations – The Framework Problem

Most published AI governance frameworks were designed with large, well-resourced organizations in mind. The NIST AI RMF Playbook, ISO/IEC 42001, and the EU AI Act conformity assessment process all assume access to dedicated legal, compliance, data science, and ethics functions – resources that most small and mid-sized enterprises (SMEs) simply do not have. An organization with 50 employees and a single IT generalist faces a different governance challenge than a bank with a model risk Read more

Vertical Market Governance Considerations and Why the Sector Matters

A generic AI governance framework provides a starting point. Regulatory obligations, however, are sector-specific – and the gap between a general policy and a compliant program widens quickly once you enter a regulated industry. This chapter covers the requirements that apply directly to financial services (with particular focus on credit unions), healthcare, employment, insurance, and critical infrastructure. Financial Services: Model Risk Management Baselines The model risk management (MRM) discipline – the practice of identifying, assessing, Read more

AI, Privacy, and Data Governance – The Intersection Is Unavoidable

AI systems, by definition, are data systems. They are trained on data, they ingest data at inference time, they produce data-derived outputs, and they frequently generate inferences about individuals that those individuals never consented to produce. Every AI deployment in an organization is simultaneously a data governance question, a privacy law compliance question, and – in regulated sectors – a model risk management question. For Canadian organizations, this intersection is governed by at least three Read more

AI and Cybersecurity – A Bidirectional Relationship

AI and cybersecurity interact in two directions simultaneously. AI is an attack surface – AI models can be manipulated, poisoned, and exploited in ways that legacy security frameworks do not address. And AI is a defensive tool – AI-powered threat detection, behavioral analytics, and automated response are materially changing the speed and effectiveness of security operations. Organizations that govern only one direction of this relationship are exposed on the other. MITRE ATLAS: The Framework for Read more

Governing Agentic AI – What Agentic AI Is

Agentic AI refers to AI systems that perceive their environment, form and pursue goals over multiple steps, take actions using tools and APIs, and operate across extended tasks without moment-to-moment human direction. Unlike conventional AI, which generates a single output in response to a single prompt, an agentic AI system can plan sequences of actions, use external tools (web search, code execution, database queries, API calls), adapt its approach based on intermediate results, and – Read more

Governing Generative AI Specifically – Why Generative AI Is Different

Traditional machine learning models are narrow in scope: a fraud detection model flags transactions; a credit scoring model outputs a risk score. Their failure modes, while consequential, are generally bounded and measurable. Generative AI (GenAI) – large language models, image generators, code assistants, and multimodal systems – is different in kind. It produces open-ended outputs across almost any domain, with no fixed output space. This creates a qualitatively different risk profile: the same system that Read more

AI Procurement and Third-Party Risk – Where AI Risk Now Enters Most Organizations

For most enterprises today, the primary source of AI risk is not internal AI development. It is the AI embedded in the software they have already purchased. Microsoft 365 Copilot, Salesforce Einstein, ServiceNow’s AI features, HR platforms with automated screening, and financial tools with embedded prediction models all represent AI deployments that most organizations made by clicking “enable” in existing SaaS subscriptions – not by building systems from scratch. This matters for governance because the Read more