AI governance establishes a structure to oversee AI projects and AI Assessment, defines roles and responsibilities, specifies practices and assesses their adoption, integrated with the second and the third line of defence rather than led by technology alone. The first line is the Project Team, responsible for development, risk evaluation, mitigation and documentation of the AI Assessment; the second is the Project Steering Committee and Project Assurance Team, which define acceptance criteria and overall requirements, review the AI Assessment, monitor through the lifecycle, comment on high-risk applications, sign off before delivery and engage the Privacy Commissioner and legal advisers on high-risk privacy or legal issues; the third is the IT Board, or the CIO where there is none, which may be supported by an Ethical AI Committee of external advisers, which reviews the AI Application Impact Assessment of high-risk applications before projects start, reviews the Project Team's recommendations and remediation, and monitors high-risk applications. The Project Manager ensures quality compliance across the lifecycle, checks and assessments including data governance, qualifies the use case and design, arranges AI training and supports the IT Board, and is assigned even for proofs of concept; System Analysts and Architects assign and track dataset ownership, secure licences for purchased data, handle ETL and uphold archival, backup, security, privacy and retention processes; Data Scientists determine capabilities and training procedures, follow model testing and validation controls, notify changes affecting governance, deploy, scale and manage post-deployment performance and platforms.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.