Chapter 13. Governance, Regulation, Ethics, and Accountability

13.1 Governance is operational, not decorative

An AI ethics statement is insufficient if no one is responsible for implementation. Governance needs named owners, decision rights, risk thresholds, records, testing, incident handling, monitoring, and consequences for non-compliance. It should apply throughout the lifecycle: idea selection, data collection, development, procurement, deployment, change, and retirement.

NIST’s AI Risk Management Framework is a voluntary framework designed to help organisations incorporate trustworthiness into AI design, development, use, and evaluation. Its generative AI profile expands attention to risks specific to generative systems (NIST, 2023, 2024). As of 2026, NIST notes that the framework is being revised and has published a concept note for trustworthy AI in critical infrastructure, illustrating that governance frameworks themselves evolve (NIST, 2026).

13.2 Core governance principles

Validity and reliability: evidence supports the intended task and operating conditions.
Safety and security: foreseeable harms are prevented or reduced and systems resist misuse.
Accountability: a person or body owns decisions and remedies.
Transparency: people receive relevant information about AI involvement, limitations, and rights.
Privacy: personal and confidential information is protected through the lifecycle.
Fairness: harmful bias and unequal impact are assessed and addressed.
Human oversight: humans can understand, challenge, override, or stop consequential operations.
Proportionality: safeguards match the risk, and the use is justified by a legitimate need.

13.3 Regulatory variation

AI law is not uniform worldwide. Rules may depend on the jurisdiction, sector, type of system, risk classification, data processing, and role of the organisation. The European Union’s AI Act uses a risk-based approach and includes transparency obligations for certain AI interactions and generated or manipulated content. Those obligations should not be described as universal law. Organisations operating internationally need a jurisdiction-by-jurisdiction assessment and current legal advice (European Commission, 2026).

Compliance is a minimum obligation, not proof of ethical quality. A use may be lawful yet still damage trust or impose unfair burdens. Conversely, a responsible process should not rely on vague ethical claims while ignoring binding law, contracts, data protection, employment duties, or sector standards.

13.4 The accountability gap

When a system causes harm, responsibility can be distributed among a developer, vendor, deployer, operator, manager, and end user. This complexity must not become an excuse for no one to act. Contracts and internal procedures should establish who evaluates, approves, monitors, explains, corrects, and reports the system. Vendors should provide sufficient documentation and incident support; deployers must assess whether the tool is suitable for their context.

Record the model and version, purpose, data categories, evaluation results, limitations, human approvals, changes, and incidents. For consequential outputs, preserve relevant prompts, source documents, tool actions, and audit logs according to a proportionate retention policy. The record should support review without collecting unnecessary personal information.