Module 1: AI Foundations for Governance

Purpose

AI governance begins with an accurate description of the system. Before asking whether an AI system is fair, compliant or well controlled, a practitioner must understand what it does, what information it uses, what output it produces and how that output affects a real decision.

By the end of this module, you should be able to:

• explain AI in plain language;
• distinguish AI from fixed-rule software;
• recognise common learning methods and modern AI system types;
• separate training from inference;
• map the AI lifecycle and its main actors; and
• prepare an AI System Description and AI Actor Map.

The continuing case is HireAI, a fictional CV-screening system. You will not assume that its claims are true. You will separate known facts, assumptions and missing evidence.

A practical definition

Artificial intelligence is software that uses data and patterns to produce predictions, classifications, recommendations, generated content or actions.

An AI system normally has four connected parts:

1. Input — information such as text, images, transactions or behaviour.
2. Model or method — the learned patterns or logic applied to the input.
3. Output — a score, category, recommendation, generated answer or action.
4. Use in context — the person or process that relies on the output.

Everyday examples

A phone camera recognises the pattern of a face so it can focus. A spam filter predicts whether a message resembles previously identified spam. A streaming service recommends content from viewing patterns. A bank estimates whether a transaction looks unusual.

The output is not knowledge or judgement in the human sense. It is a result produced from data, patterns and design choices. The governance question is therefore not simply, “Does the model work?” It is, “Is this output suitable for this decision, for these people, in this context?”

The relationship

Artificial intelligence is the broad field. Machine learning is one approach within AI in which a model learns patterns from data. Deep learning is a form of machine learning that uses multi-layer neural networks and is especially useful for complex language, image, audio and video data. Generative AI uses learned patterns to create new content.

Supervised learning

Supervised learning uses examples with known answers. A fraud model may learn from transactions labelled “fraud” or “genuine”. A recruitment model may learn from historical shortlist decisions.

This creates an immediate governance issue: labels can contain mistakes or past discrimination. Practitioners should ask who created the labels, whether the examples represent the intended population and how performance differs across groups.

Unsupervised learning

Unsupervised learning searches unlabelled data for clusters, similarities or unusual cases. It may group customer behaviour or identify transactions that differ from a person’s normal activity.

The system discovers a pattern, but people still decide what that pattern means. A cluster is not automatically a fair or useful category.

Model scope and access

A single-purpose model performs a narrow task such as fraud scoring. A general-purpose or foundation model can support many tasks. A model may be proprietary, open source, text-only or multimodal.

Large language models

An LLM produces language by predicting likely sequences from learned patterns. It can draft, summarise and answer questions, but fluent writing does not prove accuracy. A confident invented answer is often called a hallucination.

Retrieval-Augmented Generation

RAG lets a model retrieve information from approved documents before generating an answer. This can make answers more grounded, but the system may retrieve an outdated, irrelevant or unauthorised source. Evidence should show which source was used and whether access permissions worked.

AI agents

An agent can plan steps and use tools. It may send a message, update a record or create a ticket. Because an agent can cause an action, practitioners must define permissions, approval points, logs, reversibility and a reliable stop mechanism.

Training and inference

Training is when a model learns patterns from data. Inference is when the trained model receives a new input and produces an output.

Risks can arise at both stages. Training data may be inaccurate, incomplete, unlawful or unrepresentative. During inference, the model may receive an unusual input, be used for a different purpose or operate without suitable human review.

Why outputs can fail

AI outputs may be incorrect, biased, incomplete, inconsistent, difficult to explain or overly confident. Performance can also change when real-world behaviour changes; this is commonly called drift.

Risk depends on context. A poor film recommendation is inconvenient. An incorrect recruitment, credit or healthcare recommendation can affect opportunity, money, rights or safety.

Ask:

• What failure is plausible?
• Who experiences the consequence?
• Can the output be checked before action?
• How will errors and unequal outcomes be detected?
• What happens when the system is uncertain?

AI governance covers the complete lifecycle, not only the model-development stage.

1. Plan — define the purpose, benefit, decision boundary, owners and affected people.
2. Assess the use case — decide whether AI is suitable and proportionate.
3. Prepare data — establish source, quality, lawfulness, representativeness and access.
4. Design and build — select the model, supplier, workflow and human role.
5. Test — examine performance, fairness, privacy, security, safety and misuse.
6. Approve and deploy — record the evidence, limitations, residual risk and decision.
7. Monitor and change — track outcomes, incidents, complaints, drift and model updates.
8. Retire — remove access, preserve required records and manage affected processes.

A lifecycle record should show who made each important decision, what evidence they used and what conditions were attached. Governance that begins after launch arrives too late to influence purpose, data and design.

AI systems involve several actors. Their responsibilities must be explicit.

A vendor cannot accept the deployer’s accountability for a recruitment decision. A statement that “a human is involved” is also insufficient. The human needs time, information, competence and authority to challenge the AI output.

An AI Actor Map connects each actor to a decision, responsibility and evidence requirement.

Governance sets direction, decision rights, accountability and acceptable boundaries. Risk management identifies uncertainty and decides how it should be treated.

A useful early risk statement connects three elements:

Because of a cause, an uncertain event may occur, leading to an impact.

For example: because historical recruitment data may reflect past preferences, HireAI may rank qualified non-traditional applicants lower, leading to lost opportunities and discriminatory outcomes.

Early governance questions include:

• Should AI be used for this purpose?
• Who owns the system, risk and controls?
• What decisions may the AI support or make?
• Which people could be affected?
• What testing and evidence are required before approval?
• Who can restrict, pause or stop the system?
• How will complaints, appeals and incidents be handled?

Unknown information is not a reason to invent an answer. It is an evidence gap to record, assign and resolve.

HireAI is a fictional system proposed for first-pass CV screening. It analyses CVs and application responses, produces a candidate score and recommends who should progress to recruiter review.

Intended boundary

• It supports first-pass screening.
• It does not make the final hiring or salary decision.
• A recruiter should review recommendations before rejection.
• Candidates should be informed and able to request review.

Known inputs and outputs

Known inputs include CV text, application answers and job requirements. The output is a score and shortlist recommendation. Details about training data, model architecture, subgroup performance and explanation methods remain unknown.

Practitioner focus

The Week 1 assignment does not decide whether HireAI is fair. It first creates a reliable description of the system and maps the actors around it. That description becomes the foundation for the Week 2 harm assessment.

Key points

• AI produces outputs from inputs, data and learned patterns.
• The output must be assessed in its real decision context.
• Training creates the model; inference uses it on a new input.
• LLMs, RAG systems and agents introduce different capabilities and controls.
• Governance covers the complete lifecycle.
• Providers, deployers, users and affected people have different roles.
• Missing information should be recorded as an evidence gap.

Before continuing

You should be able to describe HireAI without marketing language, identify the main actors, explain where human judgement enters the process and state which facts are still unknown. Your homework converts that understanding into an AI System Description and AI Actor Map.