AI Governance 101: What ML Practitioners Actually Need to Know

AI regulation isn't abstract policy anymore. If you're building systems that touch hiring, credit, healthcare, or law enforcement, there are now legal requirements attached to your model's behavior — and the penalties are real. Here's what actually matters for practitioners, without the fluff.

The EU AI Act: risk tiers, not blanket rules

Adopted in 2024, the EU AI Act is the first comprehensive AI law, and it works by classifying systems into four risk tiers:

Unacceptable risk — banned outright. Government social scoring, real-time biometric ID in public spaces (with narrow exceptions), manipulative AI targeting vulnerable people.
High risk — hiring, credit scoring, healthcare diagnostics, law enforcement, critical infrastructure, education. These require a conformity assessment, a documented risk management system, data governance controls, transparency, human oversight, and accuracy/robustness testing.
Limited risk — chatbots, emotion recognition, deepfake generators. The obligation here is simpler: tell users they're interacting with AI.
Minimal risk — spam filters, game AI, most recommendation systems. No specific legal requirements, though voluntary codes are encouraged.

The part that should get your attention: non-compliance for high-risk systems can cost up to €35 million or 7% of global annual turnover, whichever is higher. That's not a slap on the wrist — it's a board-level risk.

High-risk systems also need ongoing post-market monitoring and registration in an EU database, not just a one-time sign-off before launch.

NIST AI RMF: voluntary, but increasingly load-bearing

The US hasn't passed anything like the AI Act. Instead, NIST published the AI Risk Management Framework (AI RMF) — voluntary, not law, but referenced in federal procurement and rapidly becoming the de facto standard for US organizations doing this work seriously.

It has four core functions, and they map cleanly onto the ML lifecycle:

Govern — set policies, define who owns AI risk, build accountability structures before you build anything else.
Map — understand context: intended use, stakeholders, likely harms, deployment environment.
Measure — test for bias, evaluate robustness, check performance across subpopulations, using both quantitative and qualitative methods.
Manage — prioritize the risks you found, implement mitigations, monitor in production, keep an incident response plan ready.

If you're not sure where to start with governance internally, this four-function structure is a reasonable skeleton even outside the US.

Sector rules stack on top of horizontal law

Horizontal AI legislation isn't the whole picture. Specific sectors have their own layered requirements:

Healthcare: the FDA regulates AI/ML-based Software as a Medical Device, and has proposed rules for continuously-learning models that keep adapting post-deployment — these need a predetermined change control plan, not a one-time approval.
Finance: the Federal Reserve and OCC require explainability for AI-driven credit decisions under the Equal Credit Opportunity Act. The SEC has proposed rules targeting AI-driven investment advisors.
Employment: NYC's Local Law 144 requires bias audits for automated employment decision tools, with results published publicly — not just kept in an internal report.
Autonomous vehicles: NHTSA requires manufacturers to report crashes involving automated driving systems.

If your model touches any of these domains, the horizontal AI law is the floor, not the ceiling.

Corporate frameworks fill the gaps

Google, Microsoft, and IBM all publish their own responsible AI frameworks. They're voluntary, but they matter in practice — they shape hiring expectations, client requirements, and often preview where regulation is headed. IBM's approach is notable structurally: it runs a centralized AI ethics board with actual authority to halt projects that don't meet its standards, which is a governance pattern worth borrowing even at smaller scale.

Different regions, different philosophies

EU: prescriptive, risk-based, legally binding.
US: sector-specific, voluntary-framework-heavy, optimized for innovation speed.
China: comprehensive rules specifically targeting algorithmic recommendation, deepfakes, and generative AI, with content moderation and transparency requirements.
UK: pro-innovation, delegates oversight to existing sector regulators rather than creating a new AI-specific body.
Canada: AIDA creates requirements for high-impact systems and a dedicated AI and Data Commissioner role.

If you ship globally, you're effectively subject to the strictest applicable regime for each market you touch.

What this means for your actual pipeline

Compliance isn't a document you write after the model ships. In practice it means:

Documenting training data, architecture decisions, and evaluation results as you go
Building monitoring that catches performance degradation and bias drift in production, not just accuracy drops
Defining accountability explicitly — who is responsible when the model causes harm
Having an incident response procedure ready before you need it
Keeping audit trails a regulator (or auditor) could actually review

Treating this as an afterthought is the expensive path. Embedding it into the ML lifecycle from day one is cheaper and, frankly, just better engineering practice.