Policy & Governance Resources
A curated library of frameworks, regulatory documents, case studies, and academic work the author endorses as worthwhile reading for readers of the paper.
Federal Reserve Board — Compliance Plan for OMB Memorandum M-25-21
What a central AI register looks like when an institution actually runs one. Staff must document every AI use case and submit it to the AI Program; the Chief AI Officer explicitly approves high-impact uses; and the Board keeps technical controls to terminate noncompliant AI on its own IT resources — the sanctioned/shadow distinction enforced rather than merely asserted.
Topic · Governance, Risk & Compliance
Baseline Security Controls: Retire
Retirement treated as a security phase rather than an afterthought. RAND's baseline controls make the case that decommissioning is where exposure concentrates: a model withdrawn from use still holds sensitive data, metadata and intellectual property, and one retired badly can leak training data, proprietary model artifacts, or details of the infrastructure it ran on — a regulatory, privacy and security problem arriving after everyone has stopped watching the system.
Topic · Governance, Risk & Compliance
AI Debris: Residual Risk and the Afterlife of Failed AI Systems
Argues that retiring a system does not retire its risk. “AI debris” is what remains once a model is switched off — workflow dependency, contaminated data, deskilled staff, and accountability nobody has claimed — and the paper proposes a stepwise decommissioning protocol demanding auditable evidence at each step. A preprint rather than peer-reviewed work; the checklist is the useful part.
Topic · Governance, Risk & Compliance
Updated OECD Definition of an AI System
The updated OECD definition of an AI system (2023) with its explanatory memorandum — the intergovernmental reference definition many regulators build on.
Topic · Governance, Risk & Compliance
Three Lines of Defense Against Risks from AI (Schuett)
Adapts the Institute of Internal Auditors’ Three Lines model — a framework for assigning and coordinating risk roles — to AI, arguing it closes coverage gaps and lets boards oversee management. The scholarly case for supplementing existing control functions rather than standing up a parallel one.
Topic · Governance, Risk & Compliance
The Language of Trustworthy AI: In-Depth Glossary (NIST)
NIST’s in-depth glossary of trustworthy-AI terms, aligned to the AI RMF — an authoritative vocabulary for the definitions an organization must agree on.
Topic · Governance, Risk & Compliance
Risk Tiering AI Use Cases: A Practical Guide (Google Cloud Office of the CISO)
Tiers AI use cases by autonomy, architectural agency, data and IAM boundaries, and blast radius, then attaches controls to each tier — automated guardrails and a stop control at the autonomous end, human approval plus anti-automation-bias measures in the middle. Insists the controls be technically enforced rather than documented.
Topic · Governance, Risk & Compliance
OpenAI — Hugging Face Model-Evaluation Security Incident
OpenAI’s disclosure of a security incident in a Hugging Face model-evaluation workflow — a concrete case of risk inside the AI evaluation pipeline itself, reinforcing why higher-trust tiers require stronger verification and tighter harnessing.
Topic · Governance, Risk & Compliance
OECD AI Principle: Accountability
The intergovernmental accountability standard: organizations and individuals developing, deploying, or operating AI are accountable for its proper functioning, by role and context — a near-verbatim statement of this chapter’s principle.
Topic · Governance, Risk & Compliance
OECD — Drawing the AI / Non-AI Boundary
OECD’s explainer on drawing the AI / non-AI line — the intergovernmental consensus definition and the “continuum, no red line” framing any boundary test must reckon with.
Topic · Governance, Risk & Compliance
NIST AI RMF: Agentic Profile (Cloud Security Alliance)
An industry profile extending the NIST AI RMF to autonomous agents that independently arrives at a Tier 1 (supervised) through Tier 4 (fully autonomous) classification — with oversight boundaries set per deployment, tool-use risk modeled by consequence scope and reversibility, and delegation registers naming the responsible human.
Topic · Governance, Risk & Compliance
Human-in-the-Loop Artificial Intelligence: A Systematic Review of Concepts, Methods, and Applications
An open-access systematic review that organizes human-in-the-loop systems into a unified taxonomy by loop placement, interaction granularity, and temporal characteristics — a scholarly map of the ground between a human gating every action and a human supervising an autonomous process.
Topic · Governance, Risk & Compliance
Institutional Intelligence Brief
Receive updates on new chapters, critical policy shifts, and emerging AI governance frameworks directly in your inbox.
A double opt-in confirmation keeps the list clean; unsubscribe anytime.