What we mean by AI governance

“AI governance” is used loosely. In this course it means the rules, institutions and practices that decide how AI systems are built, bought, used and corrected, and who is answerable when they go wrong.

AI, for governance purposes

You don’t need a technical definition to govern AI well. What matters is what a system does: it takes data, finds patterns, and produces outputs (predictions, scores, classifications, recommendations or generated text and images) that influence decisions. Many laws now use a definition close to the OECD’s: a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs that can influence physical or virtual environments.

Three features make AI a governance problem rather than just another technology:

• Scale. One model can make millions of decisions, so one flaw becomes millions of errors.
• Opacity. It’s often hard to explain why a model produced a particular output, even for the people who built it.
• Distance. The people who design a system, the people who deploy it and the people affected by it are often in different organisations, and often different countries.

Four layers of governance

Governance happens at several levels at once. It helps to keep them apart.

1. Hard law. Binding rules enforced by regulators and courts: data protection acts, consumer protection, sector regulation, constitutional rights.
2. Soft law and policy. Strategies, frameworks, principles and guidelines. Not directly enforceable, but they set direction, shape funding and signal what regulators expect.
3. Standards and contracts. Technical standards, procurement requirements and contract terms. Often the most practical lever, because they bind specific suppliers.
4. Organisational practice. Internal policies, risk registers, review boards, documentation and training. This is where governance meets daily work.

A common mistake is to assume that without an “AI law”, AI is ungoverned. In fact, most African countries already have several of these layers in place. Module 3 shows how much of the work existing law already does.

Principles and their limits

Most frameworks share a family of principles: fairness and non-discrimination, transparency and explainability, safety and security, privacy, accountability, human oversight, and benefit to people and the environment. These are a useful checklist, but principles alone don’t govern anything. The hard questions are always practical:

• Who decides whether a system is fair enough, and by what test?
• What must be written down, and who can see it?
• Who can a person complain to, and what can that body actually do?
• What happens to a system that fails the test?

Good governance turns each principle into a duty (someone must do something), a record (evidence that it was done) and a remedy (what happens when it isn’t).

Worked example: one system, four layers

Nyota’s largest bank uses an AI model to set credit limits on its mobile app. Here is how each layer of governance reaches it.

• Hard law. The Data Protection Act requires a lawful basis for using customers’ data, a DPIA before launch, and human review on request of significant automated decisions. The central bank’s consumer protection rules require fair treatment and clear disclosure of credit terms.
• Soft law and policy. Nyota’s AI strategy says AI in financial services should be “transparent and inclusive”. It isn’t enforceable, but the central bank has cited it when announcing a review of AI in lending.
• Standards and contracts. The bank bought the model from a vendor. The contract sets accuracy targets and requires the vendor to support audits, but says nothing about testing for differences between regions.
• Organisational practice. The bank’s model risk committee approved the model. There is an internal appeals process, but it is not mentioned in the app.

Looking across the layers shows the gaps quickly: no regional testing in the contract, and an appeals route customers can’t find. Those are the places to act, and neither needs a new law.

Key points

• AI governance is the rules, institutions and practices that decide how AI is built, bought, used and corrected, and who answers for it.
• Scale, opacity and distance make AI a distinct governance problem.
• Governance works at four layers: hard law, soft law, standards and contracts, and organisational practice.
• Turn each principle into a duty, a record and a remedy.

Pause and think

Pick an AI system you’ve encountered: a loan app, a recruitment tool, a chatbot, a traffic camera. For one principle, say fairness, ask: who has the duty, what record exists, and what remedy would an affected person have? If you can’t answer, you’ve found a governance gap.

Practice

Optional. Nothing here is marked, and your results are private to you.

Sort and classifyPractice · not marked

Which layer of governance?

Sort each example into the layer of governance it belongs to. Knowing the layer tells you which lever to pull.

Hard law · Soft law and policy · Standards and contracts · Organisational practice

1. Nyota's Data Protection Act requires an impact assessment before high-risk processing
2. A central bank's binding rule on fair treatment of borrowers
3. Nyota's national AI strategy
4. The UNESCO Recommendation on the Ethics of AI
5. A tender requiring bidders to report accuracy for rural and urban users separately
6. A clause giving a ministry the right to audit a vendor's model
7. A hospital's AI review committee that approves every new tool
8. A bank's internal register of every AI system it uses

I've worked through it: show the answers

Your results aren't saved. Sign in to keep a private record of your plays.