Overview

Policy is necessary but insufficient. You need structures, people, processes, and governance, that make responsible AI real.

Most companies have one of two problems: Either they have no governance (everything is approved because nobody's asking hard questions), or they have too much governance (everything gets stuck in committees that meet quarterly and solve nothing).

The best organizations have governance structures that actually work: clear authority, fast decision-making, and teeth.

>
Executive Summary: Effective AI governance requires three things: (1) A data governance structure that ensures data quality and responsible use, (2) An ethics board with real authority to challenge initiatives, and (3) Clear escalation paths and enforcement mechanisms. Without these, policies are theater. With them, you've built an organizational immune system that catches problems early and forces good thinking.

Purpose Statement

By the end of this lesson, you'll know how to design data governance for AI, how to build an effective ethics board, and how to structure oversight that actually works (not just bureaucratic blocking). You'll also understand how to make governance feel like a strength, not a burden, how to position it as a source of competitive advantage and organizational trust, not just compliance theater.

Why This Matters for HR Executives

Policy defines what's permitted. Governance structures make it real.

Here's the difference: A policy says "AI hiring systems must be audited for bias." Governance says "Here's who runs the bias audit. Here's when. Here's what happens if bias is found."

Without structures, policies are promises nobody keeps.

Most organizations build governance structures that are either:
- Too loose: A stakeholder group that meets quarterly, makes recommendations, and nobody implements them
- Too tight: A governance committee that approves everything, slowing everything down

You want something in the middle: structures with real authority, fast decision-making, and enforcement.

Data Governance for AI

Every AI system depends on data. The data is only as good as the governance behind it.

What data governance covers:

1. Data inventory and classification

You need to know:
- What data do you have?
- What is it used for?
- How sensitive is it?
- Who can access it?
- Where is it stored?

Example: A company deployed an AI retention prediction system. It turns out the model was using data from multiple systems:
- HRIS (employment data)
- Email metadata (communication patterns)
- Office location sensors (where people spend time)
- Badge data (office attendance)

The company didn't have a clear inventory. Different teams owned different data. Nobody knew about the office sensors feeding the model. When employees found out, there was backlash. Governance would have caught this.

2. Data quality standards

AI is only as good as the data. You need:
- Accuracy standards (what % accuracy is acceptable?)
- Completeness standards (what % of records need full data?)
- Timeliness standards (how current does data need to be?)
- Consistency standards (are definitions consistent across systems?)

Example: A company built a model to predict which employees would be high performers. The model was trained on performance ratings. But performance ratings came from different managers, using different rating scales, with different rigor. The model learned manager bias, not actual performance. Data quality governance would have caught this.

3. Data access and permissions

Who can access what data?
- Raw data vs. aggregated data
- Identifiable vs. anonymized
- Real-time vs. historical

Example: An HR analyst needed data to understand compensation equity. They got access to the full compensation database (salaries, bonuses, equity). A data privacy perspective: Did they need access to specific employee salaries? Or would aggregate data (median by role, equity gaps by gender) have been sufficient?

Data governance should define: What's the minimum data needed to do the work? That's what we grant access to.

4. Data retention and deletion

How long do you keep data?
- You need historical data for models and analysis
- But you don't want to keep it forever
- Different data has different retention needs

Example: You've deployed a retention prediction model. You keep 5 years of historical data to train the model. Should you keep employee exit interview notes from 5 years ago? Probably not. Data retention governance should define: 5 years for training data, 2 years for interview notes.

5. Privacy impact assessments

Before you deploy a new data use, conduct a privacy impact assessment:
- What data are you collecting?
- Why?
- Who has access?
- What could go wrong?
- How are you protecting privacy?
- Do you need employee consent?

This isn't a checkbox. This is rigorous thinking.

The data governance structure:

DATA GOVERNANCE COMMITTEE
├─ MEMBERS:
│ ├─ Chief Data Officer or IT leader
│ ├─ Privacy officer or counsel
│ ├─ HR leader (you or your designee)
│ ├─ Business stakeholder
│ └─ One rotating employee representative
├─ RESPONSIBILITIES:
│ ├─ Maintain data inventory and classification
│ ├─ Set data quality standards
│ ├─ Approve data access requests
│ ├─ Conduct privacy impact assessments
│ ├─ Handle data breaches and violations
│ └─ Set data retention policies
├─ AUTHORITY:
│ ├─ Can block a data access request
│ ├─ Can require additional protections
│ ├─ Can mandate deletion of data
│ └─ Can refer violations to ethics board
└─ CADENCE:
├─ Monthly meeting (usually 1 hour)
└─ Escalations can be handled between meetings

Building an Effective Ethics Board

An ethics board reviews AI initiatives and asks the hard questions.

The questions the ethics board asks:

• Fairness: Is this system treating people fairly? Are we building in bias?
  - Transparency: Do people understand how this system affects them?
  - Consent: Are we using data and making decisions with people's knowledge?
  - Benefit: Who benefits from this AI system? Who bears the risk?
  - Necessity: Is AI the right tool? Or are we using AI because it's novel?

Ethics board membership:

This matters. You want:
- HR leader (often the CHRO or head of HR operations)
- Employee representative (not management)
- Business leader (someone with P&L responsibility, skin in the game)
- External voice (if possible, someone from outside the company, maybe from an ethics organization)
- Data/AI expert (someone who understands the technical side)

Don't staff it only with ethics specialists. That's a sermon. Staff it with people who make business decisions. They need to understand that ethics is business.

How the ethics board works:

1. Intake and assessment (Week 1)

New AI initiatives are submitted to the ethics board with:
- Business case
- How the system works
- What data it uses
- Who it affects
- Anticipated risks
- Mitigation plans

2. Initial review (Week 1)

The board reviews and decides:
- Low risk (approve immediately)
- Medium risk (requires review and recommendations)
- High risk (requires detailed assessment)

3. Detailed assessment (Weeks 2-4, for medium/high risk)

For initiatives that warrant deeper review:
- Conduct fairness testing (if it affects hiring/promotion/pay)
- Conduct privacy impact assessment (if it uses sensitive data)
- Conduct explainability review (can we explain decisions to affected people?)
- Gather employee feedback (what do people who'll be affected think?)

4. Recommendation and conditions (Week 4)

The board makes one of four recommendations:
- Approve: No conditions, move forward
- Approve with conditions: Approve, but with specific requirements (e.g., "bias test must show no more than 5% disparate impact")
- Defer: Come back with additional information or mitigation
- Do not approve: The system creates unacceptable risk

5. Follow-up (Ongoing)

For approved initiatives:
- Continuous monitoring of outcomes
- Periodic reassessment (quarterly, or annually)
- Process for bringing concerns back to the board
- Escalation if issues emerge

Ethics board decision framework:

ETHICS BOARD REVIEW MATRIX

FAIRNESS ASSESSMENT:
├─ Low risk: System doesn't affect employment decisions
├─ Medium risk: System influences decisions but has human review
└─ High risk: System makes or heavily influences employment decisions

TRANSPARENCY ASSESSMENT:
├─ Low risk: People know they're being evaluated
├─ Medium risk: People know generally, but details aren't clear
└─ High risk: People don't know, or can't understand how system works

NECESSITY ASSESSMENT:
├─ Low risk: AI is the best tool for the job
├─ Medium risk: AI is good but not essential
└─ High risk: AI is novel but not necessary

OVERALL DECISION:
├─ Low + Low + Low = APPROVE
├─ Medium + Medium + Medium = APPROVE WITH CONDITIONS
├─ One or more High = DEFER or DO NOT APPROVE
└─ Any combination that addresses risks = APPROVE WITH CONDITIONS

Making the ethics board actually matter:

Most ethics boards are theater. Here's how to make them real:

• 
  Give them authority. They can say no. They can block initiatives. That matters.
• 
  Give them resources. If they want to commission a fairness audit, they can. Budget for it.
• 
  Give them visibility. Report to the board on ethics board decisions. Make it visible.
• 
  Hold initiatives accountable. If the ethics board approves with conditions, make sure those conditions are met. Audit it.
• 
  Have teeth for violations. If an initiative moves forward without ethics board approval, that's a violation. There are consequences.

Clear Escalation Paths

You need clarity on what happens when things go wrong.

Common scenarios:

Scenario 1: A bias concern emerges in a deployed system

Path:
1. Employee or manager reports concern (to ethics hotline, HR, or ethics board)
2. Concern goes to data governance committee
3. Committee assesses: Is this real bias? How severe? How many people affected?
4. If significant, committee escalates to ethics board
5. Board recommends: Continue as-is, adjust the system, or pause deployment
6. Decision is made and communicated to affected employees

Timeline: Urgent (same week for assessment, decision within 2 weeks)

Scenario 2: Ethics board says no to an initiative

Path:
1. Initiative sponsor appeals to CHRO or CEO
2. Appeal includes: Why do you disagree with the ethics board?
3. Decision-maker meets with ethics board to understand concerns
4. Decision: Trust the ethics board and kill it, or override and accept the risk (with documented risk assessment)
5. If override, the company is on record as accepting the risk

Timeline: 1-2 weeks

Scenario 3: An AI initiative has unintended consequences

Path:
1. Someone notices (HR, manager, employee): "This is creating an unexpected problem"
2. Report goes to data governance committee
3. Committee investigates: Is this a real problem? How wide-spread?
4. If significant, they recommend a pause or adjustment
5. Decision is made; affected employees are informed

Timeline: Urgent (assess within 2-3 days, decide within 1 week)

Escalation structure:

ESCALATION LADDER

Level 1: Data Governance Committee
├─ Handles: Data quality issues, privacy concerns, access requests
├─ Timeline: Weekly
└─ Authority: Can block decisions, require additional assessment

Level 2: Ethics Board
├─ Handles: Fairness concerns, transparency questions, broader risk assessment
├─ Timeline: Monthly (urgent escalations weekly)
└─ Authority: Can approve, approve with conditions, defer, or reject initiatives

Level 3: CHRO and CFO
├─ Handles: Appeals of ethics board decisions
├─ Timeline: 1-2 weeks
└─ Authority: Can override ethics board with documented risk acceptance

Level 4: CEO and Board (if needed)
├─ Handles: Enterprise-wide ethical concerns, precedent-setting decisions
├─ Timeline: As needed
└─ Authority: Final decision on strategic ethical issues

Measurement and Accountability

Governance structures need metrics:

• Ethics board throughput: How many initiatives reviewed per quarter?
  - Ethics board decisions: What % approved? With conditions? Deferred? Rejected?
  - Timeline: How fast do decisions happen?
  - Compliance: For approved initiatives, how many actually follow the conditions the board set?
  - Escalations: How many ethics concerns get escalated? Are they resolved fairly?
  - Employee feedback: Do employees trust that ethics governance is real and working?

Measure these. Report on them. Use them to improve the governance structure.

What to Do Monday Morning

• 
  Map your current data governance. Do you have one? What's missing?
• 
  Design your ethics board structure. Who would be on it? How often would they meet? What authority would they have?
• 
  Identify your first high-risk AI initiative. Run it through your proposed governance structure. What questions would the board ask? Are you ready for those?
• 
  Draft escalation paths. For the scenarios I described, what's your path? Who decides? How fast?
• 
  Get leadership alignment. Show your CEO and board: Here's our governance structure. Here's how we're managing AI responsibly.

Key Takeaways

• Governance structures make policy real. Policy without governance is theater.
  - Data governance is foundational. Every AI system depends on data. Govern it rigorously.
  - Ethics boards need authority. They can only be theater or they can be real. Give them power to say no.
  - Escalation paths matter. When something goes wrong, you need a clear process to handle it.
  - Measure governance. Track decisions, timelines, compliance, escalations. Use this data to improve.

FAQ

Q: How do we prevent the ethics board from becoming a blocking committee?

A: Clear decision criteria. The board asks specific questions with specific answer thresholds. "If fairness testing shows less than 5% disparate impact, it's approved." That's not blocking, that's governance.

Q: What if the ethics board and business leaders disagree?

A: Escalate to the CHRO or CEO. Document the disagreement. Make the risk explicit. But give the business leader and ethics board a chance to align first.

Q: How do we keep the ethics board from meeting endlessly?

A: Timeline discipline. Initial assessment in 1 week. Detailed review in 2 weeks. Recommendation in week 4. Decision in week 5. If initiatives take longer than this, it's a process problem.

Q: What if the ethics board says no to something the CEO wants to do?

A: The CEO can override. But they're on record. The risk is documented. The ethics board recommendation is preserved. Over time, this creates accountability.

Moving from "No" to "How"

One risk of governance structures is that they can become blocking mechanisms. People see the ethics board as a barrier. "Nothing ever gets approved. Our competitor is shipping; we're stuck."

The best governance structures are generative, not blocking. They don't say "no". They say "yes, and here's how to make this work."

Reframing governance from blocking to enabling:

Instead of: "Disparate impact? Reject the initiative."
Say: "We found potential disparate impact. Here's what we recommend to fix it. Here's a 3-week timeline to get it right."

Instead of: "We don't have a bias audit. Can't proceed."
Say: "Let's run a quick fairness check this week. If it's clean, you move forward. If not, here's what we'll fix."

Instead of: "That's too risky."
Say: "Here's how we de-risk this. Here's what success looks like. Here's the monitoring plan. Let's move forward with these guardrails."

This mindset, governance as enabler, not blocker, changes how people relate to ethics and responsibility. Instead of being something imposed, it becomes something they own.

What's Next

You've got policy and governance structures. Now comes the philosophical question: What's HR's role in being the conscience of the organization around AI? When do you push back on innovation? When do you advocate for people? That's the final lesson of Chapter 3.