Episode Overview

Good AI governance is built into the lifecycle, not added at the end. This episode of Checks & Algorithms walks through the four phases of AI development, Planning, Design, Development, and Implementation, and the governance, privacy, testing, and monitoring controls that belong in each. It is designed for candidates preparing for the IAPP AIGP certification and for leaders responsible for governing AI from idea to production.

Topics Covered

• Phase 1, Planning: Defining the business case, scope, and requirements; setting up governance roles, cross-functional oversight, and risk tolerance; and running an early impact assessment to confirm AI is the right solution, identify applicable laws, and map risks.
• Phase 2, Design: Data strategy and governance, including lawful collection, quality, provenance, and lineage; data cleansing and representative labeling; privacy by design through minimization, anonymization, synthetic data, federated learning, and differential privacy; and model selection, including the trade-off between accuracy and explainability.
• Phase 3, Development: Feature engineering that avoids spurious correlations and historical bias; model training across learning approaches; and testing, evaluation, verification, and validation (TEVV), covering performance, security, bias, fairness, and interpretability, with counterfactual explanations and documented results.
• Phase 4, Implementation: Readiness assessments, model cards, and conformity requirements before release; deployment to cloud, on-premise, or edge environments with human oversight; monitoring for model and data drift; champion and challenger models; ongoing red teaming and security testing; and clear procedures to roll back or deactivate a model when it fails.

Intended Audience

• AIGP Candidates: Coverage aligned with the AIGP body of knowledge on governing AI development and the AI system lifecycle.
• Data Science and ML Engineering Managers: Practical ways to build privacy, security, and ethics checks into MLOps pipelines.
• Risk, Audit, and Compliance Professionals: A clear view of model card expectations, TEVV, and post-deployment monitoring.

Checks & Algorithms is a podcast on AI governance, covering the policies, standards, and accountability practices shaping artificial intelligence.

The episode makes three points:

• Who signs off: the business owner owns the yes. An independent second line (risk, compliance, privacy, model validation) owns the “not yet.” Its real power is refusing or attaching conditions to validation.
• Who can stop it: US federal policy and the EU AI Act spell this out most clearly. Under the White House AI memo (M-25-21), only the agency’s Chief AI Officer can let a non-compliant system keep running, and that power can’t be delegated. Under the EU AI Act, the provider builds the stop button (Art 14) and the deployer decides when to suspend use (Art 26(5)). Microsoft and IBM’s review boards mostly attach conditions rather than veto. Hosts recommend agreeing stop triggers before launch.
• Combined risk across business lines: your follower is right. US bank guidance tracked “aggregate model risk” for 15 years, but the April 2026 replacement for SR 11-7 (SR 26-2) leaves generative and agentic AI out of scope. Vendor concentration is real: in UK finance the top three providers account for 44% of named model providers.

Episode Overview

AI regulation is moving from principles to binding rules and formal standards. This episode of Checks & Algorithms examines the EU AI Act, emerging AI laws in other jurisdictions, and the voluntary frameworks organizations use to manage AI risk, including the NIST AI RMF and ISO/IEC 42001. It is designed for candidates preparing for the IAPP AIGP certification and for anyone who needs a clear map of the global AI governance landscape.

Topics Covered

• EU AI Act Risk Tiers: Prohibited practices such as government social scoring, manipulative techniques targeting vulnerable groups, untargeted facial image scraping, and real-time remote biometric identification by law enforcement, with narrow exceptions; high-risk systems in areas such as employment, credit, education, critical infrastructure, and law enforcement, and their requirements for risk management, data governance, documentation, logging, transparency, and human oversight; transparency obligations for chatbots and deepfakes; and voluntary codes of conduct for minimal-risk AI.
• General-Purpose AI Models: Obligations for GPAI model providers, and additional requirements for models with systemic risk, presumed above 10^25 FLOPs of training compute.
• Enforcement and Penalties: Fines of up to €35 million or 7% of global annual turnover for prohibited practices, and up to €15 million or 3% for most other violations.
• Global AI Laws: Canada's proposed Artificial Intelligence and Data Act (AIDA) and what it would have required, US state laws on high-risk automated decision tools, and China's CAC rules on algorithm registration, security reviews, and labeling of generative AI content.
• NIST AI Risk Management Framework: The four core functions, Govern, Map, Measure, and Manage, and NIST's ARIA program for assessing AI risks and impacts.
• International Standards: ISO/IEC 42001 for AI management systems, ISO/IEC 22989 for AI terminology and concepts, ISO 31000 for enterprise risk management, and the Council of Europe's HUDERIA methodology for human rights, democracy, and rule of law impact assessments.

Intended Audience

• AIGP Candidates: Coverage aligned with Domain IV, Understanding Emerging AI Laws, Standards, and Frameworks.
• Compliance Officers and DPOs: Preparing for EU AI Act conformity assessments, GPAI obligations, and cross-border requirements.
• Enterprise Risk Managers: Implementing the NIST AI RMF and preparing for ISO/IEC 42001 certification.

Checks & Algorithms is a podcast on AI governance, covering the policies, standards, and accountability practices shaping artificial intelligence.