AI Governance & Risk Management: Practical Compliance

High-Risk Classification in Practice

This article provides practical examples to illustrate how high-risk classification under the EU AI Act works in real organizational contexts.

Example 1: HR Screening Tool
An organization uses an AI-powered tool to rank job applicants based on CVs and assessment results. Even if the tool is marketed as “decision support,” it materially influences hiring outcomes. Because employment decisions are explicitly listed in Annex III, this system is classified as high-risk, regardless of model complexity or vendor claims.

Example 2: Internal vs External Use
A company uses the same AI model internally to prioritize employee training opportunities. When the system later expands to screen external applicants, the intended use changes. This triggers a new governance decision, and the system must be reassessed as potentially high-risk.

Example 3: Simple Technology, High Impact
A rules-based scoring system (not machine learning) is used to assess creditworthiness. Despite technical simplicity, its impact on access to financial services makes it high-risk under the Act.

Governance takeaway:
High-risk classification depends on intended use and impact, not technical sophistication. Classification is a formal organizational decision and must be documented and defensible.

Extraterritorial Scope & Vendor AI

This article illustrates how the EU AI Act applies beyond EU borders and across AI supply chains.

Example 1: Non-EU SaaS Provider
A U.S.-based company sells an AI-powered recruitment platform to EU-based employers. Although the provider has no EU office, the system affects individuals in the EU. The AI Act applies, and governance obligations follow the impact, not company location.

Example 2: Vendor ≠ Responsibility Transfer
An organization purchases an “EU AI Act–ready” AI tool from a vendor. During an audit, the organization cannot produce risk assessments or oversight documentation. Vendor assurances do not replace governance — the deploying organization remains accountable.

Example 3: Multi-Vendor Stack
A generative AI system includes a foundation model provider, a fine-tuning partner, and a deployment platform. Governance must address the entire chain, not only the direct supplier.

Governance takeaway:
Organizations cannot outsource accountability. Vendor governance, documentation access, and role clarity are essential under the AI Act.

Mapping Intended Use & Stakeholders

The Map function is where many governance failures begin — or are prevented.

Example 1: Intended Use Drift
An AI system is approved to forecast customer churn. A business unit later uses the output to decide which customers receive retention offers. While subtle, this changes who is affected and how decisions are made. Mapping must be updated.

Example 2: Users vs Affected Persons
An AI system is operated by internal staff, but its decisions affect customers. Governance must consider both users and affected individuals. Confusing the two leads to incomplete risk assessments.

Example 3: Data Blind Spots
A team cannot clearly identify all data sources used in model training due to third-party data ingestion. Poor data visibility is a governance risk in itself.

Governance takeaway:
Mapping is not paperwork. It is how organizations ensure they understand what the system actually does in the real world.

Measuring Risk Beyond Accuracy

Accuracy alone is rarely sufficient to justify AI deployment.

Example 1: Accuracy vs Fairness
A hiring model shows high overall accuracy but performs worse for a protected group. Governance must decide whether this disparity is acceptable, how it is mitigated, and whether deployment can proceed.

Example 2: Explainability for Oversight
A system is accurate but produces outputs that users cannot interpret. Even without full transparency, governance may require additional explanation tools to enable meaningful oversight.

Example 3: Qualitative Judgment
Not all risks can be quantified. Expert review and documented judgment may be required where metrics fall short.

Governance takeaway:
Measurement supports decision-making. It does not replace it.

Residual Risk & Governance Decisions

No AI system is risk-free.

Example 1: Accepting Residual Risk
After mitigation, some bias risk remains. Senior leadership formally accepts residual risk with conditions: monitoring thresholds, human oversight, and escalation triggers.

Example 2: Limiting Scope
Instead of full automation, an organization restricts the system to decision support only. This is a valid risk treatment.

Example 3: Pausing Deployment
Governance may decide to delay deployment until additional controls are in place. This is not failure — it is governance working as intended.

Governance takeaway:
Risk acceptance must be deliberate, documented, and made at the right level of authority.

What Auditors Actually Look For

Audits focus on evidence, not intent.

Example 1: Missing Documentation
A system owner can explain controls verbally, but no documentation exists. Auditors treat this as a governance failure.

Example 2: Inconsistent Classification
Different teams classify similar systems differently. This signals weak governance and inconsistent decision authority.

Example 3: Dormant Controls
Controls exist on paper but are not used. Logs show no monitoring activity. Auditors assess controls as ineffective.

Governance takeaway:
If it isn’t documented and used, it doesn’t exist.

What Counts as an AI Incident

Not every issue is an incident — but some require immediate escalation.

Example 1: Performance Degradation
A gradual accuracy drop becomes significant over time. This qualifies as an incident when thresholds are crossed.

Example 2: Human Oversight Failure
An operator fails to intervene when required. Even without harm, this is a governance incident.

Example 3: Reporting Decisions
An incident affects fundamental rights but causes no physical harm. Regulatory reporting may still be required under the EU AI Act.

Governance takeaway:
Incident response protects people. Documentation protects the organization.