Page 367 - CyberSecurityEssentialsEnglish

✕ Common misconception Correction

Delegate low-impact uses under standing
Creating a central committee that
rules and escalate only the medium and
approves everything, so governance
high cases, while keeping one unified
becomes a bottleneck.
register.

● Remember: Section summary
• Key idea: A good structure makes decision authority, delivery, and independent
oversight clear and proportionate to impact.
• Practical decision: Name who decides, who delivers, and who checks, and keep the
level of involvement tied to the impact of the use.
• Mistake to avoid: Building a large committee that reviews everything slowly and

therefore reviews nothing well.

8.4 From Principles to a Continuous Management Cycle
◆ Key idea: governing is a function that runs, not a phase that ends.
An established risk framework organizes the work into governing, mapping, measuring,

and managing. The cycle begins again whenever the model, the data, or the purpose of
the use changes.

Professional frameworks offer a useful way to stop governance turning into slogans. The

core of an established AI risk management framework consists of four functions: govern,
map, measure, and manage. Governing is not a first phase that ends; it is a function running
through every stage, because it sets the policies, the roles, the culture, and the resources

[2]. This cycle intersects with international AI principles on trustworthy growth, human-
centered values, transparency, and accountability [16].

The mapping function begins with understanding the context: who will be affected? What is
the intended purpose? What are the expected and the unintended uses? What data,

systems, and external parties are involved? The organization then moves to measuring,
gathering evidence through tests of accuracy, reliability, safety, fairness, and usability.

Managing follows, setting priorities, treating risks, accepting or rejecting what remains, and
monitoring outcomes. The cycle then begins again when the model, the data, the vendor, or
the environment changes.

A management system standard for artificial intelligence completes this picture with the
logic of a management system: policies, objectives, processes, responsibilities, review, and

continual improvement. It does not promise that every system will be free of error; it

366