4.1.3. Governance by Design
💡 First Principle: The cost of fixing a responsible AI problem grows with every stage it survives. At use-case intake, a fairness concern is a design choice; after training, it is a rebuild; after launch, it is an incident. Governance by design moves responsible AI questions to the earliest point where they can change the plan, and keeps them present at every stage after.
The exam guide asks when responsible AI practices should be integrated into AI project planning. The answer is from the beginning, and then throughout:
| Lifecycle stage | Responsible AI activities |
|---|---|
| Use-case intake and ideation | Initial risk classification; is AI appropriate? Which dimensions are most at stake? Is this use permitted (legal, policy, prohibited practices)? |
| Business case and planning | Impact assessment; define fairness, transparency, and oversight requirements; budget for testing, monitoring, and governance; identify accountable owner |
| Data sourcing | Data rights and consent, representativeness, privacy review, provenance and IP |
| Build or procurement | Vendor due diligence (AI Service Cards, data use terms, IP indemnity), evaluation criteria including fairness and robustness, guardrail design |
| Testing and approval | Fairness and robustness testing, red-teaming for misuse, explainability checks, governance sign-off proportional to risk |
| Deployment | Transparency notices, human oversight procedures, escalation paths, user training |
| Operation and monitoring | Drift and bias monitoring, incident response, feedback channels, periodic re-review |
| Retirement | Data retention and deletion, communication, transition of decisions back to people or new systems |
An AI impact assessment at intake is the anchor activity. It describes the purpose, affected stakeholders, data used, potential harms, risk tier, and planned mitigations, and it determines how much governance the initiative needs. This is also where ISO/IEC 42001-style management system thinking shows up in practice: a repeatable process rather than ad hoc reviews.
Governance by design also speeds delivery. Teams that know the requirements up front build to them once, rather than discovering at a late review that the system cannot be approved.
⚠️ Exam Trap: When asked when to integrate responsible AI practices, choose the earliest planning stage (use-case intake or project planning) with continuation through the lifecycle. Options that place responsible AI only at testing, at launch, or after an incident are distractors.
Reflection Question: A team has built a working prototype of an AI tool that prioritizes social-services cases and now asks for a responsible AI review before launch. What problems might a late review uncover that would have been cheaper to address at intake?
