Governance frameworks and AI regulation

The board meeting in December would ask the question Lorraine had been dreading: "Are we compliant?" She asked Noor and Hannah for an answer in advance. Hannah's reply was careful. "There isn't one AI law that tells us yes or no. There are privacy laws that already apply, consumer protection rules, professional rules for veterinarians, a fast-moving set of AI-specific laws and proposals, and several respected frameworks. Governance is how we turn all of that into decisions we can defend."

This lesson covers AI governance: the layers of law, frameworks and internal policy; the current regulatory picture in the United States and internationally; the AWS Generative AI Security Scoping Matrix; the AWS services that help with governance and compliance; and the processes that keep governance working. Laws in this area change quickly, so the lesson gives the position as of late 2026 and the habits for staying current.

Three layers of AI governance

Noor drew governance as three layers. At the top is law and regulation: rules an organization must follow, with penalties for breaking them. In the middle are frameworks and standards: structured, widely recognized guidance that organizations adopt voluntarily or because customers and regulators expect it. At the base is the organization's own policy: its approved uses, risk tiers, review steps, training and records. The own-policy layer is where the other two become concrete decisions.

For the exam, governance is about policies, review cadence, review strategies, governance frameworks, transparency standards and team training requirements, all named in the exam guide's governance task statement. It is less about memorizing laws, which differ by country, and more about knowing how an organization stays in control of its AI use.

The regulatory picture in the United States

The United States has no comprehensive federal AI law. In December 2025 an executive order set out a national policy framework for AI that seeks to limit conflicting state AI laws, including a Justice Department task force to challenge them and a call for federal legislation that would preempt them. Existing laws apply in full: the Federal Trade Commission enforces against unfair or deceptive practices, including false claims about AI, and anti-discrimination, consumer credit, health privacy and other sector laws still govern AI uses in their areas. States have also legislated. Colorado, where Cascade Ridge is based, passed one of the first broad AI laws in 2024; after delays and a court order it was replaced in May 2026 by a narrower law that takes effect on January 1, 2027. Its details and its interaction with federal policy were still settling in late 2026, so Hannah asked counsel to confirm whether and how it applies to Cascade Ridge's uses.

Hannah's summary for the board was that none of Cascade Ridge's planned uses made fully automated decisions about people, none were used for credit, employment or housing, and all kept clinical decisions with veterinarians. That placed them at the lower-risk end of every framework she had read. But privacy law applied to all of them, and the documentation and oversight already built would be what any regulator asked to see.

International rules

Many organizations also watch the EU AI Act, the first comprehensive AI law, which entered into force in 2024. It sorts AI uses into risk levels: practices that are prohibited, uses classified as high risk with strict requirements such as risk management, data governance, documentation and human oversight, uses with transparency obligations such as telling people they are interacting with an AI system, and minimal-risk uses with no new obligations. A 2026 amendment that entered into force on July 27, 2026 moved the main high-risk deadlines to December 2027 and August 2028. The Act matters beyond Europe because companies that serve European customers must follow it, and because its risk-based approach influences other rules. Cascade Ridge has no European clients, so it does not apply directly, but its risk levels gave the governance group a useful vocabulary.

Frameworks and standards

Two frameworks were most useful to Cascade Ridge.

• The NIST AI Risk Management Framework (AI RMF), published by the US National Institute of Standards and Technology in 2023, is voluntary and widely used in both countries. It organizes AI risk management into four functions: Govern (culture, policies and roles), Map (understand the context and the risks), Measure (analyze and track the risks) and Manage (prioritize and act on them). NIST has also published a profile applying the framework to generative AI.
• ISO/IEC 42001, published in 2023, is an international standard for an AI management system: the policies, processes and records an organization uses to manage AI responsibly. Organizations can be certified against it, much as they are certified against ISO/IEC 27001 for information security.

Noor mapped her existing work onto the NIST functions and found it fitted well. The governance group and the roles table from lesson 1 were Govern. The risk screen and the framing questions were Map. The fairness measures, Clarify reports and evaluations were Measure. The guardrails, oversight design, off switches and quarterly reviews were Manage.

The Generative AI Security Scoping Matrix

AWS publishes the Generative AI Security Scoping Matrix to help organizations work out which security and governance controls apply to a generative AI use. It sorts uses into five scopes by how much of the model and its data the organization owns.

The matrix also names the security disciplines to consider for each scope: governance and compliance, legal and privacy, risk management, controls and resilience. In scope 1, the main controls are policies and training for staff. In scope 3, the organization owns its application, prompts, data and guardrails. In scope 4, it also owns a custom model and the training data embedded in it, which raises the stakes for poisoning, leakage and documentation.

AWS services for governance and compliance

The exam guide names several AWS services that help with governance and regulatory compliance for AI systems. None is specific to AI, which is the point: AI systems are governed with the same tools as everything else.

Making governance work

Noor's written policy, approved by the governance group, had six parts, matching the processes the exam guide describes.

• Approved uses and prohibited uses. For example: AI may assist with scheduling, documentation and client communication; it may not make clinical decisions or decide access to services; staff may not paste client data into public AI tools.
• Risk tiers. The screen from lesson 1 sorts each use into low, medium or high, and the tier decides the review needed.
• Review strategies. Low tier: owner sign-off with a model card. Medium: governance group review, privacy assessment and evaluation. High: all of that plus an external review.
• Review cadence. Every AI system in production is reviewed each quarter, and immediately after any incident or significant change, such as a new model version.
• Transparency standards. Users and clients are told when AI is involved, in plain language; each system has a model card.
• Team training. Everyone who builds, approves or uses an AI system completes training on its intended use and limits, and builders complete responsible AI training each year.

# Map a use's risk tier to the reviews it needs and its review cadence.
policy = {
    "low":    (["owner sign-off", "model card"], "every 6 months"),
    "medium": (["governance review", "privacy assessment", "evaluation", "model card"], "quarterly"),
    "high":   (["governance review", "privacy assessment", "evaluation", "external review", "model card"], "quarterly"),
}
uses = {"no-show reminders": "low", "call-note summarizer": "medium", "website assistant": "medium"}
for use, tier in uses.items():
    reviews, cadence = policy[tier]
    print(f"{use}: {tier} tier -> {', '.join(reviews)}; review {cadence}")

no-show reminders: low tier -> owner sign-off, model card; review every 6 months
call-note summarizer: medium tier -> governance review, privacy assessment, evaluation, model card; review quarterly
website assistant: medium tier -> governance review, privacy assessment, evaluation, model card; review quarterly

Staying current

AI law and guidance changed more in 2025 and 2026 than in the previous decade, and Hannah expected that to continue. Governance therefore needs a way to notice change, not just a snapshot of today's rules. She set up three habits.

First, a regulatory watch: once a month she spent an hour reviewing updates from the Federal Trade Commission, the Colorado Attorney General, NIST, and the veterinary licensing boards in Colorado and Wyoming, plus a law firm newsletter. Anything relevant went on the governance group's agenda.

Second, change triggers: certain events automatically reopen a system's review, whatever the calendar says. These include a new law or guidance that might apply, a new model version, a new use of an existing model, a significant incident, and a large change in the data, such as a new clinic joining the group.

Third, evidence by default: because the documentation, logs and evaluations from the earlier lessons are produced as part of normal work, answering a new requirement usually means finding existing evidence rather than creating it in a rush. When the cyber insurer added AI questions to its questionnaire, the answers took an afternoon.

Lorraine got her answer for the board. Cascade Ridge could not honestly say it was "compliant with AI law", because there was no single law to be compliant with. It could say that it followed a recognized framework, that its uses were low or medium risk, that privacy law was being met with assessments and controls, and that it had the records to prove it. The board minuted that, and asked for the same report each quarter.