Week 22 self-check | AI GRCA Practice Lab

WEEK 22 · Controls, operations & judgement · Integrated AI Governance Operating Model

What is the purpose of an 'exceptions and waivers' process?

Waivers remove the need for any future reviewTo let anyone bypass governance permanentlyTo allow a documented, time-limited departure from standard process, with a compensating control and named approverExceptions should never be granted under any circumstance

WEEK 22 · Controls, operations & judgement · Integrated AI Governance Operating Model

What is the purpose of an integrated AI governance lifecycle?

To slow down every AI project equallyTo connect intake, risk tiering, specialist review, release, monitoring and retirement into one coherent processTo replace the need for any specialist legal or privacy reviewTo apply only to generative AI systems

WEEK 22 · Controls, operations & judgement · Integrated AI Governance Operating Model

What's a reasonable trigger for a 'security review' at intake?

The system integrates with external tools, APIs or handles sensitive dataSecurity review is only needed after a breachSecurity review only applies to open-source systemsThe system has no external connections and processes no sensitive data

WEEK 22 · Controls, operations & judgement · Integrated AI Governance Operating Model

What's the difference between 'risk acceptance' and simply ignoring a risk?

They are the same thing in practiceRisk acceptance is a deliberate, documented decision by an authorised role; ignoring is an absence of any decisionIgnoring a risk is always the safer optionRisk acceptance means the risk no longer exists

WEEK 22 · Controls, operations & judgement · Integrated AI Governance Operating Model

What is an 'external communication plan' for AI incidents meant to define?

Who is told what, when, by whom, and how uncertainty is acknowledged if a real-world impact occursOnly the internal engineering responseA synonym for the model cardNothing — communication should be improvised

WEEK 22 · Controls, operations & judgement · Integrated AI Governance Operating Model

What's a key governance trade-off between hosted and self-hosted deployment?

Self-hosting always eliminates the need for security controlsHosted deployment is always illegal under UK GDPRNo meaningful trade-off existsHosted deployment can mean less operational burden but less control over data location; self-hosting reverses that

WEEK 22 · Controls, operations & judgement · Integrated AI Governance Operating Model

Which trigger would most likely require a DPIA screening at intake?

The system has no connection to any personal dataThe system processes no personal data at allThe system profiles individuals at scale for a decision with potential significant effectThe system is only used internally by two people

WEEK 22 · Controls, operations & judgement · Integrated AI Governance Operating Model

What belongs in the 'retirement' stage of the AI lifecycle?

Nothing further once a system stops being usedData handling, supplier exit, evidence retention and communication to affected people, as relevantImmediate deletion of all records with no retentionTransferring accountability to the AI system itself

WEEK 22 · Controls, operations & judgement · Integrated AI Governance Operating Model

Which vendor contract term most directly addresses the supplier's right to inspect or verify compliance claims?

Export restrictionsCompliance supportIndemnityAudit rights