AI Governance, Risk, and Compliance · Topic 1 of 3
AI Governance Structures and Roles
Learn AI governance structures: AI Center of Excellence, AI policies and procedures, and roles from data scientist and MLOps engineer to AI auditor.
- 5 min
- An AI Center of Excellence sets standards, approves use cases, keeps the inventory and shares expertise.
- Policies state what is required; procedures state how to do it.
- Data engineers build pipelines; data scientists build and evaluate models.
What it is
Artificial intelligence (AI) governance is the set of structures, policies and roles that decide how an organisation uses AI, who is accountable, and how risk is kept within limits. Without it, teams adopt tools independently, nobody owns the risks and nobody can say which models are in use.
The exam expects you to know the main structure, an AI Center of Excellence, what AI policies and procedures contain, and which role is responsible for which task.
How it works
AI Center of Excellence
An AI Center of Excellence (CoE) is a central, cross-functional group that sets standards and shares expertise for AI across the organisation. It typically includes technical, security, legal, privacy, risk and business members.
| CoE responsibility | Example |
|---|---|
| Set standards | Approved model sources, required testing, documentation templates |
| Review and approve use cases | Risk-rate a new AI project before it starts |
| Maintain an AI inventory | A register of every model, owner, data source and purpose |
| Share tools and knowledge | Reusable gateways, guardrails, training material |
| Coordinate with governance bodies | Report AI risk to the risk committee and board |
The CoE avoids two failures: every team inventing its own rules, and a central team so slow that staff turn to unapproved tools.
AI policies and procedures
Policies say what must happen and procedures say how. Common AI policies include:
- Acceptable use: which AI tools staff may use and what data may be entered into them.
- Model development and procurement: requirements for building, buying or fine-tuning models, including security and bias testing.
- Data use: which data may train or feed models, with classification and consent rules.
- Human oversight: which decisions need human review or approval.
- Incident response: how AI-specific incidents, such as a prompt injection or a harmful output, are reported and handled.
- Model life cycle: versioning, monitoring, retraining and retirement.
AI-related roles
| Role | Main responsibility |
|---|---|
| Data scientist | Explores data, designs and trains models, and measures their performance |
| Data engineer | Builds and maintains the pipelines that collect, clean, move and store data |
| Machine learning (ML) engineer | Turns models into production-ready software, optimises and integrates them |
| AI architect | Designs the overall AI solution: models, data flows, integrations and infrastructure |
| Platform engineer | Builds and runs the shared infrastructure, such as compute clusters, gateways and registries |
| Machine learning operations (MLOps) engineer | Automates the model life cycle: training pipelines, deployment, versioning, monitoring and retraining |
| AI security architect | Designs security controls for AI systems: threat models, access, guardrails and data protection |
| AI governance engineer | Builds governance into tooling: policy checks, inventories, documentation and approval workflows |
| AI risk analyst | Identifies, assesses and tracks AI risks against the organisation's risk appetite |
| AI auditor | Independently checks that AI systems and processes meet policy, standards and law |
Telling similar roles apart
Several pairs are easy to confuse.
- Data engineer versus data scientist: the engineer builds the pipelines that deliver data; the scientist analyses it and trains models.
- ML engineer versus MLOps engineer: the ML engineer makes a model work well in production; the MLOps engineer automates how models are trained, deployed and monitored repeatedly.
- AI architect versus AI security architect: the AI architect designs the whole solution; the security architect designs its protections.
- AI risk analyst versus AI auditor: the analyst assesses risk as part of management; the auditor gives independent assurance and should not audit work they built.
- Platform engineer versus AI governance engineer: the platform engineer runs the infrastructure; the governance engineer builds the policy checks and records into it.
Separation of duties
Governance depends on no single person controlling a model end to end. The person who trains a model should not be the only one who approves its release, and the auditor must be independent of the teams being audited.
A worked example
A retailer finds that five departments are each using different AI tools, and nobody knows what customer data they receive. Leadership creates an AI Center of Excellence with security, legal, privacy and business members.
The CoE builds an inventory, publishes an acceptable use policy and a list of approved tools, and assigns an owner to each system. An AI risk analyst rates each use case, an AI security architect designs a shared gateway, and an internal AI auditor reviews compliance after six months.
How the exam asks about this
- "An organisation wants one cross-functional group to set AI standards, approve use cases and share expertise across departments. Which of the following should it establish?" An AI Center of Excellence.
- "A team needs someone to automate model retraining, deployment and performance monitoring. Which of the following roles is the best fit?" An MLOps engineer.
- "Which of the following roles provides independent assurance that AI systems comply with policy and regulation?" An AI auditor.
What to remember for the exam
- An AI Center of Excellence sets standards, approves use cases, keeps the inventory and shares expertise.
- Policies state what is required; procedures state how to do it.
- Data engineers build pipelines; data scientists build and evaluate models.
- MLOps engineers automate the model life cycle; ML engineers productionise individual models.
- AI risk analysts assess risk; AI auditors independently verify compliance.
An AI system with no named owner is ungoverned. Every model in the inventory needs an accountable owner who answers for its risk and its use.
Common mistakes
Making the AI security architect responsible for all AI risk. Security designs controls, but risk ownership sits with the business owner, supported by the risk analyst and governance structures.
Letting builders audit their own systems. An audit by the team that built the system is not independent. The AI auditor must be separate.
Confusing a CoE with a single approving manager. A CoE is cross-functional and sets shared standards; it is not one person signing off projects.
Check yourself
What is the main purpose of an AI Center of Excellence?
To provide a central, cross-functional group that sets AI standards, reviews use cases and shares expertise across the organisation.
How does an MLOps engineer differ from a data scientist?
The data scientist designs and trains models, while the MLOps engineer automates their deployment, monitoring and retraining.
Why must the AI auditor be independent?
Assurance is only credible if the auditor did not build or operate the systems being reviewed.
Topic 1 of 3 in AI Governance, Risk, and Compliance
Test yourself on AI Governance, Risk, and Compliance
The full CompTIA SecAI+ CY0-001 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.