At a glance
Competency I.B set up the people; I.C sets up the rules they enforce. This competency is about the policy and procedure layer of an AI governance program across three moves: (1) create lifecycle policies that ensure oversight and accountability at every stage of the AI life cycle, (2) evaluate and update existing policies (privacy, security, data governance, IP) so they actually cover AI, and (3) manage third-party risk through assessments, contracts and acceptable-use policies.
A useful framing: a policy states the organization’s expectations and rules (the what/why); procedures, standards and controls make them operational (the how). Grounded in the NIST AI RMF Govern function (“policies, processes, procedures and practices are in place”) and ISO/IEC 42001’s documented-policy requirements, the exam tests the most widely accepted policy areas at the apply/analyze level.
I.C.1 — Lifecycle policies for oversight and accountability
The core requirement is policies that ensure oversight and accountability across all AI life cycle stages. The BOK enumerates the stages your policies must cover — learn the list, because exam questions test whether a control sits at the right stage:
| Life cycle stage | What the policy ensures |
|---|---|
| Use-case assessment | A gate to decide whether an AI use is appropriate, lawful and within risk tolerance before building. |
| Risk management | Identify, assess, mitigate and monitor risks throughout (ties to NIST Map/Measure/Manage). |
| Ethics by design | Embed responsible-AI/ethical considerations from the start of design, not after. |
| Data acquisition and use | Lawful rights to data; quality, provenance, minimization, bias checks. |
| Model & system development | Standards for how systems are built and reviewed. |
| Training and testing | Validation, performance, security, bias and interpretability testing before release. |
| Deployment and monitoring | Approval gates, human oversight, continuous monitoring for drift/degradation. |
| Documentation and reporting | Records (model cards, technical docs) to evidence compliance and enable review. |
| Incident management | Detect, escalate, respond to, document and learn from AI failures and harms. |
Two ideas the exam stresses:
- Oversight and accountability are end-to-end. Governance is not a one-time pre-launch sign-off; policies must run from use-case assessment through monitoring and incident management. Ethics by design specifically means building responsibility in early, not auditing it in late.
- Policies enable accountability by defining who approves, who reviews, what must be documented and how incidents are handled — the operational expression of the roles set in I.B.
I.C.2 — Evaluate and update existing policies for AI
Most organizations already have policies — for data privacy, security, data governance and intellectual property. The BOK’s requirement is to evaluate and update them for AI rather than write everything from scratch. AI stresses these existing policies in new ways:
| Existing policy | Why AI forces an update |
|---|---|
| Data privacy | Training on personal data raises lawful-basis, purpose-limitation, minimization, transparency and automated-decision (GDPR Art. 22) issues; DPIAs may be required. |
| Security | New attack surfaces — data poisoning, model inversion/extraction, adversarial examples, prompt injection — that traditional security policy never contemplated. |
| Data governance | Provenance, lineage, quality, bias and retention of training data; rights to use data for AI specifically. |
| Intellectual property | Rights to use third-party data for training; ownership/authorship of AI-generated outputs (the U.S. human-authorship requirement); leakage of confidential/IP data into external models. |
The takeaway the exam rewards: start by reviewing and extending what you have. Governance is partly new AI-specific policy (I.C.1) and partly adapting existing policy. Don’t assume current privacy/security/IP policies already cover AI — they usually do not address training-data rights, model-specific attacks, or generative-output ownership.
I.C.3 — Manage third-party risk
Most organizations consume AI they did not build — foundation models, APIs, vendor tools, components and data. The BOK requires policies, assessments and contracts to manage third-party risk across procurement, supply chain, human resources and acceptable use.
The control points:
- Procurement as a gate. Embed governance into buying: require a risk/impact assessment and due diligence before adopting a third-party AI system, so unvetted tools cannot enter through purchasing.
- Vendor due-diligence assessments. Evaluate the provider’s data practices, security, documentation, bias testing, compliance posture and ability to support your obligations.
- Contracts allocate responsibility. Negotiate terms covering data use and ownership, IP and confidentiality, security and audit rights, liability and indemnification, performance/SLAs, transparency/documentation, and breach/incident notification. Contracts are how you push duties up the supply chain — but accountability to regulators and customers stays with you (link back to I.B.1).
- Supply-chain visibility. Track the AI components and models embedded in your stack; a flaw upstream becomes your risk.
- Human resources. AI in hiring/HR brings nondiscrimination and notice duties; HR policy and vendor tools must be governed.
- Acceptable use policy (AUP). Define what employees may and may not do with AI tools — e.g., never enter confidential or personal data into public generative-AI tools — to curb shadow AI (unsanctioned use outside governance).
How this shows up later
- These lifecycle policies are the rules the build-side controls in Domain III and the deploy-side controls in Domain IV actually apply (impact assessments, monitoring, incident management).
- Updating privacy/security/IP policy sets up Domain II — the legal detail behind each update (GDPR, EU AI Act, U.S. copyright).
- Third-party assessments and contracts reappear directly when evaluating vendor/licensing agreements and proprietary-vs-third-party deployment in Domain IV (IV.B).
- Acceptable-use and procurement controls operationalize the proportionate, context-driven governance from I.B.4.