Which set of elements are essential components of an AI governance policy?

• A. Data handling, privacy, fairness, accountability, risk management.
• B. Data handling, privacy, fairness, accountability, risk management, roles, and approval workflows.
• C. Roles and approval workflows only.
• D. Data handling, privacy, fairness, accountability, risk management.

Answer: (B)

A solid AI governance policy covers both what needs to be controlled in the AI lifecycle and how that control is organized. Data handling sets the rules for how data is collected, stored, processed, cleaned, and retained, emphasizing quality and provenance. Privacy ensures personal information is protected through controls like minimization, consent, and compliance with laws and regulations. Fairness focuses on preventing bias and ensuring equitable outcomes across users and scenarios. Accountability makes sure there is a clear owner for decisions and actions, with traceable records of what was done and by whom. Risk management identifies potential harms and uncertainties from AI systems and puts in place measures to reduce or monitor those risks.

Including roles and approval workflows is essential because governance isn’t just about what should be done; it’s about who is authorized to do it and how changes get reviewed and approved. Roles define responsibilities (for data handling, model development, testing, deployment, monitoring), while approval workflows introduce checks and balances before critical actions—such as training on new data, deploying a model, or making changes to governance controls—are executed. This creates accountability, prevents unauthorized alterations, and provides audit trails for oversight.

The other options omit one or more of these governance elements. Without roles and approval workflows, you lose the structural oversight that ensures the other components are consistently applied in practice.