AI Governance

Traditional GRC assumes systems are deterministic — given the same input, they produce the same output. AI systems are probabilistic. A credit scoring model might approve one applicant and deny another with nearly identical profiles because of subtle differences in feature weights learned during training. The model's behavior can change over time as it encounters new data (model drift). The reasons for individual decisions may not be fully explainable even to the developers. This breaks fundamental assumptions in audit (how do you test a control that produces different outputs for similar inputs?), compliance (how do you prove non-discrimination if you can't fully explain the decision?), and risk management (how do you assess the risk of a system whose behavior changes without being explicitly reprogrammed?).