[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"portal-settings:stajic:es":3,"public-menus:all":38,"post:ai-governance-models-data-permissions-risk-and-auditability:es":205,"related:post:ai-governance-models-data-permissions-risk-and-auditability:es:1":3757},{"statusCode":4,"data":5,"message":37},200,{"tenantId":6,"lang":7,"defaultLang":8,"siteUrl":9,"contactEmail":10,"brandName":11,"logoUrl":12,"siteName":11,"siteDescription":13,"ogImage":10,"robotsIndex":14,"socialLinks":10,"reservedSlugs":10,"seoPolicy":15},"stajic","es","de","https:\u002F\u002Fstajic.de",null,"Stajic Platform","\u002FLogo_Planet.svg","Stajic Portal",true,{"branding":16,"relatedContent":17,"crossDomainLinks":18},{"logoUrl":12},{"enabled":14},[19,22,25,28,31,34],{"url":20,"label":21,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Ffigure.rocks","figure.rocks",{"url":23,"label":24,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Floving.rocks","loving.rocks",{"url":26,"label":27,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.com","bazify.com",{"url":29,"label":30,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.de","bazify.de",{"url":32,"label":33,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.at","bazify.at",{"url":35,"label":36,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.ba","bazify.ba","Portal settings resolved",[39,45],{"id":40,"name":41,"location":42,"isActive":14,"isDefault":43,"items":44},1,"main-navigation","header",false,[],{"id":46,"name":47,"location":48,"isActive":14,"isDefault":14,"items":49},4,"main-menu","sidebar",[50,66,79,93,103,118,133],{"id":51,"title":52,"url":60,"target":61,"icon":62,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":64,"portfolioId":10,"children":65},"item-18",{"de":53,"en":54,"es":55,"fr":56,"it":54,"ru":57,"sr":58,"zh":59},"Startseite","Home","Inicio","Accueil","Главная","Почетна","首页","\u002Ffull-stack-web-developer-munich-performance-seo-and-maintainable-builds","_self","i-lucide-home","page",111,[],{"id":67,"title":68,"url":75,"target":61,"icon":76,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":77,"portfolioId":10,"children":78},"item-22",{"de":69,"en":69,"es":70,"fr":69,"it":71,"ru":72,"sr":73,"zh":74},"Vision","Visión","Visione","Видение","Визија","想象","\u002Fueber-uns-webdesign-muenchen-webaplikation","i-lucide-eye",113,[],{"id":80,"title":81,"url":89,"target":61,"icon":90,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":91,"portfolioId":10,"children":92},"item-19",{"de":82,"en":83,"es":84,"fr":83,"it":85,"ru":86,"sr":87,"zh":88},"Leistungen","Services","Servicios","Servizi","Услуги","Услуге","服务","\u002Fservices-dienstleistungen-muenchen","i-lucide-wrench",116,[],{"id":94,"title":95,"url":99,"target":61,"icon":100,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":101,"portfolioId":10,"children":102},"item-23",{"de":96,"en":96,"es":96,"fr":96,"it":96,"ru":97,"sr":97,"zh":98},"Blog","Блог","博客","\u002Fblog","i-lucide-book-open",112,[],{"id":104,"title":105,"url":114,"target":61,"icon":115,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":116,"portfolioId":10,"children":117},"item-32",{"de":106,"en":107,"es":108,"fr":109,"it":110,"ru":111,"sr":112,"zh":113},"Neue Technologien","New Technologies","Nuevas tecnologías","Nouvelles technologies","Nuove tecnologie","Новые технологии","Нове технологије","新技术！","\u002Fneue-webtechnologien","i-lucide-sparkles",122,[],{"id":119,"title":120,"url":129,"target":61,"icon":130,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":131,"portfolioId":10,"children":132},"item-20",{"de":121,"en":122,"es":123,"fr":124,"it":125,"ru":126,"sr":127,"zh":128},"Kontakt","Contact us!","Contacto","Contact","Contatto","Контакт","Контактирајте нас","联系我们！","\u002Fcontact","i-lucide-mail",115,[],{"id":134,"title":135,"url":144,"target":61,"icon":145,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":146,"portfolioId":10,"children":147},"item-21",{"de":136,"en":137,"es":138,"fr":139,"it":140,"ru":141,"sr":142,"zh":143},"Unsere Arbeit","Our Work","Nuestro trabajo","Nos réalisations","I nostri lavori","Наши работы","Наши радови","文件夹","\u002Fportfolio","i-lucide-briefcase",114,[148,161,175,181,193],{"id":149,"title":150,"url":144,"target":61,"icon":159,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":146,"portfolioId":10,"children":160},"item-24",{"de":151,"en":152,"es":153,"fr":154,"it":155,"ru":156,"sr":157,"zh":158},"Alle Projekte","All Projects","Todos los proyectos","Tous les projets","Tutti i progetti","Все проекты","Сви пројекти","所有项目","i-lucide-grid-3x3",[],{"id":162,"title":163,"url":171,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":174},"item-29",{"de":164,"en":165,"es":166,"fr":167,"it":168,"ru":169,"sr":170,"zh":143},"Local Roots, Global Reach","Local Roots - Global Reach","Empresa local ","Entreprise locale","Azienda locale","Местная компания","Локално предузеће глобално тржиште","\u002Fportfolio\u002Flocal-roots-global-reach-communication-media-systems-for-modern-business","i-lucide-folder","custom",[],{"id":176,"title":177,"url":179,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":180},"item-28",{"de":178,"en":178,"es":178,"fr":178,"it":178,"ru":178,"sr":178,"zh":178},"Solr Suggester","\u002Fportfolio\u002Fsolr-fuzzy-suggester-und-solr-infix-suggester-abfrage-ueber-ajax-und-filterung",[],{"id":182,"title":183,"url":191,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":192},"item-27",{"de":184,"en":185,"es":186,"fr":187,"it":188,"ru":189,"sr":190,"zh":185},"Firmenwebseite SEO","Company Website SEO","Sitio web corporativo SEO","Site web d’entreprise SEO","Sito web aziendale SEO","Корпоративный сайт SEO","Пословна веб-страница SEO","\u002Fportfolio\u002Fseo-sem-branding-mobile-webseite-muenchen",[],{"id":194,"title":195,"url":203,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":204},"item-31",{"de":196,"en":197,"es":198,"fr":199,"it":200,"ru":201,"sr":202,"zh":197},"Digitalisierungsportal","Digitalization Portal","Portal de digitalización","Portail de numérisation","Portale di digitalizzazione","Портал цифровизации","Портал за дигитализацију","\u002Fportfolio\u002Fdigitalisierungsportal-archiv-museum-bibliothek-ead-lido-mets-mods",[],{"statusCode":4,"data":206,"message":3756},{"id":207,"title":208,"slug":209,"content":210,"contentJson":211,"excerpt":1718,"featuredImage":1719,"featuredImageAlt":1720,"featuredImageCaption":10,"featuredImageTitle":10,"featuredImageCopyright":10,"featuredImageAuthor":10,"featuredImageSourceUrl":10,"featuredImageLicense":10,"featuredImageIsAiGenerated":43,"status":1721,"publishedAt":1722,"createdAt":1723,"updatedAt":1724,"seoLocalePaths":1725,"categories":1734,"author":1735,"translations":1740},"491","Gobernanza de la IA: modelos, datos, permisos, riesgo y auditabilidad","ai-governance-models-data-permissions-risk-and-auditability","\u003Cp>La gobernanza de la IA es el sistema de derechos de decisión, responsabilidades, controles y evidencia utilizados para decidir cómo una organización puede desarrollar, adquirir, desplegar, operar, cambiar y retirar sistemas de IA. Es más amplia que un documento de políticas y más estrecha que la arquitectura empresarial en su conjunto. La gobernanza efectiva de la IA conecta la propiedad empresarial, las elecciones de modelos y proveedores, la autoridad sobre los datos, los permisos, la clasificación de riesgos, la evaluación, el monitoreo, la gestión de incidentes, la auditabilidad y las decisiones del ciclo de vida, de modo que alguien pueda responder no solo \"¿funciona la IA?\" sino también \"¿quién la aprobó, bajo qué condiciones, con qué evidencia y cuándo debe revisarse esa decisión?\"\u003C\u002Fp>\n\u003Caside class=\"editorjs-callout editorjs-callout--info my-6 rounded-xl border p-5 border-blue-300 bg-blue-50 dark:border-blue-900 dark:bg-blue-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Respuesta directa\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">\u003Cstrong>La gobernanza de la IA convierte la IA de una capacidad técnica informal en una capacidad organizacional responsable.\u003C\u002Fstrong>\u003Cbr>\u003Cbr>La arquitectura determina cómo se construye el sistema. La ingeniería lo implementa. La gestión de riesgos evalúa la incertidumbre y el daño. El cumplimiento aborda las obligaciones aplicables. La gobernanza conecta estas actividades mediante la propiedad, los derechos de decisión, los controles requeridos, la evidencia y las puertas del ciclo de vida.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Caside class=\"editorjs-callout editorjs-callout--warning my-6 rounded-xl border p-5 border-amber-300 bg-amber-50 dark:border-amber-900 dark:bg-amber-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">La gobernanza no es un comité ni un PDF\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">Un consejo de gobernanza puede ser un mecanismo, y las políticas pueden documentar expectativas, pero la gobernanza solo se vuelve operativa cuando las decisiones cambian lo que los sistemas pueden hacer: qué modelos pueden usarse, qué datos pueden ingresar en ellos, qué herramientas puede ejecutar un agente, qué evaluaciones se requieren, quién puede aprobar excepciones, qué debe registrarse y qué desencadena la suspensión o el retiro.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Caside class=\"editorjs-callout editorjs-callout--note my-6 rounded-xl border p-5 border-gray-300 bg-gray-50 dark:border-gray-700 dark:bg-gray-900\u002F40\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Nota de fuentes actuales — 8 de octubre de 2026\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">El NIST AI RMF 1.0 sigue siendo el marco publicado vigente mientras el NIST lo está revisando. Su núcleo se organiza en torno a \u003Cstrong>GOBERNAR, MAPEAR, MEDIR y GESTIONAR\u003C\u002Fstrong>, con GOBERNAR como función transversal. La ISO\u002FIEC 42001:2023 sigue siendo la norma internacional de sistemas de gestión de IA para establecer, operar y mejorar continuamente un sistema de gestión de IA. La Ley de IA de la UE es ahora generalmente aplicable desde el 2 de agosto de 2026, aunque algunas obligaciones tenían fechas de aplicación anteriores y algunos requisitos de alto riesgo tienen fechas de transición posteriores. Los plazos regulatorios siempre deben verificarse nuevamente antes de tomar una decisión de cumplimiento concreta.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Cnav class=\"editorjs-toc\" data-editorjs-toc=\"true\" aria-label=\"Contenido\">\u003Cstrong class=\"editorjs-toc__title\">Contenido\u003C\u002Fstrong>\u003Col class=\"editorjs-toc__list editorjs-toc__list--depth-0\">\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-6\" class=\"editorjs-toc__link\">Qué significa realmente la gobernanza de la IA\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-10\" class=\"editorjs-toc__link\">El ejemplo más simple\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-15\" class=\"editorjs-toc__link\">Dónde se detiene el ejemplo simple\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-19\" class=\"editorjs-toc__link\">Qué es la gobernanza de IA y qué no es\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-21\" class=\"editorjs-toc__link\">La gobernanza es más amplia que el cumplimiento normativo\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-25\" class=\"editorjs-toc__link\">NIST AI RMF e ISO\u002FIEC 42001 resuelven necesidades de gobernanza diferentes\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-28\" class=\"editorjs-toc__link\">Los plazos actuales del Reglamento de IA de la UE importan\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-32\" class=\"editorjs-toc__link\">La gobernanza de IA comienza con un inventario\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-37\" class=\"editorjs-toc__link\">La gobernanza requiere responsabilidad nominada\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-41\" class=\"editorjs-toc__link\">Los derechos de decisión deben ser explícitos\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-43\" class=\"editorjs-toc__link\">La gobernanza del modelo es más que elegir un modelo\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-47\" class=\"editorjs-toc__link\">La gobernanza del proveedor es una capa de dependencia separada\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-51\" class=\"editorjs-toc__link\">La gobernanza de datos sigue siendo la capa de fuente de verdad\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-55\" class=\"editorjs-toc__link\">Los permisos son decisiones de gobernanza con aplicación en tiempo de ejecución\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-59\" class=\"editorjs-toc__link\">La clasificación de riesgos debe cambiar el conjunto de controles\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-63\" class=\"editorjs-toc__link\">La gobernanza debe preservar el contexto del caso de uso\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-67\" class=\"editorjs-toc__link\">La evaluación es evidencia de gobernanza\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-72\" class=\"editorjs-toc__link\">Las puertas de gobernanza deben existir a lo largo del ciclo de vida\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-74\" class=\"editorjs-toc__link\">La gestión de cambios es fundamental para la gobernanza de la IA\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-78\" class=\"editorjs-toc__link\">Las excepciones necesitan propietarios, caducidad y controles compensatorios\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-82\" class=\"editorjs-toc__link\">La auditabilidad es la capacidad de reconstruir la decisión y la ejecución\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-87\" class=\"editorjs-toc__link\">El monitoreo cierra el ciclo de gobernanza\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-91\" class=\"editorjs-toc__link\">Los incidentes de IA necesitan una ruta operativa definida\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-95\" class=\"editorjs-toc__link\">La adquisición forma parte de la gobernanza de IA\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-99\" class=\"editorjs-toc__link\">La supervisión humana debe diseñarse, no solo declararse\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-103\" class=\"editorjs-toc__link\">La gobernanza de plataforma y la gobernanza de casos de uso son diferentes\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-106\" class=\"editorjs-toc__link\">Gobernanza de IA y Arquitectura de IA Empresarial\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-110\" class=\"editorjs-toc__link\">Evidencia del proyecto original\u003C\u002Fa>\u003Col class=\"editorjs-toc__list editorjs-toc__list--depth-1\">\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-111\" class=\"editorjs-toc__link\">Enterprise Aaasaasa 0.1: la gobernanza como estructura de entrega\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-116\" class=\"editorjs-toc__link\">SenseFlow: trazabilidad de requisitos y decisiones\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-119\" class=\"editorjs-toc__link\">Aaasaasa AI Client: permisos y tiempo de ejecución como configuración gobernada\u003C\u002Fa>\u003C\u002Fli>\u003C\u002Fol>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-124\" class=\"editorjs-toc__link\">Modos comunes de fallo en la gobernanza de IA\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-126\" class=\"editorjs-toc__link\">Gobernanza central no significa centralizar cada decisión\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-130\" class=\"editorjs-toc__link\">Gobernar el propio sistema de gobernanza\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-134\" class=\"editorjs-toc__link\">Una secuencia práctica de implementación de gobernanza de IA\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-136\" class=\"editorjs-toc__link\">Lista de verificación de gobernanza de IA\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-138\" class=\"editorjs-toc__link\">Conceptos erróneos comunes\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-140\" class=\"editorjs-toc__link\">Casos límite y limitaciones\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-146\" class=\"editorjs-toc__link\">¿Qué cambiaría esta respuesta?\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-150\" class=\"editorjs-toc__link\">Conocimiento canónico relacionado\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-157\" class=\"editorjs-toc__link\">Preguntas frecuentes\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-159\" class=\"editorjs-toc__link\">Glosario\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-161\" class=\"editorjs-toc__link\">Conclusión\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-165\" class=\"editorjs-toc__link\">Fuentes primarias y referencias actuales\u003C\u002Fa>\u003C\u002Fli>\u003C\u002Fol>\u003C\u002Fnav>\n\u003Ch2 id=\"section-6\">Qué significa realmente la gobernanza de la IA\u003C\u002Fh2>\n\u003Cp>La gobernanza de la IA responde preguntas organizacionales que un modelo, un SDK o un diagrama de arquitectura no pueden responder por sí solos. ¿Quién es dueño del resultado empresarial? ¿Quién puede aprobar un nuevo proveedor? ¿Qué clases de datos están prohibidas para el procesamiento externo? ¿Qué evidencia se requiere antes del despliegue? ¿Qué permisos puede recibir un agente? ¿Quién puede aceptar el riesgo residual? ¿Qué sucede cuando un modelo cambia de comportamiento después de una actualización?\u003C\u002Fp>\n\u003Cp>El propósito no es impedir el cambio. Una buena gobernanza hace que el cambio sea legible: las decisiones tienen dueños, evidencia, condiciones, excepciones, fechas de revisión y rutas de reversión o escalamiento.\u003C\u002Fp>\n\u003Cp>Por eso el NIST sitúa GOBERNAR a lo largo de todo el ciclo de vida de la gestión de riesgos de IA, en lugar de tratar la gobernanza como un único paso final de aprobación. La gobernanza establece la cultura, las políticas, la responsabilidad y las estructuras organizacionales que hacen posible mapear, medir y gestionar el riesgo de la IA.\u003C\u002Fp>\n\u003Ch2 id=\"section-10\">El ejemplo más simple\u003C\u002Fh2>\n\u003Cp>Un equipo de producto quiere añadir un proveedor externo de IA generativa para resumir tickets internos de soporte al cliente. Técnicamente, la integración puede requerir solo una llamada a la API.\u003C\u002Fp>\n\u003Cp>La gobernanza plantea un conjunto diferente de preguntas: ¿Se permite que el contenido de los tickets salga del entorno de la organización? ¿Qué proveedor y versión del modelo están aprobados? ¿Está deshabilitada la retención? ¿Qué usuarios pueden invocar la función? ¿Cómo se evalúa la salida? ¿Se requiere revisión humana? ¿Qué se registra? ¿Quién es responsable de los incidentes? ¿Qué sucede si el proveedor cambia sus términos o el comportamiento del modelo?\u003C\u002Fp>\n\u003Cp>El resultado de la gobernanza aún puede ser \"despliégalo\". La diferencia es que el despliegue ahora es una decisión rastreable con condiciones explícitas en lugar de una elección de ingeniería no registrada.\u003C\u002Fp>\n\u003Csection class=\"editorjs-process my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Una decisión básica de IA gobernada\u003C\u002Fh3>\u003Cdiv class=\"grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4\">\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">1\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">1. Registrar el caso de uso\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Registrar el propósito, el propietario, los usuarios, los datos, el modelo\u002Fproveedor y el resultado previsto.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">2\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">2. Clasificar el riesgo y las obligaciones\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Determinar la consecuencia empresarial, la sensibilidad de los datos, la autonomía, la exposición regulatoria y el potencial de uso indebido.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">3\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">3. Definir los controles requeridos\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Especificar permisos, manejo de datos, evaluaciones, supervisión humana, seguridad, registro y restricciones del proveedor.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">4\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">4. Recopilar evidencia\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Ejecutar pruebas, revisión de seguridad\u002Fprivacidad, revisión de arquitectura y verificaciones legales\u002Fde cumplimiento relevantes.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">5\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">5. Tomar una decisión\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Aprobar, aprobar con condiciones, solicitar cambios, retener o rechazar.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">6\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">6. Desplegar bajo una configuración controlada\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Fijar el modelo\u002Fproveedor\u002Fentorno de ejecución aprobado y hacer cumplir los límites requeridos.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">7\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">7. Monitorear y reevaluar\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Rastrear incidentes, calidad, deriva, cambios del proveedor, nuevos riesgos y regulaciones modificadas.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">8\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">8. Cambiar, suspender o retirar\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Usar la evidencia y las reglas de propiedad para decidir el siguiente estado del ciclo de vida.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-15\">Dónde se detiene el ejemplo simple\u003C\u002Fh2>\n\u003Cp>Las grandes organizaciones rara vez gobiernan un solo sistema de IA de forma aislada. El mismo modelo puede soportar docenas de productos; un proveedor puede procesar varias clases de datos; una plataforma de agentes puede exponer herramientas compartidas a muchos equipos.\u003C\u002Fp>\n\u003Cp>Por lo tanto, la gobernanza necesita estructuras a nivel de cartera, así como controles a nivel de sistema: inventario de IA, proveedores aprobados, catálogos de modelos, líneas base de evaluación compartidas, patrones de seguridad, umbrales de riesgo, registros de excepciones y mapeos de propiedad.\u003C\u002Fp>\n\u003Cp>La gobernanza tampoco puede ser idéntica para cada uso de IA. Un resumidor de contenido público, un asistente de programación interno, un sistema de apoyo a la contratación y un agente que puede iniciar pagos tienen perfiles de consecuencia y control materialmente diferentes.\u003C\u002Fp>\n\u003Ch2 id=\"section-19\">Qué es la gobernanza de IA y qué no es\u003C\u002Fh2>\n\u003Csection class=\"editorjs-comparison my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">La gobernanza de IA comparada con disciplinas adyacentes\u003C\u002Fh3>\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left dark:border-gray-700 dark:bg-gray-900\">\u003C\u002Fth>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left font-semibold dark:border-gray-700 dark:bg-gray-900\">Gobernanza de IA\u003C\u002Fth>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left font-semibold dark:border-gray-700 dark:bg-gray-900\">Disciplina adyacente\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Arquitectura empresarial \u002F de soluciones\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Gestión de riesgos de IA\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Cumplimiento normativo\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Seguridad\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">MLOps \u002F LLMOps\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Principios de ética de IA\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-21\">La gobernanza es más amplia que el cumplimiento normativo\u003C\u002Fh2>\n\u003Cp>El cumplimiento normativo es una entrada a la gobernanza, no todo el sistema de gobernanza. Un caso de uso de IA puede estar legalmente permitido y aun así violar el apetito de riesgo de la empresa, la política de seguridad, las obligaciones contractuales o los requisitos de calidad del producto.\u003C\u002Fp>\n\u003Cp>Lo contrario también importa: la aprobación interna no anula la ley. La gobernanza debe hacer visibles las obligaciones legales aplicables dentro de la misma ruta de decisión utilizada para la arquitectura, la seguridad y el riesgo empresarial.\u003C\u002Fp>\n\u003Cp>ISO\u002FIEC 42001 enmarca explícitamente un sistema de gestión de IA como una forma estructurada de establecer políticas, objetivos y procesos para una IA responsable. ISO también afirma que la norma no reemplaza las leyes ni las regulaciones; proporciona un marco de gestión que puede apoyar el cumplimiento normativo.\u003C\u002Fp>\n\u003Ch2 id=\"section-25\">NIST AI RMF e ISO\u002FIEC 42001 resuelven necesidades de gobernanza diferentes\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Marco \u002F norma\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Rol principal\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Valor de gobernanza útil\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">NIST AI RMF 1.0\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Marco voluntario de gestión de riesgos de IA\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Organiza los resultados en torno a GOVERN, MAP, MEASURE y MANAGE a lo largo del ciclo de vida\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">NIST AI 600-1\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Perfil de IA generativa para AI RMF\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Añade consideraciones y acciones de riesgo específicas de IA generativa\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">ISO\u002FIEC 42001:2023\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Requisitos de sistema de gestión de IA\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Crea un sistema de gestión para toda la organización con política, roles, procesos y mejora continua\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">ISO\u002FIEC 23894:2023\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Guía de gestión de riesgos de IA\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Orienta la integración de la gestión de riesgos específicos de IA en las actividades organizacionales\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Reglamento de IA de la UE\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Regulación vinculante en la UE\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Crea obligaciones legales según el actor, la categoría de IA y el caso de uso\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>Estas fuentes no deben reducirse a una única lista de verificación. NIST AI RMF es una guía de gestión de riesgos. ISO\u002FIEC 42001 es una norma de sistema de gestión. El Reglamento de IA de la UE es ley. Una organización puede usarlos juntos, pero su autoridad, alcance y propósito de implementación son diferentes.\u003C\u002Fp>\n\u003Ch2 id=\"section-28\">Los plazos actuales del Reglamento de IA de la UE importan\u003C\u002Fh2>\n\u003Cp>A partir del 8 de octubre de 2026, la Comisión Europea declara que el Reglamento de IA pasó a ser generalmente aplicable el 2 de agosto de 2026. Las disposiciones sobre prácticas prohibidas y alfabetización en IA se aplicaron desde el 2 de febrero de 2025, mientras que las reglas de gobernanza y las obligaciones para modelos de IA de propósito general se aplicaron desde el 2 de agosto de 2025.\u003C\u002Fp>\n\u003Cp>La guía actual de la Comisión también refleja fechas de aplicación posteriores para ciertos requisitos de alto riesgo. Las fechas exactas y las reglas de transición son una entrada de cumplimiento cambiante y deben verificarse contra el material actual de la Comisión antes de una decisión de despliegue.\u003C\u002Fp>\n\u003Caside class=\"editorjs-callout editorjs-callout--warning my-6 rounded-xl border p-5 border-amber-300 bg-amber-50 dark:border-amber-900 dark:bg-amber-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Artículo de arquitectura, no asesoramiento legal\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">Los ejemplos regulatorios aquí explican por qué la gobernanza necesita entradas legales\u002Fde cumplimiento versionadas. No determinan si un producto específico se clasifica legalmente como prohibido, de alto riesgo, GPAI, implementador, proveedor u otro actor regulado.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Ch2 id=\"section-32\">La gobernanza de IA comienza con un inventario\u003C\u002Fh2>\n\u003Cp>Una organización no puede gobernar sistemas de IA que no puede identificar. El inventario debe cubrir más que modelos entrenados a medida. Puede incluir API de modelos externos, copilotos integrados, modelos locales, funciones de SaaS habilitadas para IA, entornos de ejecución de agentes, sistemas de recuperación y componentes de decisión automatizados.\u003C\u002Fp>\n\u003Cp>Un inventario útil conecta la capacidad de IA con su propietario empresarial, propietario técnico, caso de uso, usuarios, clases de datos, modelo\u002Fproveedor, entorno de despliegue, permisos, clasificación de riesgo, estado de evaluación, obligaciones aplicables y estado del ciclo de vida.\u003C\u002Fp>\n\u003Cp>El inventario no es solo una hoja de cálculo para auditores. Es el índice que permite a la organización saber qué debe revisarse cuando cambia un proveedor, aparece una vulnerabilidad, se vuelve aplicable una regulación o se retira un modelo.\u003C\u002Fp>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Campo del inventario\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Por qué la gobernanza lo necesita\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Caso de uso \u002F propósito\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Define por qué existe la IA y qué significa el éxito\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Propietario empresarial\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Es dueño del resultado y del riesgo empresarial\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Propietario técnico\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Es dueño de la arquitectura, la implementación y la operación\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Modelo + versión\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Identifica la dependencia que produce el comportamiento\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Proveedor \u002F entorno de ejecución\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Identifica la dependencia contractual, de alojamiento y operativa\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Clases de datos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Determina restricciones de privacidad, confidencialidad y fuente de verdad\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Usuarios \u002F partes afectadas\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Determina la exposición y el contexto de impacto humano\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Herramientas \u002F acciones\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Determina la autonomía y el riesgo de efectos secundarios\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Permisos \u002F identidad\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Define quién o qué puede invocar la capacidad\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Clasificación de riesgo\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Determina los controles requeridos y la ruta de aprobación\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Evidencia de evaluación\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Muestra si se probó el comportamiento previsto\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Estado del ciclo de vida\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Borrador, revisión, aprobado, restringido, suspendido o retirado\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Fecha de revisión \u002F disparadores\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Define cuándo debe revisarse la decisión de gobernanza\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-37\">La gobernanza requiere responsabilidad nominada\u003C\u002Fh2>\n\u003Cp>Los fallos de IA a menudo cruzan los límites organizacionales. Un problema de calidad del modelo puede convertirse en un fallo de producto, un problema de seguridad, un incidente de privacidad o un incumplimiento contractual. La gobernanza necesita responsables nominados antes de que ocurra el incidente.\u003C\u002Fp>\n\u003Cp>La responsabilidad no significa que una sola persona sea responsable de todo. Un modelo sólido separa los derechos de decisión: propietario del negocio, propietario del producto, propietario técnico, propietario de datos, especialistas en seguridad\u002Fprivacidad, actores legales\u002Fcumplimiento y soporte operativo.\u003C\u002Fp>\n\u003Cp>La propiedad crítica es que cada decisión requerida tenga un responsable y que cada responsable sepa qué evidencia se espera que revise.\u003C\u002Fp>\n\u003Ch2 id=\"section-41\">Los derechos de decisión deben ser explícitos\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Decisión\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Función responsable típica\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Puede existir este caso de uso de IA?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Propietario del negocio\u002Fproducto con aporte de gobernanza\u002Friesgo\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Puede procesarse esta clase de datos?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Propietario de datos + privacidad\u002Fseguridad según la política\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Puede usarse este proveedor\u002Fmodelo?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Arquitectura\u002Fplataforma + seguridad\u002Fadquisiciones + gobernanza\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Puede este agente ejecutar esta acción?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Propietario de la aplicación + propietario de autorización\u002Fpolítica de negocio\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Es la calidad suficiente para el despliegue?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Propietario de producto\u002Ftécnico frente a criterios de aceptación definidos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Puede aceptarse el riesgo residual?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Responsable de riesgo nominado en el nivel de autoridad adecuado\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Puede concederse una excepción?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Autoridad de excepción explícita, con límite temporal y documentada\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Debería suspenderse el sistema?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Propietario operativo\u002Fnegocio bajo incidentes o desencadenantes de riesgo\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Puede entrar en producción una actualización del modelo?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Responsable del cambio tras evidencia de regresión\u002Fevaluación\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-43\">La gobernanza del modelo es más que elegir un modelo\u003C\u002Fh2>\n\u003Cp>La gobernanza del modelo rastrea qué modelo se utiliza, con qué propósito, bajo qué configuración y evidencia. Esto se aplica a API externas, modelos alojados localmente, modelos ajustados y modelos integrados en software de terceros.\u003C\u002Fp>\n\u003Cp>Una decisión de modelo debe considerar la capacidad, los resultados de evaluación, el costo, la latencia, el manejo de datos, los términos del proveedor, el soporte del ciclo de vida, las restricciones geográficas\u002Fde alojamiento, la seguridad, el comportamiento de respaldo y las consecuencias del cambio de versión.\u003C\u002Fp>\n\u003Cp>Los alias de modelo como “latest” pueden ser operativamente convenientes pero debilitan la reproducibilidad si el comportamiento cambia sin un proceso de liberación gobernado. Los sistemas consecuentes se benefician del seguimiento explícito de versiones y la evaluación de regresión.\u003C\u002Fp>\n\u003Ch2 id=\"section-47\">La gobernanza del proveedor es una capa de dependencia separada\u003C\u002Fh2>\n\u003Cp>Dos sistemas que utilizan la misma familia de modelos pueden tener un riesgo de gobernanza diferente si uno se ejecuta localmente y otro envía datos a un proveedor externo. La gobernanza del proveedor cubre términos contractuales, ubicación de procesamiento, retención, registro, subprocesadores, disponibilidad, obsolescencia y estrategia de salida.\u003C\u002Fp>\n\u003Cp>La abstracción del proveedor puede reducir el bloqueo técnico, pero no elimina el trabajo de gobernanza. Cambiar de proveedor puede cambiar los flujos de datos, el comportamiento del modelo, los supuestos de seguridad, el costo y las obligaciones de cumplimiento.\u003C\u002Fp>\n\u003Cp>Por lo tanto, una lista de proveedores aprobados no debe interpretarse como “cada modelo y cada clase de datos de este proveedor están aprobados automáticamente”. La aprobación necesita alcance.\u003C\u002Fp>\n\u003Ch2 id=\"section-51\">La gobernanza de datos sigue siendo la capa de fuente de verdad\u003C\u002Fh2>\n\u003Cp>La gobernanza de IA no hace que el modelo sea la autoridad para los hechos organizacionales. La gobernanza de datos aún determina la propiedad, clasificación, retención, calidad y uso permitido de los datos de origen.\u003C\u002Fp>\n\u003Cp>Para RAG y agentes, la gobernanza debe identificar qué fuentes son autoritativas, cuáles son consultivas, cómo se preserva la procedencia, qué datos pueden entrar en el contexto del modelo y qué límites de inquilino\u002Fusuario deben aplicarse.\u003C\u002Fp>\n\u003Cp>Las salidas generadas también crean nuevas preguntas de gobernanza de datos: si se retienen las indicaciones y respuestas, quién puede acceder a los rastros, si los resúmenes generados se convierten en registros y cómo se eliminan los embeddings o índices derivados cuando se eliminan los datos de origen.\u003C\u002Fp>\n\u003Ch2 id=\"section-55\">Los permisos son decisiones de gobernanza con aplicación en tiempo de ejecución\u003C\u002Fh2>\n\u003Cp>La IA agéntica convierte los permisos en un objeto de gobernanza de primer nivel. La organización necesita decidir a qué herramientas, archivos, API, bases de datos y efectos secundarios puede acceder cada agente o usuario.\u003C\u002Fp>\n\u003Cp>La gobernanza define la política y la lógica de aprobación; el entorno de ejecución confiable la aplica. Las instrucciones en lenguaje natural como \"no eliminar archivos\" no sustituyen la autorización de sistemas de archivos, API o servicios.\u003C\u002Fp>\n\u003Cp>El mismo principio se aplica al aislamiento de inquilinos: un rol puede autorizar una operación mientras que el alcance del inquilino restringe a qué recursos de qué cliente puede llegar esa operación.\u003C\u002Fp>\n\u003Ch2 id=\"section-59\">La clasificación de riesgos debe cambiar el conjunto de controles\u003C\u002Fh2>\n\u003Cp>No todos los sistemas de IA necesitan la misma profundidad de revisión. La gobernanza se vuelve escalable cuando la clasificación de riesgos modifica los requisitos de evidencia, aprobación y monitoreo.\u003C\u002Fp>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Factor de riesgo\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Ejemplo de menor control\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Ejemplo de mayor control\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Consecuencia empresarial\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Borrador de texto interno\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Aprobar una liquidación financiera\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Impacto humano\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ayuda de escritura opcional\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Apoyo a decisiones de empleo o elegibilidad\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sensibilidad de los datos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Documentación pública\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Datos de salud, RR. HH., financieros o confidenciales\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Autonomía\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Recomendación de solo lectura\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Agente con herramientas de escritura\u002Fpago\u002Fdespliegue\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Reversibilidad\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Resumen fácilmente regenerable\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Transacción externa irreversible\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Exposición\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Piloto interno pequeño\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sistema público\u002Fde cara al cliente a escala\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Autoridad de la fuente\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Contenido de asesoramiento\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sistema en el que se confía para un hecho regulado o contractual\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Detectabilidad de fallos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Defecto de formato obvio\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Recomendación plausible pero materialmente incorrecta\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>El método de clasificación puede ser simple o sofisticado, pero debe corresponderse con consecuencias concretas: más pruebas, permisos más restringidos, supervisión humana obligatoria, revisión de seguridad, aceptación ejecutiva del riesgo o prohibición del despliegue.\u003C\u002Fp>\n\u003Ch2 id=\"section-63\">La gobernanza debe preservar el contexto del caso de uso\u003C\u002Fh2>\n\u003Cp>La función MAP del NIST enfatiza el propósito previsto, los usuarios, el contexto de despliegue, los supuestos, los impactos y las leyes o normas aplicables. Esto importa porque el mismo modelo puede ser de bajo riesgo en un caso de uso y de altas consecuencias en otro.\u003C\u002Fp>\n\u003Cp>Por lo tanto, los registros de gobernanza deben clasificar la aplicación, no solo el modelo. \"Usamos el modelo X\" no es suficiente para determinar el riesgo.\u003C\u002Fp>\n\u003Cp>El objeto de gobernanza relevante es el sistema\u002Fcaso de uso: modelo + datos + contexto + herramientas + usuarios + entorno de despliegue + proceso de negocio.\u003C\u002Fp>\n\u003Ch2 id=\"section-67\">La evaluación es evidencia de gobernanza\u003C\u002Fh2>\n\u003Cp>Un proceso de gobernanza de IA no debe aprobar el despliegue basándose únicamente en los puntos de referencia de un proveedor o en una demostración exitosa. El sistema necesita evidencia vinculada a su uso previsto real.\u003C\u002Fp>\n\u003Cp>La evidencia útil puede incluir la evaluación del éxito en la tarea, la calidad de la recuperación, la fundamentación fáctica, las pruebas de seguridad, las pruebas de permisos, los escenarios adversarios, los estudios de revisión humana, la latencia\u002Fcosto, la robustez y las comparaciones de regresión.\u003C\u002Fp>\n\u003Cp>La función MEASURE del NIST lo hace explícito: las organizaciones deben identificar y aplicar métodos y métricas apropiados para los riesgos identificados durante el mapeo, documentando al mismo tiempo los riesgos que no pueden o no serán medidos.\u003C\u002Fp>\n\u003Caside class=\"editorjs-callout editorjs-callout--success my-6 rounded-xl border p-5 border-emerald-300 bg-emerald-50 dark:border-emerald-900 dark:bg-emerald-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Una puerta de gobernanza debe pedir evidencia, no confianza\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">"El equipo cree que el modelo es suficientemente bueno" es un artefacto de aprobación débil. "El sistema cumplió los criterios de aceptación definidos en pruebas representativas, con estas limitaciones conocidas y riesgos residuales" es gobernable.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Ch2 id=\"section-72\">Las puertas de gobernanza deben existir a lo largo del ciclo de vida\u003C\u002Fh2>\n\u003Csection class=\"editorjs-process my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Puertas de ciclo de vida de ejemplo\u003C\u002Fh3>\u003Cdiv class=\"grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4\">\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">1\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Puerta de idea \u002F descubrimiento\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Confirmar el propósito empresarial, el propietario y si la IA es una solución adecuada.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">2\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Puerta de arquitectura\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Revisar el modelo\u002Fproveedor, el flujo de datos, la identidad, los permisos, el aislamiento y el diseño operativo.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">3\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Puerta de riesgo\u002Fcumplimiento\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Clasificar el riesgo y las obligaciones aplicables; definir los controles requeridos.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">4\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Puerta de validación\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Exigir evidencia de que se cumplen los criterios funcionales, de seguridad, de protección y de calidad.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">5\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Puerta de despliegue\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Aprobar la configuración concreta, la versión, el entorno y el propietario operativo.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">6\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Puerta de cambio\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Reevaluar los cambios de modelo\u002Fproveedor\u002Fherramienta\u002Fdatos según su materialidad.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">7\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Puerta de incidente\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Pausar, restringir o revertir cuando se produzcan los desencadenantes de riesgo definidos.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">8\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Puerta de retirada\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Eliminar limpiamente el acceso, los derivados de datos, las credenciales y las dependencias obsoletas.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-74\">La gestión de cambios es fundamental para la gobernanza de la IA\u003C\u002Fh2>\n\u003Cp>Los sistemas de IA cambian incluso cuando el código de la aplicación no lo hace. Los proveedores actualizan modelos, filtros de seguridad, límites de contexto, precios, políticas e infraestructura. Los corpus de recuperación cambian. Las herramientas de los agentes obtienen permisos. Las regulaciones y los contratos evolucionan.\u003C\u002Fp>\n\u003Cp>Por lo tanto, la gobernanza debe definir desencadenantes de cambios materiales. Un ajuste menor en la redacción de un prompt puede requerir pruebas de regresión ordinarias; reemplazar el modelo, habilitar herramientas de escritura o introducir datos sensibles puede requerir una nueva puerta de aprobación.\u003C\u002Fp>\n\u003Cp>El registro de gobernanza debe preservar qué versión fue aprobada y qué condiciones hicieron válida la aprobación.\u003C\u002Fp>\n\u003Ch2 id=\"section-78\">Las excepciones necesitan propietarios, caducidad y controles compensatorios\u003C\u002Fh2>\n\u003Cp>Las organizaciones reales necesitan excepciones. Un equipo puede necesitar un modelo no aprobado para un experimento de duración limitada, o un sistema heredado puede que aún no cumpla un nuevo requisito de registro.\u003C\u002Fp>\n\u003Cp>El patrón peligroso es una excepción permanente no documentada. Las excepciones gobernables especifican propietario, justificación, alcance, riesgo residual, control compensatorio, fecha de caducidad y condición de revisión.\u003C\u002Fp>\n\u003Cp>La gestión de excepciones debe formar parte del sistema de gobernanza normal en lugar de un canal lateral informal.\u003C\u002Fp>\n\u003Ch2 id=\"section-82\">La auditabilidad es la capacidad de reconstruir la decisión y la ejecución\u003C\u002Fh2>\n\u003Cp>La auditabilidad de la IA no consiste meramente en almacenar prompts de modelos. Significa poder reconstruir qué versión del sistema se utilizó, qué datos y permisos se aplicaron, quién aprobó la configuración, qué evaluaciones respaldaron el despliegue y qué ocurrió durante la ejecución relevante.\u003C\u002Fp>\n\u003Cp>Para un agente, esto puede requerir la identidad del principal, las llamadas a herramientas, las aprobaciones, los recursos objetivo, los cambios de estado y los resultados. Para RAG, puede requerir la versión del corpus\u002Fíndice, la consulta de recuperación, la evidencia seleccionada y la procedencia. Para un cambio de modelo, puede requerir los resultados de evaluación anteriores y nuevos.\u003C\u002Fp>\n\u003Cp>La evidencia de auditoría debe ser proporcionada. Registrar cada token posible puede crear un riesgo de privacidad y seguridad por sí mismo. La gobernanza debe definir qué evidencia es necesaria, cuánto tiempo se conserva y quién puede acceder a ella.\u003C\u002Fp>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Objeto de auditoría\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Evidencia útil\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Decisión de gobernanza\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Propietario, fecha, decisión, condiciones, evidencia, excepciones\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Lanzamiento de modelo\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Modelo\u002Fproveedor\u002Fversión, configuración, resultados de regresión\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Acceso a datos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Principal, inquilino\u002Falcance, clase de origen, decisión de política\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Acción del agente\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Herramienta, argumentos\u002Fobjetivo, aprobación, resultado, cambio de estado\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Respuesta RAG\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Versión del corpus\u002Fíndice, conjunto de recuperación, evidencia seleccionada, citas\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Incidente\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Desencadenante, sistemas afectados, contención, propietario de la decisión, remediación\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Retirada\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Puntos finales deshabilitados, credenciales revocadas, datos derivados eliminados, decisión de archivo\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-87\">El monitoreo cierra el ciclo de gobernanza\u003C\u002Fh2>\n\u003Cp>La aprobación es una instantánea. El monitoreo en producción indica a la gobernanza si las suposiciones detrás de la aprobación aún se mantienen.\u003C\u002Fp>\n\u003Cp>Las señales útiles dependen del caso de uso: regresión de calidad, salidas inseguras, fallos de herramientas, denegaciones de políticas, costos inusuales, latencia, quejas de usuarios, deriva, frescura de recuperación, incidentes del proveedor, alertas de seguridad o nuevas clasificaciones regulatorias.\u003C\u002Fp>\n\u003Cp>La gobernanza debe definir umbrales que provoquen acciones: investigar, restringir, requerir revisión humana, revertir, cambiar de proveedor, suspender o retirar.\u003C\u002Fp>\n\u003Ch2 id=\"section-91\">Los incidentes de IA necesitan una ruta operativa definida\u003C\u002Fh2>\n\u003Cp>Los incidentes específicos de IA pueden implicar contenido dañino, fuga de datos, acciones no autorizadas, fallo factual persistente, interrupción del modelo o del proveedor, inyección de prompts, recuperación entre inquilinos o comportamiento inesperado tras una actualización del modelo.\u003C\u002Fp>\n\u003Cp>El proceso de incidentes debe conectar la respuesta técnica con la responsabilidad de gobernanza. Alguien debe estar autorizado para deshabilitar un modelo, retirar una herramienta, revocar credenciales, restringir usuarios, notificar a las funciones afectadas y decidir si el sistema puede volver al servicio.\u003C\u002Fp>\n\u003Cp>Las lecciones de los incidentes deben actualizar políticas, pruebas, clasificación de riesgos y controles de plataforma reutilizables en lugar de permanecer aisladas en un solo equipo.\u003C\u002Fp>\n\u003Ch2 id=\"section-95\">La adquisición forma parte de la gobernanza de IA\u003C\u002Fh2>\n\u003Cp>Las organizaciones pueden adquirir una capacidad sustancial de IA mediante la adquisición ordinaria de SaaS. Por lo tanto, la gobernanza debe cubrir tanto las funciones de IA compradas como los sistemas desarrollados internamente.\u003C\u002Fp>\n\u003Cp>La revisión de proveedores puede incluir el uso de datos, la retención, la política de entrenamiento de modelos, los subprocesadores, la seguridad, la notificación de incidentes, la exportación o eliminación, el procesamiento geográfico, el cambio de versión, la continuidad del servicio y la salida contractual.\u003C\u002Fp>\n\u003Cp>Una revisión de arquitectura técnica y una revisión de adquisición deben compartir el mismo inventario de sistemas para que la aprobación comercial no se aleje del flujo de datos realmente desplegado.\u003C\u002Fp>\n\u003Ch2 id=\"section-99\">La supervisión humana debe diseñarse, no solo declararse\u003C\u002Fh2>\n\u003Cp>El 'humano en el bucle' solo tiene sentido si el humano tiene autoridad, tiempo, información y un mecanismo de intervención utilizable.\u003C\u002Fp>\n\u003Cp>Un revisor que solo ve la recomendación de la IA pero no su evidencia, incertidumbre o estado de la fuente puede simplemente aprobar la salida sin más. La gobernanza debe especificar qué puede inspeccionar el revisor y qué acciones están disponibles: aprobar, rechazar, editar, escalar o detener.\u003C\u002Fp>\n\u003Cp>La supervisión humana también debe basarse en el riesgo. Los sistemas de bajas consecuencias pueden usar muestreo o revisión posterior, mientras que los efectos secundarios de altas consecuencias pueden requerir aprobación antes de la ejecución.\u003C\u002Fp>\n\u003Ch2 id=\"section-103\">La gobernanza de plataforma y la gobernanza de casos de uso son diferentes\u003C\u002Fh2>\n\u003Csection class=\"editorjs-comparison my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Dos niveles de gobernanza\u003C\u002Fh3>\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left dark:border-gray-700 dark:bg-gray-900\">\u003C\u002Fth>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left font-semibold dark:border-gray-700 dark:bg-gray-900\">Plataforma de IA compartida\u003C\u002Fth>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left font-semibold dark:border-gray-700 dark:bg-gray-900\">Caso de uso de IA individual\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Preocupación principal\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Aprobación típica\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Evidencia\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Fallo de gobernanza\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Cp>Por lo tanto, la aprobación de la plataforma debe reducir el trabajo repetido, no eliminar la responsabilidad del caso de uso. 'El modelo está aprobado' es diferente de 'esta aplicación del modelo está aprobada'.\u003C\u002Fp>\n\u003Ch2 id=\"section-106\">Gobernanza de IA y Arquitectura de IA Empresarial\u003C\u002Fh2>\n\u003Cp>La Arquitectura de IA Empresarial describe cómo encajan los sistemas de IA, las plataformas, los datos, las identidades, los proveedores, las operaciones y los sistemas organizativos. La gobernanza de IA describe el sistema de decisión y control que determina cómo pueden crearse y modificarse esas arquitecturas.\u003C\u002Fp>\n\u003Cp>Ambos están estrechamente acoplados. La gobernanza sin arquitectura puede volverse política abstracta. La arquitectura sin gobernanza puede producir sistemas técnicamente elegantes con propiedad poco clara, adopción descontrolada de proveedores o riesgo no revisado.\u003C\u002Fp>\n\u003Cp>El diseño más sólido es bidireccional: los requisitos de gobernanza se convierten en controles de arquitectura, mientras que la arquitectura expone las decisiones reales que la gobernanza debe asumir.\u003C\u002Fp>\n\u003Ch2 id=\"section-110\">Evidencia del proyecto original\u003C\u002Fh2>\n\u003Ch3 id=\"section-111\">Enterprise Aaasaasa 0.1: la gobernanza como estructura de entrega\u003C\u002Fh3>\n\u003Caside class=\"editorjs-callout editorjs-callout--note my-6 rounded-xl border p-5 border-gray-300 bg-gray-50 dark:border-gray-700 dark:bg-gray-900\u002F40\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Evidencia de proyecto \u002F PoC\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">Enterprise Aaasaasa 0.1 es evidencia de proyecto y de formación\u002FPoC, no evidencia de adopción empresarial comercial. Es útil aquí porque su estructura de entrega conecta explícitamente arquitectura, hitos, riesgos, partes interesadas, validación y decisiones de proyecto.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Cp>Enterprise Aaasaasa 0.1 utiliza hitos definidos para requisitos, arquitectura, prototipo, validación y cierre del proyecto. Esa estructura ilustra un principio central de gobernanza: las transiciones del ciclo de vida deben tener salidas explícitas y puntos de decisión en lugar de un proceso informal de “construir primero, revisar después”.\u003C\u002Fp>\n\u003Cp>El proyecto también rastrea riesgos como la expansión del alcance, el retraso de la arquitectura y las preocupaciones sobre IA\u002FRGPD, e identifica grupos de partes interesadas, incluidos patrocinio, dirección, arquitectura, seguridad, marketing, API externas y alojamiento.\u003C\u002Fp>\n\u003Cp>Esto no constituye un sistema de gestión ISO\u002FIEC 42001. Es evidencia de proyecto más acotada que muestra cómo la propiedad, el riesgo, los hitos y la validación pueden integrarse en la entrega técnica.\u003C\u002Fp>\n\u003Ch3 id=\"section-116\">SenseFlow: trazabilidad de requisitos y decisiones\u003C\u002Fh3>\n\u003Cp>SenseFlow utiliza una ruta estructurada desde el objetivo del producto y la necesidad del usuario a través de epics, historias de usuario, criterios de aceptación, arquitectura, implementación y validación. Los registros de decisiones conservan la decisión, la justificación, las alternativas, las compensaciones, el estado y la fecha\u002Fversión.\u003C\u002Fp>\n\u003Cp>Ese patrón de trazabilidad es directamente relevante para la gobernanza porque un control de IA debe conectarse con el requisito o riesgo que lo justificó. Un sistema de gobernanza se vuelve más sólido cuando la cadena desde la necesidad del negocio hasta la decisión de arquitectura y la evidencia de validación puede reconstruirse.\u003C\u002Fp>\n\u003Ch3 id=\"section-119\">Aaasaasa AI Client: permisos y tiempo de ejecución como configuración gobernada\u003C\u002Fh3>\n\u003Cp>Aaasaasa AI Client separa proveedor, modelo, ubicación de ejecución y permisos en lugar de tratarlos como una única “configuración de IA”. Los perfiles de permisos del espacio de trabajo central gobiernan el acceso a herramientas, Direct Chat no tiene herramientas de sistema de archivos\u002Fshell, y los tiempos de ejecución con capacidad de agente operan bajo perfiles de permisos explícitos.\u003C\u002Fp>\n\u003Cp>Esa separación demuestra un patrón de gobernanza importante: la elección del modelo y la autoridad de acción deben ser objetos de configuración independientes. Un modelo más potente no recibe automáticamente permisos más amplios de sistema de archivos, shell o negocio.\u003C\u002Fp>\n\u003Cp>La evidencia de implementación es arquitectónica, no una afirmación de que la aplicación constituya un sistema certificado de gobernanza organizacional de IA.\u003C\u002Fp>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Patrón de proyecto observado\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Lección de gobernanza\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Puertas de hitos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las transiciones del ciclo de vida pueden requerir evidencia explícita\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Registro de riesgos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las incertidumbres conocidas se convierten en objetos gestionados en lugar de preocupaciones informales\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Mapeo de partes interesadas\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La responsabilidad de decisión puede distribuirse deliberadamente\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Criterios de aceptación + validación\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las decisiones de despliegue pueden depender de la evidencia\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Registros de decisiones\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las compensaciones de arquitectura permanecen trazables\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Separar modelo\u002Fproveedor\u002Ftiempo de ejecución\u002Fpermisos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La capacidad y la autoridad pueden gobernarse de forma independiente\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Etiquetas explícitas de madurez del proyecto\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La evidencia de PoC no se presenta erróneamente como prueba de producción o de mercado\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-124\">Modos comunes de fallo en la gobernanza de IA\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Modo de fallo\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Qué sale mal\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La gobernanza es solo un PDF de políticas\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los equipos no pueden traducir la política en controles de tiempo de ejecución o decisiones de despliegue\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sin inventario de IA\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La organización no puede identificar dónde se utilizan modelos, agentes o IA integrada\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La aprobación del modelo se trata como aprobación del caso de uso\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Un modelo aprobado se utiliza para un contexto de riesgo materialmente diferente\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sin propietario de negocio designado\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los equipos técnicos heredan por defecto las decisiones de riesgo de negocio\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La clasificación de riesgo no tiene consecuencia de control\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Todos los sistemas reciben la misma revisión independientemente de las consecuencias\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los permisos viven solo en los prompts\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Las instrucciones del modelo se convierten en un sustituto de la autorización real\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El cambio de proveedor es invisible\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los supuestos de comportamiento\u002Fdatos\u002Fcumplimiento cambian sin reevaluación\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El éxito de la demo es evidencia de aprobación\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El riesgo de producción se infiere de una pequeña prueba de camino feliz\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La supervisión humana es ceremonial\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El revisor no puede inspeccionar la evidencia ni detener la acción\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La excepción no tiene vencimiento\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La solución temporal se convierte en deuda de gobernanza permanente\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Existen registros pero no pueden reconstruir decisiones\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La auditabilidad se confunde con la retención de datos brutos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Cumplimiento posee la gobernanza en solitario\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Producto, ingeniería, seguridad y operaciones se desvinculan de la responsabilidad\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Cada decisión va a un consejo central\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La gobernanza se convierte en un cuello de botella en lugar de un sistema de control escalable\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-126\">Gobernanza central no significa centralizar cada decisión\u003C\u002Fh2>\n\u003Cp>Una organización madura puede centralizar la política, los patrones de control y la escalada, mientras delega las decisiones de bajo riesgo a los equipos de producto o de plataforma.\u003C\u002Fp>\n\u003Cp>Este modelo federado escala mejor que exigir que un comité central apruebe cada cambio de prompt. La función central define los niveles de riesgo, los controles obligatorios, la política de proveedores, la autoridad de excepción y los requisitos de auditoría; los equipos operan de forma autónoma dentro de esos límites.\u003C\u002Fp>\n\u003Cp>El objetivo de diseño es una rendición de cuentas consistente, no la máxima centralización.\u003C\u002Fp>\n\u003Ch2 id=\"section-130\">Gobernar el propio sistema de gobernanza\u003C\u002Fh2>\n\u003Cp>La gobernanza necesita retroalimentación. De lo contrario, los controles pueden convertirse en rituales costosos que no reducen el riesgo.\u003C\u002Fp>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Métrica \u002F señal\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Qué puede revelar\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Cobertura del inventario\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Si la adopción de IA es visible para la gobernanza\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Tiempo hasta la decisión\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Si la gobernanza bloquea la entrega innecesariamente\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Número y antigüedad de excepciones\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Si las políticas son realistas o se eluden de forma rutinaria\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Tasa de fallo en la evaluación\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Si los controles previos al despliegue detectan defectos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Tasa de incidentes posteriores al despliegue\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Si la evidencia de aprobación predice el comportamiento en producción\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Tasa de denegación de herramientas no autorizadas\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Si los límites de permisos se ejercen activamente\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Frecuencia de cambios de modelo\u002Fproveedor\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Con qué frecuencia los supuestos aprobados pueden quedar obsoletos\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sistemas retirados pero activos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Fallo en la limpieza\u002Fcontrol del ciclo de vida\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Patrones de incidentes repetidos\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Si las lecciones se están convirtiendo en controles de plataforma reutilizables\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>Las métricas de gobernanza no deben recompensar el volumen de papeleo. La medida útil es si mejoran la calidad de las decisiones, la trazabilidad, la detección de riesgos y la entrega segura.\u003C\u002Fp>\n\u003Ch2 id=\"section-134\">Una secuencia práctica de implementación de gobernanza de IA\u003C\u002Fh2>\n\u003Csection class=\"editorjs-process my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Construir la gobernanza desde la visibilidad hasta el control\u003C\u002Fh3>\u003Cdiv class=\"grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4\">\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">1\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">1. Definir el alcance de la gobernanza\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Decidir qué sistemas de IA desarrollados internamente, adquiridos, integrados y experimentales están cubiertos.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">2\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">2. Crear el inventario de IA\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Registrar propietarios, casos de uso, modelos\u002Fproveedores, datos, herramientas, usuarios, estado del ciclo de vida y clase de riesgo.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">3\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">3. Definir los derechos de decisión\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Designar quién puede aprobar proveedores, uso de datos, aceptación de riesgos, excepciones, despliegue y retirada.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">4\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">4. Establecer niveles de riesgo\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Asignar la consecuencia y la exposición a diferentes requisitos de control.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">5\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">5. Definir controles mínimos reutilizables\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Establecer requisitos de referencia para identidad, permisos, datos, seguridad, evaluación, registro y supervisión humana.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">6\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">6. Conectar la gobernanza con la arquitectura\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Convertir la política en controles de plataforma\u002Ftiempo de ejecución que los equipos no puedan eludir accidentalmente.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">7\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">7. Construir puertas basadas en evidencia\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Exigir evidencia relevante de evaluación, seguridad, privacidad, arquitectura y cumplimiento antes de las transiciones del ciclo de vida.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">8\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">8. Gobernar el cambio de modelo\u002Fproveedor\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Rastrear versiones, obsolescencias y cambios materiales con evidencia de regresión.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">9\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">9. Añadir monitoreo y disparadores de incidentes\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Definir qué señales de producción obligan a investigar, restringir o suspender.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">10\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">10. Formalizar las excepciones\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Exigir alcance, propietario, riesgo residual, controles compensatorios y caducidad.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">11\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">11. Auditar las decisiones y la ejecución\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Conservar evidencia proporcionada que vincule propietarios, configuración, permisos, evaluaciones y acciones significativas.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">12\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">12. Mejorar el sistema de gobernanza\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Usar incidentes, retrasos y excepciones repetidas para revisar los controles y los patrones de plataforma.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-136\">Lista de verificación de gobernanza de IA\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Pregunta\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Evidencia de gobernanza esperada\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Por qué existe este sistema de IA?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Propósito, propietario empresarial y resultado previsto\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Quién es el propietario de la operación técnica?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Propietario técnico\u002Fde plataforma designado\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué modelo\u002Fproveedor\u002Fversión se utiliza?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Dependencia registrada y versionada\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué datos pueden entrar en el sistema?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Clasificación, autoridad y decisión de uso permitido\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué identidades pueden usarlo?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Modelo de autenticación y autorización\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué acciones puede realizar?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Matriz de herramientas\u002Fpermisos y límite de autonomía\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Cuál es el nivel de riesgo?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Clasificación documentada con justificación\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué controles son obligatorios?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Línea base de controles por nivel de riesgo\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Cómo se evaluó?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Pruebas representativas y criterios de aceptación\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Quién aceptó el riesgo residual?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Autoridad responsable designada\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué requiere revisión humana?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Reglas explícitas de supervisión\u002Faprobación\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué se registra?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Política de auditoría\u002Fobservabilidad proporcional a la consecuencia\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Qué desencadena una nueva revisión?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Eventos de cambio de modelo\u002Fproveedor\u002Fdatos\u002Fherramientas\u002Fregulatorios\u002Fmateriales\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Cómo se puede suspender?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ruta operativa de inhabilitación\u002Frestricción y propietario\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">¿Cómo se retira?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Limpieza de credenciales, datos, derivados, endpoints y registros\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-138\">Conceptos erróneos comunes\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Concepto erróneo\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Corrección\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“La gobernanza de IA es cumplimiento.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El cumplimiento es una entrada de la gobernanza; la gobernanza también cubre decisiones de propiedad, arquitectura, permisos, calidad, riesgo y ciclo de vida.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“Gobernanza significa un comité de revisión.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Los comités pueden aprobar excepciones o sistemas de alto riesgo, pero muchos controles deben integrarse en la entrega normal y en la arquitectura de plataforma.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“Un modelo aprobado es seguro para cualquier uso.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El riesgo pertenece al caso de uso y al contexto del sistema, no solo al modelo.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“Un proveedor gestiona la gobernanza por nosotros.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Un proveedor controla parte de la pila; la organización sigue siendo propietaria de su caso de uso, datos, permisos y consecuencias empresariales.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“El humano en el bucle resuelve automáticamente el riesgo.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La supervisión solo funciona cuando los revisores tienen autoridad, contexto y capacidad de intervención.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“Registrar todo proporciona auditabilidad.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">La auditabilidad requiere evidencia relevante reconstruible con retención y acceso controlados.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“La gobernanza bloquea la innovación.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Una gobernanza deficiente puede bloquear la entrega; una gobernanza bien diseñada crea rutas seguras reutilizables y una propiedad de decisión más clara.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“Los pilotos de bajo riesgo no necesitan gobernanza.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Pueden usar una gobernanza ligera, pero el inventario, la propiedad y los límites de datos\u002Fherramientas siguen importando.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“La IA local necesita menos gobernanza.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El alojamiento local puede cambiar el riesgo de privacidad\u002Fproveedor, pero la calidad del modelo, los permisos, la seguridad y la gobernanza del ciclo de vida permanecen.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">“Una vez aprobado, el sistema permanece aprobado.”\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">El modelo, el proveedor, los datos, la regulación y el uso pueden cambiar; las decisiones de gobernanza necesitan disparadores de revisión.\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-140\">Casos límite y limitaciones\u003C\u002Fh2>\n\u003Cp>Las organizaciones muy pequeñas pueden no necesitar una función dedicada de gobernanza de IA. Los mismos principios pueden implementarse mediante decisiones de arquitectura ligeras, registros de riesgos, mapeos de propietarios y puertas de liberación.\u003C\u002Fp>\n\u003Cp>Las organizaciones altamente reguladas pueden necesitar una gobernanza mucho más formal, aseguramiento independiente, procesos de conformidad documentados e interpretación legal de lo que describe este artículo a nivel de arquitectura.\u003C\u002Fp>\n\u003Cp>Los modelos de código abierto y autoalojados reducen algunas dependencias de proveedores pero crean otras: parcheo, procedencia del modelo, evaluación, seguridad de la infraestructura, licencias y propiedad operativa.\u003C\u002Fp>\n\u003Cp>Los modelos de IA de propósito general pueden usarse en muchos contextos. La gobernanza debe evitar asumir que los controles del modelo a nivel de proveedor determinan por completo el riesgo de la aplicación posterior.\u003C\u002Fp>\n\u003Cp>Ningún marco de gobernanza garantiza que un sistema de IA sea seguro o correcto. La gobernanza mejora la rendición de cuentas y la calidad de las decisiones; la validación técnica, el monitoreo y el juicio humano siguen siendo necesarios.\u003C\u002Fp>\n\u003Ch2 id=\"section-146\">¿Qué cambiaría esta respuesta?\u003C\u002Fh2>\n\u003Cp>El conjunto exacto de controles cambia según la ley, la industria, el tamaño de la organización, la sensibilidad de los datos, la autonomía, el modelo de despliegue y las consecuencias empresariales.\u003C\u002Fp>\n\u003Cp>NIST está revisando actualmente AI RMF 1.0, por lo que la terminología o las prácticas recomendadas futuras de NIST pueden cambiar. Las normas ISO también pueden revisarse, y las directrices y los detalles de transición del Reglamento de IA de la UE continúan evolucionando.\u003C\u002Fp>\n\u003Cp>El principio arquitectónico estable es que las decisiones de IA necesitan propietarios explícitos, evidencia, permisos, tratamiento de riesgos y revisión del ciclo de vida en lugar de estar ocultas dentro de la configuración del modelo o de la aplicación.\u003C\u002Fp>\n\u003Ch2 id=\"section-150\">Conocimiento canónico relacionado\u003C\u002Fh2>\n\u003Cp>La gobernanza de IA depende de conceptos ya separados en otro lugar de este grafo de conocimiento: la Fuente de Verdad determina la autoridad, RBAC y el aislamiento de inquilinos restringen el acceso, la ingeniería de contexto controla la información visible para el modelo, y la arquitectura agéntica define cómo las herramientas y acciones entran en un bucle de ejecución.\u003C\u002Fp>\n\u003Cp>La Arquitectura Empresarial de IA es el concepto de arquitectura organizacional padre. La gobernanza es la capa de control operativo que determina cómo esos componentes empresariales de IA pueden introducirse, modificarse y retirarse.\u003C\u002Fp>\n\u003Cp>Los sistemas agénticos aumentan los requisitos de gobernanza porque las decisiones del modelo pueden convertirse en efectos secundarios reales. Por lo tanto, los controles de permisos, aprobación y auditoría deben existir fuera del propio modelo.\u003C\u002Fp>\n\u003Caside class=\"editorjs-referral my-6\">\u003Ca href=\"https:\u002F\u002Fstajic.de\u002Fes\u002Fblog\u002Fai-agent-reliability-why-the-final-answer-is-not-enough\" class=\"flex flex-col sm:flex-row gap-4 rounded-xl border border-gray-200 dark:border-gray-700 p-4 transition hover:border-primary-500\">\u003Cdiv class=\"min-w-0 flex-1\">\u003Cstrong class=\"block text-lg text-gray-900 dark:text-gray-100\">Confiabilidad de los agentes de IA: por qué la respuesta final no es suficiente\u003C\u002Fstrong>\u003Cp class=\"mt-2 text-sm text-gray-600 dark:text-gray-300\">La gobernanza de agentes requiere evidencia sobre las trayectorias de ejecución, el uso de herramientas, los cambios de estado y la recuperabilidad, no solo la calidad del resultado final.\u003C\u002Fp>\u003Cspan class=\"mt-3 inline-flex text-sm font-medium text-primary-600 dark:text-primary-400\">Leer el artículo sobre confiabilidad de agentes →\u003C\u002Fspan>\u003C\u002Fdiv>\u003C\u002Fa>\u003C\u002Faside>\n\u003Caside class=\"editorjs-referral my-6\">\u003Ca href=\"https:\u002F\u002Fstajic.de\u002Fes\u002Fblog\u002Fai-agent-memory-is-not-rag-how-to-separate-memory-retrieval-state-and-context\" class=\"flex flex-col sm:flex-row gap-4 rounded-xl border border-gray-200 dark:border-gray-700 p-4 transition hover:border-primary-500\">\u003Cdiv class=\"min-w-0 flex-1\">\u003Cstrong class=\"block text-lg text-gray-900 dark:text-gray-100\">La memoria de los agentes de IA no es RAG: cómo separar memoria, recuperación, estado y contexto\u003C\u002Fstrong>\u003Cp class=\"mt-2 text-sm text-gray-600 dark:text-gray-300\">La gobernanza necesita políticas diferentes para la memoria duradera, el estado autoritativo, la información recuperada y el contexto temporal del modelo.\u003C\u002Fp>\u003Cspan class=\"mt-3 inline-flex text-sm font-medium text-primary-600 dark:text-primary-400\">Leer el artículo sobre arquitectura de memoria →\u003C\u002Fspan>\u003C\u002Fdiv>\u003C\u002Fa>\u003C\u002Faside>\n\u003Caside class=\"editorjs-referral my-6\">\u003Ca href=\"https:\u002F\u002Fstajic.de\u002Fes\u002Fblog\u002Fthe-answer-validity-boundary-the-missing-layer-between-relevance-and-reliable-ai-answers\" class=\"flex flex-col sm:flex-row gap-4 rounded-xl border border-gray-200 dark:border-gray-700 p-4 transition hover:border-primary-500\">\u003Cdiv class=\"min-w-0 flex-1\">\u003Cstrong class=\"block text-lg text-gray-900 dark:text-gray-100\">La frontera de validez de la respuesta: la capa faltante entre la relevancia y las respuestas confiables de IA\u003C\u002Fstrong>\u003Cp class=\"mt-2 text-sm text-gray-600 dark:text-gray-300\">Las decisiones de gobernanza deben preservar las condiciones bajo las cuales la evidencia y la aprobación siguen siendo válidas, incluidos la versión, el alcance, la fuente y el tiempo.\u003C\u002Fp>\u003Cspan class=\"mt-3 inline-flex text-sm font-medium text-primary-600 dark:text-primary-400\">Leer la frontera de validez de la respuesta →\u003C\u002Fspan>\u003C\u002Fdiv>\u003C\u002Fa>\u003C\u002Faside>\n\u003Ch2 id=\"section-157\">Preguntas frecuentes\u003C\u002Fh2>\n\u003Csection class=\"editorjs-faq my-6 rounded-xl border border-gray-200 p-5 dark:border-gray-700\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Preguntas frecuentes sobre gobernanza de IA\u003C\u002Fh3>\u003Cdiv id=\"faq1\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Qué es la gobernanza de IA?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">La gobernanza de IA es el sistema de propiedad, derechos de decisión, controles y evidencia utilizado para gestionar cómo se desarrollan, adquieren, despliegan, operan, modifican y retiran los sistemas de IA.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq2\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Es la gobernanza de IA lo mismo que la gestión de riesgos de IA?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">No. La gestión de riesgos identifica, evalúa y trata el riesgo. La gobernanza define quién debe realizar ese trabajo, qué decisiones lo requieren y qué evidencia o autoridad se necesita.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq3\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Es la gobernanza de IA lo mismo que el cumplimiento normativo?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">No. El cumplimiento se refiere a obligaciones legales, regulatorias, contractuales o internas aplicables. La gobernanza integra el cumplimiento con la arquitectura, la seguridad, los datos, la calidad, los permisos y la propiedad empresarial.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq4\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Cuál es la diferencia entre la gobernanza de IA y la Arquitectura Empresarial de IA?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">La Arquitectura Empresarial de IA define cómo encajan las capacidades y los sistemas de IA en la organización. La gobernanza de IA define el sistema de decisión y control que rige cómo esos componentes pueden introducirse, operarse y modificarse.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq5\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Necesitan las pequeñas empresas gobernanza de IA?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Sí, pero no necesariamente un departamento dedicado. Un inventario ligero, la propiedad, los permisos, la evaluación y los controles de cambio pueden implementar los mismos principios.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq6\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Qué debe contener un inventario de IA?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Como mínimo: caso de uso, propietarios, modelo\u002Fproveedor\u002Fversión, clases de datos, usuarios, herramientas\u002Facciones, permisos, clasificación de riesgos, estado de evaluación, estado del ciclo de vida y desencadenantes de revisión.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq7\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Usar un modelo aprobado significa que un caso de uso está aprobado?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">No. El riesgo depende del contexto de la aplicación: datos, usuarios, herramientas, autonomía, consecuencias y proceso empresarial.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq8\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Qué hace que un sistema de IA sea auditable?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">La organización puede reconstruir la propiedad relevante, la configuración aprobada, el modelo\u002Fproveedor\u002Fversión, el contexto de datos\u002Fpermisos, la evidencia de evaluación, las acciones significativas y las decisiones del ciclo de vida.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq9\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">¿Con qué frecuencia deben revisarse las decisiones de gobernanza de IA?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Utilice intervalos de revisión basados en riesgos más desencadenantes de eventos como cambios de modelo\u002Fproveedor, nuevos datos, nuevas herramientas, incidentes, cambios materiales en el rendimiento o actualizaciones regulatorias.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-159\">Glosario\u003C\u002Fh2>\n\u003Csection class=\"editorjs-glossary my-6 rounded-xl border border-gray-200 dark:border-gray-700 p-5\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Términos clave de gobernanza de IA\u003C\u002Fh3>\u003Cdl>\u003Cdiv id=\"ai-governance\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Gobernanza de IA\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Sistema organizacional de propiedad, derechos de decisión, controles y evidencia que rige el ciclo de vida de la IA.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"ai-management-system\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Sistema de gestión de IA\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Políticas, objetivos y procesos organizacionales interrelacionados para el desarrollo, la provisión o el uso responsable de la IA; ISO\u002FIEC 42001 especifica los requisitos para dicho sistema.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"ai-inventory\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Inventario de IA\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Registro de sistemas de IA, modelos, proveedores, casos de uso, propietarios, datos, clasificaciones de riesgo y estado del ciclo de vida.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"risk-owner\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Propietario del riesgo\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Autoridad designada responsable de decidir cómo se trata un riesgo definido o si se acepta el riesgo residual.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"control\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Control\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Medida técnica, organizacional o procedimental destinada a prevenir, detectar, reducir o responder a un riesgo.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"governance-gate\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Puerta de gobernanza\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Punto de decisión del ciclo de vida en el que se requieren evidencia y autoridad definidas antes de continuar.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"residual-risk\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Riesgo residual\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Riesgo que permanece después de aplicar controles o mitigación.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"exception\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Excepción\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Autorización explícita, con alcance definido y generalmente limitada en el tiempo, para desviarse de un requisito normal de gobernanza.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"auditability\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Auditabilidad\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Capacidad de reconstruir decisiones, configuraciones, evidencia, identidades y eventos de ejecución relevantes.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"model-governance\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Gobernanza de modelos\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Controles y decisiones que cubren la selección, el versionado, la evaluación, el uso permitido, el cambio y la retirada de modelos.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"provider-governance\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Gobernanza de proveedores\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Controles que cubren las dependencias de proveedores de IA externos o internos, el manejo de datos, la seguridad, los contratos, el ciclo de vida y la salida.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"human-oversight\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Supervisión humana\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Capacidad diseñada de revisión o intervención humana para decisiones o acciones de IA en puntos definidos.\u003C\u002Fdd>\u003C\u002Fdiv>\u003C\u002Fdl>\u003C\u002Fsection>\n\u003Ch2 id=\"section-161\">Conclusión\u003C\u002Fh2>\n\u003Cp>La gobernanza de IA es el plano de control organizacional en torno a la IA. Da nombres y evidencia a decisiones que de otro modo permanecen ocultas dentro del código, la configuración del proveedor, los prompts o el juicio informal del equipo.\u003C\u002Fp>\n\u003Cp>Una gobernanza sólida conecta el sistema completo: propósito empresarial, modelos, proveedores, autoridad sobre los datos, identidad, permisos, evaluación, riesgo, cumplimiento, monitoreo, incidentes, cambio y retiro.\u003C\u002Fp>\n\u003Cp>El objetivo práctico no es el máximo proceso. Es la estructura de gobernanza mínima que hace que las decisiones importantes de IA sean propiedad de alguien, estén basadas en evidencia, sean exigibles, revisables y auditables a lo largo de todo el ciclo de vida.\u003C\u002Fp>\n\u003Ch2 id=\"section-165\">Fuentes primarias y referencias actuales\u003C\u002Fh2>\n\u003Cp>Las fuentes a continuación proporcionan un fundamento externo actual para la gestión, el riesgo y la regulación de la IA. Las secciones del proyecto son evidencia original de implementación\u002Fproyecto y se distinguen explícitamente de los estándares formales o los sistemas de gobernanza certificados.\u003C\u002Fp>\n\u003Ca href=\"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">NIST — Marco de Gestión de Riesgos de IA\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Centro actual del NIST para el AI RMF 1.0, la revisión en curso, el Perfil de IA Generativa y los recursos relacionados con la gestión de riesgos.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fairc.nist.gov\u002Fairmf-resources\u002Fairmf\u002F5-sec-core\u002F\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">NIST AIRC — Núcleo del AI RMF\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Núcleo oficial del AI RMF que describe GOBERNAR, MAPEAR, MEDIR y GESTIONAR, con GOBERNAR como una función transversal del ciclo de vida.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework\u002Fnist-ai-rmf-playbook\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">NIST — Guía práctica del AI RMF\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Acciones sugeridas para operacionalizar la confiabilidad y la gestión de riesgos a lo largo del ciclo de vida de la IA.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.nist.gov\u002Fpublications\u002Fartificial-intelligence-risk-management-framework-generative-artificial-intelligence\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">NIST AI 600-1 — Perfil de IA Generativa\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Perfil complementario del NIST que aplica los conceptos del AI RMF a los riesgos de la IA generativa y la gestión del ciclo de vida.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F42001\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">ISO\u002FIEC 42001:2023 — Sistemas de gestión de IA\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Estándar internacional que especifica los requisitos para establecer, implementar, mantener y mejorar continuamente un sistema de gestión de IA.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F77304.html\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">ISO\u002FIEC 23894:2023 — Gestión de riesgos de IA\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Guía internacional para integrar la gestión de riesgos específicos de la IA en las actividades y funciones organizacionales.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Fpolicies\u002Fregulatory-framework-ai\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">Comisión Europea — Ley de IA\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Resumen actual de la Comisión sobre la Ley de IA de la UE, el calendario de aplicación y el marco de implementación.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Ffaqs\u002Fnavigating-ai-act\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">Comisión Europea — Navegando la Ley de IA\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Preguntas frecuentes actuales que cubren gobernanza, aplicación, implementación y el calendario de aplicación en evolución.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Ffactpages\u002Fgeneral-purpose-ai-obligations-under-ai-act\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">Comisión Europea — Obligaciones de IA de propósito general\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Resumen actual de las obligaciones de documentación, derechos de autor, contenido de entrenamiento y riesgo sistémico para los proveedores de GPAI.\u003C\u002Fp>\u003C\u002Fa>",{"time":212,"blocks":213,"version":1717},1791486149099,[214,220,228,235,242,250,255,260,265,270,275,280,285,290,322,327,332,337,342,347,387,392,397,402,407,412,441,446,451,456,461,467,472,477,482,487,534,539,544,549,554,559,594,599,604,609,614,619,624,629,634,639,644,649,654,659,664,669,674,679,684,725,730,735,740,745,750,755,760,765,770,777,782,812,817,822,827,832,837,842,847,852,857,862,867,872,901,906,911,916,921,926,931,936,941,946,951,956,961,966,971,976,981,986,1015,1020,1025,1030,1035,1040,1045,1050,1056,1061,1066,1071,1076,1081,1086,1091,1096,1101,1106,1135,1140,1187,1192,1197,1202,1207,1212,1217,1252,1257,1262,1304,1309,1362,1367,1405,1410,1415,1420,1425,1430,1435,1440,1445,1450,1455,1460,1465,1470,1475,1484,1492,1500,1505,1547,1552,1605,1610,1615,1620,1625,1630,1635,1645,1654,1663,1672,1681,1690,1699,1708],{"id":215,"data":216,"type":218,"tunes":219},"intro",{"text":217},"La gobernanza de la IA es el sistema de derechos de decisión, responsabilidades, controles y evidencia utilizados para decidir cómo una organización puede desarrollar, adquirir, desplegar, operar, cambiar y retirar sistemas de IA. Es más amplia que un documento de políticas y más estrecha que la arquitectura empresarial en su conjunto. La gobernanza efectiva de la IA conecta la propiedad empresarial, las elecciones de modelos y proveedores, la autoridad sobre los datos, los permisos, la clasificación de riesgos, la evaluación, el monitoreo, la gestión de incidentes, la auditabilidad y las decisiones del ciclo de vida, de modo que alguien pueda responder no solo \"¿funciona la IA?\" sino también \"¿quién la aprobó, bajo qué condiciones, con qué evidencia y cuándo debe revisarse esa decisión?\"","paragraph",{},{"id":221,"data":222,"type":226,"tunes":227},"direct",{"body":223,"title":224,"variant":225},"\u003Cstrong>La gobernanza de la IA convierte la IA de una capacidad técnica informal en una capacidad organizacional responsable.\u003C\u002Fstrong>\u003Cbr>\u003Cbr>La arquitectura determina cómo se construye el sistema. La ingeniería lo implementa. La gestión de riesgos evalúa la incertidumbre y el daño. El cumplimiento aborda las obligaciones aplicables. La gobernanza conecta estas actividades mediante la propiedad, los derechos de decisión, los controles requeridos, la evidencia y las puertas del ciclo de vida.","Respuesta directa","info","callout",{},{"id":229,"data":230,"type":226,"tunes":234},"boundary",{"body":231,"title":232,"variant":233},"Un consejo de gobernanza puede ser un mecanismo, y las políticas pueden documentar expectativas, pero la gobernanza solo se vuelve operativa cuando las decisiones cambian lo que los sistemas pueden hacer: qué modelos pueden usarse, qué datos pueden ingresar en ellos, qué herramientas puede ejecutar un agente, qué evaluaciones se requieren, quién puede aprobar excepciones, qué debe registrarse y qué desencadena la suspensión o el retiro.","La gobernanza no es un comité ni un PDF","warning",{},{"id":236,"data":237,"type":226,"tunes":241},"current",{"body":238,"title":239,"variant":240},"El NIST AI RMF 1.0 sigue siendo el marco publicado vigente mientras el NIST lo está revisando. Su núcleo se organiza en torno a \u003Cstrong>GOBERNAR, MAPEAR, MEDIR y GESTIONAR\u003C\u002Fstrong>, con GOBERNAR como función transversal. La ISO\u002FIEC 42001:2023 sigue siendo la norma internacional de sistemas de gestión de IA para establecer, operar y mejorar continuamente un sistema de gestión de IA. La Ley de IA de la UE es ahora generalmente aplicable desde el 2 de agosto de 2026, aunque algunas obligaciones tenían fechas de aplicación anteriores y algunos requisitos de alto riesgo tienen fechas de transición posteriores. Los plazos regulatorios siempre deben verificarse nuevamente antes de tomar una decisión de cumplimiento concreta.","Nota de fuentes actuales — 8 de octubre de 2026","note",{},{"id":243,"data":244,"type":248,"tunes":249},"toc",{"title":245,"maxLevel":246,"minLevel":247},"Contenido",3,2,"tableOfContents",{},{"id":251,"data":252,"type":42,"tunes":254},"h-meaning",{"text":253,"level":247},"Qué significa realmente la gobernanza de la IA",{},{"id":256,"data":257,"type":218,"tunes":259},"p-meaning-1",{"text":258},"La gobernanza de la IA responde preguntas organizacionales que un modelo, un SDK o un diagrama de arquitectura no pueden responder por sí solos. ¿Quién es dueño del resultado empresarial? ¿Quién puede aprobar un nuevo proveedor? ¿Qué clases de datos están prohibidas para el procesamiento externo? ¿Qué evidencia se requiere antes del despliegue? ¿Qué permisos puede recibir un agente? ¿Quién puede aceptar el riesgo residual? ¿Qué sucede cuando un modelo cambia de comportamiento después de una actualización?",{},{"id":261,"data":262,"type":218,"tunes":264},"p-meaning-2",{"text":263},"El propósito no es impedir el cambio. Una buena gobernanza hace que el cambio sea legible: las decisiones tienen dueños, evidencia, condiciones, excepciones, fechas de revisión y rutas de reversión o escalamiento.",{},{"id":266,"data":267,"type":218,"tunes":269},"p-meaning-3",{"text":268},"Por eso el NIST sitúa GOBERNAR a lo largo de todo el ciclo de vida de la gestión de riesgos de IA, en lugar de tratar la gobernanza como un único paso final de aprobación. La gobernanza establece la cultura, las políticas, la responsabilidad y las estructuras organizacionales que hacen posible mapear, medir y gestionar el riesgo de la IA.",{},{"id":271,"data":272,"type":42,"tunes":274},"h-simple",{"text":273,"level":247},"El ejemplo más simple",{},{"id":276,"data":277,"type":218,"tunes":279},"p-simple-1",{"text":278},"Un equipo de producto quiere añadir un proveedor externo de IA generativa para resumir tickets internos de soporte al cliente. Técnicamente, la integración puede requerir solo una llamada a la API.",{},{"id":281,"data":282,"type":218,"tunes":284},"p-simple-2",{"text":283},"La gobernanza plantea un conjunto diferente de preguntas: ¿Se permite que el contenido de los tickets salga del entorno de la organización? ¿Qué proveedor y versión del modelo están aprobados? ¿Está deshabilitada la retención? ¿Qué usuarios pueden invocar la función? ¿Cómo se evalúa la salida? ¿Se requiere revisión humana? ¿Qué se registra? ¿Quién es responsable de los incidentes? ¿Qué sucede si el proveedor cambia sus términos o el comportamiento del modelo?",{},{"id":286,"data":287,"type":218,"tunes":289},"p-simple-3",{"text":288},"El resultado de la gobernanza aún puede ser \"despliégalo\". La diferencia es que el despliegue ahora es una decisión rastreable con condiciones explícitas en lugar de una elección de ingeniería no registrada.",{},{"id":291,"data":292,"type":320,"tunes":321},"simple-flow",{"steps":293,"title":318,"orientation":319},[294,297,300,303,306,309,312,315],{"label":295,"description":296},"1. Registrar el caso de uso","Registrar el propósito, el propietario, los usuarios, los datos, el modelo\u002Fproveedor y el resultado previsto.",{"label":298,"description":299},"2. Clasificar el riesgo y las obligaciones","Determinar la consecuencia empresarial, la sensibilidad de los datos, la autonomía, la exposición regulatoria y el potencial de uso indebido.",{"label":301,"description":302},"3. Definir los controles requeridos","Especificar permisos, manejo de datos, evaluaciones, supervisión humana, seguridad, registro y restricciones del proveedor.",{"label":304,"description":305},"4. Recopilar evidencia","Ejecutar pruebas, revisión de seguridad\u002Fprivacidad, revisión de arquitectura y verificaciones legales\u002Fde cumplimiento relevantes.",{"label":307,"description":308},"5. Tomar una decisión","Aprobar, aprobar con condiciones, solicitar cambios, retener o rechazar.",{"label":310,"description":311},"6. Desplegar bajo una configuración controlada","Fijar el modelo\u002Fproveedor\u002Fentorno de ejecución aprobado y hacer cumplir los límites requeridos.",{"label":313,"description":314},"7. Monitorear y reevaluar","Rastrear incidentes, calidad, deriva, cambios del proveedor, nuevos riesgos y regulaciones modificadas.",{"label":316,"description":317},"8. Cambiar, suspender o retirar","Usar la evidencia y las reglas de propiedad para decidir el siguiente estado del ciclo de vida.","Una decisión básica de IA gobernada","auto","processFlow",{},{"id":323,"data":324,"type":42,"tunes":326},"h-stops",{"text":325,"level":247},"Dónde se detiene el ejemplo simple",{},{"id":328,"data":329,"type":218,"tunes":331},"p-stops-1",{"text":330},"Las grandes organizaciones rara vez gobiernan un solo sistema de IA de forma aislada. El mismo modelo puede soportar docenas de productos; un proveedor puede procesar varias clases de datos; una plataforma de agentes puede exponer herramientas compartidas a muchos equipos.",{},{"id":333,"data":334,"type":218,"tunes":336},"p-stops-2",{"text":335},"Por lo tanto, la gobernanza necesita estructuras a nivel de cartera, así como controles a nivel de sistema: inventario de IA, proveedores aprobados, catálogos de modelos, líneas base de evaluación compartidas, patrones de seguridad, umbrales de riesgo, registros de excepciones y mapeos de propiedad.",{},{"id":338,"data":339,"type":218,"tunes":341},"p-stops-3",{"text":340},"La gobernanza tampoco puede ser idéntica para cada uso de IA. Un resumidor de contenido público, un asistente de programación interno, un sistema de apoyo a la contratación y un agente que puede iniciar pagos tienen perfiles de consecuencia y control materialmente diferentes.",{},{"id":343,"data":344,"type":42,"tunes":346},"h-not",{"text":345,"level":247},"Qué es la gobernanza de IA y qué no es",{},{"id":348,"data":349,"type":385,"tunes":386},"not-comparison",{"rows":350,"title":376,"layout":377,"columns":378},[351,356,360,364,368,372],{"id":352,"label":353,"values":354},"architecture","Arquitectura empresarial \u002F de soluciones",[355,355],"",{"id":357,"label":358,"values":359},"risk","Gestión de riesgos de IA",[355,355],{"id":361,"label":362,"values":363},"compliance","Cumplimiento normativo",[355,355],{"id":365,"label":366,"values":367},"security","Seguridad",[355,355],{"id":369,"label":370,"values":371},"mlops","MLOps \u002F LLMOps",[355,355],{"id":373,"label":374,"values":375},"ethics","Principios de ética de IA",[355,355],"La gobernanza de IA comparada con disciplinas adyacentes","table",[379,382],{"id":380,"label":381},"governance","Gobernanza de IA",{"id":383,"label":384},"adjacent","Disciplina adyacente","comparison",{},{"id":388,"data":389,"type":42,"tunes":391},"h-governance-compliance",{"text":390,"level":247},"La gobernanza es más amplia que el cumplimiento normativo",{},{"id":393,"data":394,"type":218,"tunes":396},"p-compliance-1",{"text":395},"El cumplimiento normativo es una entrada a la gobernanza, no todo el sistema de gobernanza. Un caso de uso de IA puede estar legalmente permitido y aun así violar el apetito de riesgo de la empresa, la política de seguridad, las obligaciones contractuales o los requisitos de calidad del producto.",{},{"id":398,"data":399,"type":218,"tunes":401},"p-compliance-2",{"text":400},"Lo contrario también importa: la aprobación interna no anula la ley. La gobernanza debe hacer visibles las obligaciones legales aplicables dentro de la misma ruta de decisión utilizada para la arquitectura, la seguridad y el riesgo empresarial.",{},{"id":403,"data":404,"type":218,"tunes":406},"p-compliance-3",{"text":405},"ISO\u002FIEC 42001 enmarca explícitamente un sistema de gestión de IA como una forma estructurada de establecer políticas, objetivos y procesos para una IA responsable. ISO también afirma que la norma no reemplaza las leyes ni las regulaciones; proporciona un marco de gestión que puede apoyar el cumplimiento normativo.",{},{"id":408,"data":409,"type":42,"tunes":411},"h-frameworks",{"text":410,"level":247},"NIST AI RMF e ISO\u002FIEC 42001 resuelven necesidades de gobernanza diferentes",{},{"id":413,"data":414,"type":377,"tunes":440},"framework-table",{"content":415,"stretched":43,"withHeadings":14},[416,420,424,428,432,436],[417,418,419],"Marco \u002F norma","Rol principal","Valor de gobernanza útil",[421,422,423],"NIST AI RMF 1.0","Marco voluntario de gestión de riesgos de IA","Organiza los resultados en torno a GOVERN, MAP, MEASURE y MANAGE a lo largo del ciclo de vida",[425,426,427],"NIST AI 600-1","Perfil de IA generativa para AI RMF","Añade consideraciones y acciones de riesgo específicas de IA generativa",[429,430,431],"ISO\u002FIEC 42001:2023","Requisitos de sistema de gestión de IA","Crea un sistema de gestión para toda la organización con política, roles, procesos y mejora continua",[433,434,435],"ISO\u002FIEC 23894:2023","Guía de gestión de riesgos de IA","Orienta la integración de la gestión de riesgos específicos de IA en las actividades organizacionales",[437,438,439],"Reglamento de IA de la UE","Regulación vinculante en la UE","Crea obligaciones legales según el actor, la categoría de IA y el caso de uso",{},{"id":442,"data":443,"type":218,"tunes":445},"p-framework-1",{"text":444},"Estas fuentes no deben reducirse a una única lista de verificación. NIST AI RMF es una guía de gestión de riesgos. ISO\u002FIEC 42001 es una norma de sistema de gestión. El Reglamento de IA de la UE es ley. Una organización puede usarlos juntos, pero su autoridad, alcance y propósito de implementación son diferentes.",{},{"id":447,"data":448,"type":42,"tunes":450},"h-current-eu",{"text":449,"level":247},"Los plazos actuales del Reglamento de IA de la UE importan",{},{"id":452,"data":453,"type":218,"tunes":455},"p-eu-1",{"text":454},"A partir del 8 de octubre de 2026, la Comisión Europea declara que el Reglamento de IA pasó a ser generalmente aplicable el 2 de agosto de 2026. Las disposiciones sobre prácticas prohibidas y alfabetización en IA se aplicaron desde el 2 de febrero de 2025, mientras que las reglas de gobernanza y las obligaciones para modelos de IA de propósito general se aplicaron desde el 2 de agosto de 2025.",{},{"id":457,"data":458,"type":218,"tunes":460},"p-eu-2",{"text":459},"La guía actual de la Comisión también refleja fechas de aplicación posteriores para ciertos requisitos de alto riesgo. Las fechas exactas y las reglas de transición son una entrada de cumplimiento cambiante y deben verificarse contra el material actual de la Comisión antes de una decisión de despliegue.",{},{"id":462,"data":463,"type":226,"tunes":466},"eu-boundary",{"body":464,"title":465,"variant":233},"Los ejemplos regulatorios aquí explican por qué la gobernanza necesita entradas legales\u002Fde cumplimiento versionadas. No determinan si un producto específico se clasifica legalmente como prohibido, de alto riesgo, GPAI, implementador, proveedor u otro actor regulado.","Artículo de arquitectura, no asesoramiento legal",{},{"id":468,"data":469,"type":42,"tunes":471},"h-inventory",{"text":470,"level":247},"La gobernanza de IA comienza con un inventario",{},{"id":473,"data":474,"type":218,"tunes":476},"p-inventory-1",{"text":475},"Una organización no puede gobernar sistemas de IA que no puede identificar. El inventario debe cubrir más que modelos entrenados a medida. Puede incluir API de modelos externos, copilotos integrados, modelos locales, funciones de SaaS habilitadas para IA, entornos de ejecución de agentes, sistemas de recuperación y componentes de decisión automatizados.",{},{"id":478,"data":479,"type":218,"tunes":481},"p-inventory-2",{"text":480},"Un inventario útil conecta la capacidad de IA con su propietario empresarial, propietario técnico, caso de uso, usuarios, clases de datos, modelo\u002Fproveedor, entorno de despliegue, permisos, clasificación de riesgo, estado de evaluación, obligaciones aplicables y estado del ciclo de vida.",{},{"id":483,"data":484,"type":218,"tunes":486},"p-inventory-3",{"text":485},"El inventario no es solo una hoja de cálculo para auditores. Es el índice que permite a la organización saber qué debe revisarse cuando cambia un proveedor, aparece una vulnerabilidad, se vuelve aplicable una regulación o se retira un modelo.",{},{"id":488,"data":489,"type":377,"tunes":533},"inventory-table",{"content":490,"stretched":43,"withHeadings":14},[491,494,497,500,503,506,509,512,515,518,521,524,527,530],[492,493],"Campo del inventario","Por qué la gobernanza lo necesita",[495,496],"Caso de uso \u002F propósito","Define por qué existe la IA y qué significa el éxito",[498,499],"Propietario empresarial","Es dueño del resultado y del riesgo empresarial",[501,502],"Propietario técnico","Es dueño de la arquitectura, la implementación y la operación",[504,505],"Modelo + versión","Identifica la dependencia que produce el comportamiento",[507,508],"Proveedor \u002F entorno de ejecución","Identifica la dependencia contractual, de alojamiento y operativa",[510,511],"Clases de datos","Determina restricciones de privacidad, confidencialidad y fuente de verdad",[513,514],"Usuarios \u002F partes afectadas","Determina la exposición y el contexto de impacto humano",[516,517],"Herramientas \u002F acciones","Determina la autonomía y el riesgo de efectos secundarios",[519,520],"Permisos \u002F identidad","Define quién o qué puede invocar la capacidad",[522,523],"Clasificación de riesgo","Determina los controles requeridos y la ruta de aprobación",[525,526],"Evidencia de evaluación","Muestra si se probó el comportamiento previsto",[528,529],"Estado del ciclo de vida","Borrador, revisión, aprobado, restringido, suspendido o retirado",[531,532],"Fecha de revisión \u002F disparadores","Define cuándo debe revisarse la decisión de gobernanza",{},{"id":535,"data":536,"type":42,"tunes":538},"h-ownership",{"text":537,"level":247},"La gobernanza requiere responsabilidad nominada",{},{"id":540,"data":541,"type":218,"tunes":543},"p-own-1",{"text":542},"Los fallos de IA a menudo cruzan los límites organizacionales. Un problema de calidad del modelo puede convertirse en un fallo de producto, un problema de seguridad, un incidente de privacidad o un incumplimiento contractual. La gobernanza necesita responsables nominados antes de que ocurra el incidente.",{},{"id":545,"data":546,"type":218,"tunes":548},"p-own-2",{"text":547},"La responsabilidad no significa que una sola persona sea responsable de todo. Un modelo sólido separa los derechos de decisión: propietario del negocio, propietario del producto, propietario técnico, propietario de datos, especialistas en seguridad\u002Fprivacidad, actores legales\u002Fcumplimiento y soporte operativo.",{},{"id":550,"data":551,"type":218,"tunes":553},"p-own-3",{"text":552},"La propiedad crítica es que cada decisión requerida tenga un responsable y que cada responsable sepa qué evidencia se espera que revise.",{},{"id":555,"data":556,"type":42,"tunes":558},"h-decision-rights",{"text":557,"level":247},"Los derechos de decisión deben ser explícitos",{},{"id":560,"data":561,"type":377,"tunes":593},"decision-table",{"content":562,"stretched":43,"withHeadings":14},[563,566,569,572,575,578,581,584,587,590],[564,565],"Decisión","Función responsable típica",[567,568],"¿Puede existir este caso de uso de IA?","Propietario del negocio\u002Fproducto con aporte de gobernanza\u002Friesgo",[570,571],"¿Puede procesarse esta clase de datos?","Propietario de datos + privacidad\u002Fseguridad según la política",[573,574],"¿Puede usarse este proveedor\u002Fmodelo?","Arquitectura\u002Fplataforma + seguridad\u002Fadquisiciones + gobernanza",[576,577],"¿Puede este agente ejecutar esta acción?","Propietario de la aplicación + propietario de autorización\u002Fpolítica de negocio",[579,580],"¿Es la calidad suficiente para el despliegue?","Propietario de producto\u002Ftécnico frente a criterios de aceptación definidos",[582,583],"¿Puede aceptarse el riesgo residual?","Responsable de riesgo nominado en el nivel de autoridad adecuado",[585,586],"¿Puede concederse una excepción?","Autoridad de excepción explícita, con límite temporal y documentada",[588,589],"¿Debería suspenderse el sistema?","Propietario operativo\u002Fnegocio bajo incidentes o desencadenantes de riesgo",[591,592],"¿Puede entrar en producción una actualización del modelo?","Responsable del cambio tras evidencia de regresión\u002Fevaluación",{},{"id":595,"data":596,"type":42,"tunes":598},"h-model",{"text":597,"level":247},"La gobernanza del modelo es más que elegir un modelo",{},{"id":600,"data":601,"type":218,"tunes":603},"p-model-1",{"text":602},"La gobernanza del modelo rastrea qué modelo se utiliza, con qué propósito, bajo qué configuración y evidencia. Esto se aplica a API externas, modelos alojados localmente, modelos ajustados y modelos integrados en software de terceros.",{},{"id":605,"data":606,"type":218,"tunes":608},"p-model-2",{"text":607},"Una decisión de modelo debe considerar la capacidad, los resultados de evaluación, el costo, la latencia, el manejo de datos, los términos del proveedor, el soporte del ciclo de vida, las restricciones geográficas\u002Fde alojamiento, la seguridad, el comportamiento de respaldo y las consecuencias del cambio de versión.",{},{"id":610,"data":611,"type":218,"tunes":613},"p-model-3",{"text":612},"Los alias de modelo como “latest” pueden ser operativamente convenientes pero debilitan la reproducibilidad si el comportamiento cambia sin un proceso de liberación gobernado. Los sistemas consecuentes se benefician del seguimiento explícito de versiones y la evaluación de regresión.",{},{"id":615,"data":616,"type":42,"tunes":618},"h-provider",{"text":617,"level":247},"La gobernanza del proveedor es una capa de dependencia separada",{},{"id":620,"data":621,"type":218,"tunes":623},"p-provider-1",{"text":622},"Dos sistemas que utilizan la misma familia de modelos pueden tener un riesgo de gobernanza diferente si uno se ejecuta localmente y otro envía datos a un proveedor externo. La gobernanza del proveedor cubre términos contractuales, ubicación de procesamiento, retención, registro, subprocesadores, disponibilidad, obsolescencia y estrategia de salida.",{},{"id":625,"data":626,"type":218,"tunes":628},"p-provider-2",{"text":627},"La abstracción del proveedor puede reducir el bloqueo técnico, pero no elimina el trabajo de gobernanza. Cambiar de proveedor puede cambiar los flujos de datos, el comportamiento del modelo, los supuestos de seguridad, el costo y las obligaciones de cumplimiento.",{},{"id":630,"data":631,"type":218,"tunes":633},"p-provider-3",{"text":632},"Por lo tanto, una lista de proveedores aprobados no debe interpretarse como “cada modelo y cada clase de datos de este proveedor están aprobados automáticamente”. La aprobación necesita alcance.",{},{"id":635,"data":636,"type":42,"tunes":638},"h-data",{"text":637,"level":247},"La gobernanza de datos sigue siendo la capa de fuente de verdad",{},{"id":640,"data":641,"type":218,"tunes":643},"p-data-1",{"text":642},"La gobernanza de IA no hace que el modelo sea la autoridad para los hechos organizacionales. La gobernanza de datos aún determina la propiedad, clasificación, retención, calidad y uso permitido de los datos de origen.",{},{"id":645,"data":646,"type":218,"tunes":648},"p-data-2",{"text":647},"Para RAG y agentes, la gobernanza debe identificar qué fuentes son autoritativas, cuáles son consultivas, cómo se preserva la procedencia, qué datos pueden entrar en el contexto del modelo y qué límites de inquilino\u002Fusuario deben aplicarse.",{},{"id":650,"data":651,"type":218,"tunes":653},"p-data-3",{"text":652},"Las salidas generadas también crean nuevas preguntas de gobernanza de datos: si se retienen las indicaciones y respuestas, quién puede acceder a los rastros, si los resúmenes generados se convierten en registros y cómo se eliminan los embeddings o índices derivados cuando se eliminan los datos de origen.",{},{"id":655,"data":656,"type":42,"tunes":658},"h-permissions",{"text":657,"level":247},"Los permisos son decisiones de gobernanza con aplicación en tiempo de ejecución",{},{"id":660,"data":661,"type":218,"tunes":663},"p-perm-1",{"text":662},"La IA agéntica convierte los permisos en un objeto de gobernanza de primer nivel. La organización necesita decidir a qué herramientas, archivos, API, bases de datos y efectos secundarios puede acceder cada agente o usuario.",{},{"id":665,"data":666,"type":218,"tunes":668},"p-perm-2",{"text":667},"La gobernanza define la política y la lógica de aprobación; el entorno de ejecución confiable la aplica. Las instrucciones en lenguaje natural como \"no eliminar archivos\" no sustituyen la autorización de sistemas de archivos, API o servicios.",{},{"id":670,"data":671,"type":218,"tunes":673},"p-perm-3",{"text":672},"El mismo principio se aplica al aislamiento de inquilinos: un rol puede autorizar una operación mientras que el alcance del inquilino restringe a qué recursos de qué cliente puede llegar esa operación.",{},{"id":675,"data":676,"type":42,"tunes":678},"h-risk",{"text":677,"level":247},"La clasificación de riesgos debe cambiar el conjunto de controles",{},{"id":680,"data":681,"type":218,"tunes":683},"p-risk-1",{"text":682},"No todos los sistemas de IA necesitan la misma profundidad de revisión. La gobernanza se vuelve escalable cuando la clasificación de riesgos modifica los requisitos de evidencia, aprobación y monitoreo.",{},{"id":685,"data":686,"type":377,"tunes":724},"risk-table",{"content":687,"stretched":43,"withHeadings":14},[688,692,696,700,704,708,712,716,720],[689,690,691],"Factor de riesgo","Ejemplo de menor control","Ejemplo de mayor control",[693,694,695],"Consecuencia empresarial","Borrador de texto interno","Aprobar una liquidación financiera",[697,698,699],"Impacto humano","Ayuda de escritura opcional","Apoyo a decisiones de empleo o elegibilidad",[701,702,703],"Sensibilidad de los datos","Documentación pública","Datos de salud, RR. HH., financieros o confidenciales",[705,706,707],"Autonomía","Recomendación de solo lectura","Agente con herramientas de escritura\u002Fpago\u002Fdespliegue",[709,710,711],"Reversibilidad","Resumen fácilmente regenerable","Transacción externa irreversible",[713,714,715],"Exposición","Piloto interno pequeño","Sistema público\u002Fde cara al cliente a escala",[717,718,719],"Autoridad de la fuente","Contenido de asesoramiento","Sistema en el que se confía para un hecho regulado o contractual",[721,722,723],"Detectabilidad de fallos","Defecto de formato obvio","Recomendación plausible pero materialmente incorrecta",{},{"id":726,"data":727,"type":218,"tunes":729},"p-risk-2",{"text":728},"El método de clasificación puede ser simple o sofisticado, pero debe corresponderse con consecuencias concretas: más pruebas, permisos más restringidos, supervisión humana obligatoria, revisión de seguridad, aceptación ejecutiva del riesgo o prohibición del despliegue.",{},{"id":731,"data":732,"type":42,"tunes":734},"h-map",{"text":733,"level":247},"La gobernanza debe preservar el contexto del caso de uso",{},{"id":736,"data":737,"type":218,"tunes":739},"p-map-1",{"text":738},"La función MAP del NIST enfatiza el propósito previsto, los usuarios, el contexto de despliegue, los supuestos, los impactos y las leyes o normas aplicables. Esto importa porque el mismo modelo puede ser de bajo riesgo en un caso de uso y de altas consecuencias en otro.",{},{"id":741,"data":742,"type":218,"tunes":744},"p-map-2",{"text":743},"Por lo tanto, los registros de gobernanza deben clasificar la aplicación, no solo el modelo. \"Usamos el modelo X\" no es suficiente para determinar el riesgo.",{},{"id":746,"data":747,"type":218,"tunes":749},"p-map-3",{"text":748},"El objeto de gobernanza relevante es el sistema\u002Fcaso de uso: modelo + datos + contexto + herramientas + usuarios + entorno de despliegue + proceso de negocio.",{},{"id":751,"data":752,"type":42,"tunes":754},"h-evaluation",{"text":753,"level":247},"La evaluación es evidencia de gobernanza",{},{"id":756,"data":757,"type":218,"tunes":759},"p-eval-1",{"text":758},"Un proceso de gobernanza de IA no debe aprobar el despliegue basándose únicamente en los puntos de referencia de un proveedor o en una demostración exitosa. El sistema necesita evidencia vinculada a su uso previsto real.",{},{"id":761,"data":762,"type":218,"tunes":764},"p-eval-2",{"text":763},"La evidencia útil puede incluir la evaluación del éxito en la tarea, la calidad de la recuperación, la fundamentación fáctica, las pruebas de seguridad, las pruebas de permisos, los escenarios adversarios, los estudios de revisión humana, la latencia\u002Fcosto, la robustez y las comparaciones de regresión.",{},{"id":766,"data":767,"type":218,"tunes":769},"p-eval-3",{"text":768},"La función MEASURE del NIST lo hace explícito: las organizaciones deben identificar y aplicar métodos y métricas apropiados para los riesgos identificados durante el mapeo, documentando al mismo tiempo los riesgos que no pueden o no serán medidos.",{},{"id":771,"data":772,"type":226,"tunes":776},"eval-boundary",{"body":773,"title":774,"variant":775},"\"El equipo cree que el modelo es suficientemente bueno\" es un artefacto de aprobación débil. \"El sistema cumplió los criterios de aceptación definidos en pruebas representativas, con estas limitaciones conocidas y riesgos residuales\" es gobernable.","Una puerta de gobernanza debe pedir evidencia, no confianza","success",{},{"id":778,"data":779,"type":42,"tunes":781},"h-gates",{"text":780,"level":247},"Las puertas de gobernanza deben existir a lo largo del ciclo de vida",{},{"id":783,"data":784,"type":320,"tunes":811},"gate-flow",{"steps":785,"title":810,"orientation":319},[786,789,792,795,798,801,804,807],{"label":787,"description":788},"Puerta de idea \u002F descubrimiento","Confirmar el propósito empresarial, el propietario y si la IA es una solución adecuada.",{"label":790,"description":791},"Puerta de arquitectura","Revisar el modelo\u002Fproveedor, el flujo de datos, la identidad, los permisos, el aislamiento y el diseño operativo.",{"label":793,"description":794},"Puerta de riesgo\u002Fcumplimiento","Clasificar el riesgo y las obligaciones aplicables; definir los controles requeridos.",{"label":796,"description":797},"Puerta de validación","Exigir evidencia de que se cumplen los criterios funcionales, de seguridad, de protección y de calidad.",{"label":799,"description":800},"Puerta de despliegue","Aprobar la configuración concreta, la versión, el entorno y el propietario operativo.",{"label":802,"description":803},"Puerta de cambio","Reevaluar los cambios de modelo\u002Fproveedor\u002Fherramienta\u002Fdatos según su materialidad.",{"label":805,"description":806},"Puerta de incidente","Pausar, restringir o revertir cuando se produzcan los desencadenantes de riesgo definidos.",{"label":808,"description":809},"Puerta de retirada","Eliminar limpiamente el acceso, los derivados de datos, las credenciales y las dependencias obsoletas.","Puertas de ciclo de vida de ejemplo",{},{"id":813,"data":814,"type":42,"tunes":816},"h-change",{"text":815,"level":247},"La gestión de cambios es fundamental para la gobernanza de la IA",{},{"id":818,"data":819,"type":218,"tunes":821},"p-change-1",{"text":820},"Los sistemas de IA cambian incluso cuando el código de la aplicación no lo hace. Los proveedores actualizan modelos, filtros de seguridad, límites de contexto, precios, políticas e infraestructura. Los corpus de recuperación cambian. Las herramientas de los agentes obtienen permisos. Las regulaciones y los contratos evolucionan.",{},{"id":823,"data":824,"type":218,"tunes":826},"p-change-2",{"text":825},"Por lo tanto, la gobernanza debe definir desencadenantes de cambios materiales. Un ajuste menor en la redacción de un prompt puede requerir pruebas de regresión ordinarias; reemplazar el modelo, habilitar herramientas de escritura o introducir datos sensibles puede requerir una nueva puerta de aprobación.",{},{"id":828,"data":829,"type":218,"tunes":831},"p-change-3",{"text":830},"El registro de gobernanza debe preservar qué versión fue aprobada y qué condiciones hicieron válida la aprobación.",{},{"id":833,"data":834,"type":42,"tunes":836},"h-exceptions",{"text":835,"level":247},"Las excepciones necesitan propietarios, caducidad y controles compensatorios",{},{"id":838,"data":839,"type":218,"tunes":841},"p-exc-1",{"text":840},"Las organizaciones reales necesitan excepciones. Un equipo puede necesitar un modelo no aprobado para un experimento de duración limitada, o un sistema heredado puede que aún no cumpla un nuevo requisito de registro.",{},{"id":843,"data":844,"type":218,"tunes":846},"p-exc-2",{"text":845},"El patrón peligroso es una excepción permanente no documentada. Las excepciones gobernables especifican propietario, justificación, alcance, riesgo residual, control compensatorio, fecha de caducidad y condición de revisión.",{},{"id":848,"data":849,"type":218,"tunes":851},"p-exc-3",{"text":850},"La gestión de excepciones debe formar parte del sistema de gobernanza normal en lugar de un canal lateral informal.",{},{"id":853,"data":854,"type":42,"tunes":856},"h-audit",{"text":855,"level":247},"La auditabilidad es la capacidad de reconstruir la decisión y la ejecución",{},{"id":858,"data":859,"type":218,"tunes":861},"p-audit-1",{"text":860},"La auditabilidad de la IA no consiste meramente en almacenar prompts de modelos. Significa poder reconstruir qué versión del sistema se utilizó, qué datos y permisos se aplicaron, quién aprobó la configuración, qué evaluaciones respaldaron el despliegue y qué ocurrió durante la ejecución relevante.",{},{"id":863,"data":864,"type":218,"tunes":866},"p-audit-2",{"text":865},"Para un agente, esto puede requerir la identidad del principal, las llamadas a herramientas, las aprobaciones, los recursos objetivo, los cambios de estado y los resultados. Para RAG, puede requerir la versión del corpus\u002Fíndice, la consulta de recuperación, la evidencia seleccionada y la procedencia. Para un cambio de modelo, puede requerir los resultados de evaluación anteriores y nuevos.",{},{"id":868,"data":869,"type":218,"tunes":871},"p-audit-3",{"text":870},"La evidencia de auditoría debe ser proporcionada. Registrar cada token posible puede crear un riesgo de privacidad y seguridad por sí mismo. La gobernanza debe definir qué evidencia es necesaria, cuánto tiempo se conserva y quién puede acceder a ella.",{},{"id":873,"data":874,"type":377,"tunes":900},"audit-table",{"content":875,"stretched":43,"withHeadings":14},[876,879,882,885,888,891,894,897],[877,878],"Objeto de auditoría","Evidencia útil",[880,881],"Decisión de gobernanza","Propietario, fecha, decisión, condiciones, evidencia, excepciones",[883,884],"Lanzamiento de modelo","Modelo\u002Fproveedor\u002Fversión, configuración, resultados de regresión",[886,887],"Acceso a datos","Principal, inquilino\u002Falcance, clase de origen, decisión de política",[889,890],"Acción del agente","Herramienta, argumentos\u002Fobjetivo, aprobación, resultado, cambio de estado",[892,893],"Respuesta RAG","Versión del corpus\u002Fíndice, conjunto de recuperación, evidencia seleccionada, citas",[895,896],"Incidente","Desencadenante, sistemas afectados, contención, propietario de la decisión, remediación",[898,899],"Retirada","Puntos finales deshabilitados, credenciales revocadas, datos derivados eliminados, decisión de archivo",{},{"id":902,"data":903,"type":42,"tunes":905},"h-observability",{"text":904,"level":247},"El monitoreo cierra el ciclo de gobernanza",{},{"id":907,"data":908,"type":218,"tunes":910},"p-monitor-1",{"text":909},"La aprobación es una instantánea. El monitoreo en producción indica a la gobernanza si las suposiciones detrás de la aprobación aún se mantienen.",{},{"id":912,"data":913,"type":218,"tunes":915},"p-monitor-2",{"text":914},"Las señales útiles dependen del caso de uso: regresión de calidad, salidas inseguras, fallos de herramientas, denegaciones de políticas, costos inusuales, latencia, quejas de usuarios, deriva, frescura de recuperación, incidentes del proveedor, alertas de seguridad o nuevas clasificaciones regulatorias.",{},{"id":917,"data":918,"type":218,"tunes":920},"p-monitor-3",{"text":919},"La gobernanza debe definir umbrales que provoquen acciones: investigar, restringir, requerir revisión humana, revertir, cambiar de proveedor, suspender o retirar.",{},{"id":922,"data":923,"type":42,"tunes":925},"h-incidents",{"text":924,"level":247},"Los incidentes de IA necesitan una ruta operativa definida",{},{"id":927,"data":928,"type":218,"tunes":930},"p-inc-1",{"text":929},"Los incidentes específicos de IA pueden implicar contenido dañino, fuga de datos, acciones no autorizadas, fallo factual persistente, interrupción del modelo o del proveedor, inyección de prompts, recuperación entre inquilinos o comportamiento inesperado tras una actualización del modelo.",{},{"id":932,"data":933,"type":218,"tunes":935},"p-inc-2",{"text":934},"El proceso de incidentes debe conectar la respuesta técnica con la responsabilidad de gobernanza. Alguien debe estar autorizado para deshabilitar un modelo, retirar una herramienta, revocar credenciales, restringir usuarios, notificar a las funciones afectadas y decidir si el sistema puede volver al servicio.",{},{"id":937,"data":938,"type":218,"tunes":940},"p-inc-3",{"text":939},"Las lecciones de los incidentes deben actualizar políticas, pruebas, clasificación de riesgos y controles de plataforma reutilizables en lugar de permanecer aisladas en un solo equipo.",{},{"id":942,"data":943,"type":42,"tunes":945},"h-procurement",{"text":944,"level":247},"La adquisición forma parte de la gobernanza de IA",{},{"id":947,"data":948,"type":218,"tunes":950},"p-proc-1",{"text":949},"Las organizaciones pueden adquirir una capacidad sustancial de IA mediante la adquisición ordinaria de SaaS. Por lo tanto, la gobernanza debe cubrir tanto las funciones de IA compradas como los sistemas desarrollados internamente.",{},{"id":952,"data":953,"type":218,"tunes":955},"p-proc-2",{"text":954},"La revisión de proveedores puede incluir el uso de datos, la retención, la política de entrenamiento de modelos, los subprocesadores, la seguridad, la notificación de incidentes, la exportación o eliminación, el procesamiento geográfico, el cambio de versión, la continuidad del servicio y la salida contractual.",{},{"id":957,"data":958,"type":218,"tunes":960},"p-proc-3",{"text":959},"Una revisión de arquitectura técnica y una revisión de adquisición deben compartir el mismo inventario de sistemas para que la aprobación comercial no se aleje del flujo de datos realmente desplegado.",{},{"id":962,"data":963,"type":42,"tunes":965},"h-human",{"text":964,"level":247},"La supervisión humana debe diseñarse, no solo declararse",{},{"id":967,"data":968,"type":218,"tunes":970},"p-human-1",{"text":969},"El 'humano en el bucle' solo tiene sentido si el humano tiene autoridad, tiempo, información y un mecanismo de intervención utilizable.",{},{"id":972,"data":973,"type":218,"tunes":975},"p-human-2",{"text":974},"Un revisor que solo ve la recomendación de la IA pero no su evidencia, incertidumbre o estado de la fuente puede simplemente aprobar la salida sin más. La gobernanza debe especificar qué puede inspeccionar el revisor y qué acciones están disponibles: aprobar, rechazar, editar, escalar o detener.",{},{"id":977,"data":978,"type":218,"tunes":980},"p-human-3",{"text":979},"La supervisión humana también debe basarse en el riesgo. Los sistemas de bajas consecuencias pueden usar muestreo o revisión posterior, mientras que los efectos secundarios de altas consecuencias pueden requerir aprobación antes de la ejecución.",{},{"id":982,"data":983,"type":42,"tunes":985},"h-platform",{"text":984,"level":247},"La gobernanza de plataforma y la gobernanza de casos de uso son diferentes",{},{"id":987,"data":988,"type":385,"tunes":1014},"platform-comparison",{"rows":989,"title":1006,"layout":377,"columns":1007},[990,994,998,1002],{"id":991,"label":992,"values":993},"owner","Preocupación principal",[355,355],{"id":995,"label":996,"values":997},"approval","Aprobación típica",[355,355],{"id":999,"label":1000,"values":1001},"evidence","Evidencia",[355,355],{"id":1003,"label":1004,"values":1005},"failure","Fallo de gobernanza",[355,355],"Dos niveles de gobernanza",[1008,1011],{"id":1009,"label":1010},"platform","Plataforma de IA compartida",{"id":1012,"label":1013},"usecase","Caso de uso de IA individual",{},{"id":1016,"data":1017,"type":218,"tunes":1019},"p-platform-1",{"text":1018},"Por lo tanto, la aprobación de la plataforma debe reducir el trabajo repetido, no eliminar la responsabilidad del caso de uso. 'El modelo está aprobado' es diferente de 'esta aplicación del modelo está aprobada'.",{},{"id":1021,"data":1022,"type":42,"tunes":1024},"h-architecture",{"text":1023,"level":247},"Gobernanza de IA y Arquitectura de IA Empresarial",{},{"id":1026,"data":1027,"type":218,"tunes":1029},"p-arch-1",{"text":1028},"La Arquitectura de IA Empresarial describe cómo encajan los sistemas de IA, las plataformas, los datos, las identidades, los proveedores, las operaciones y los sistemas organizativos. La gobernanza de IA describe el sistema de decisión y control que determina cómo pueden crearse y modificarse esas arquitecturas.",{},{"id":1031,"data":1032,"type":218,"tunes":1034},"p-arch-2",{"text":1033},"Ambos están estrechamente acoplados. La gobernanza sin arquitectura puede volverse política abstracta. La arquitectura sin gobernanza puede producir sistemas técnicamente elegantes con propiedad poco clara, adopción descontrolada de proveedores o riesgo no revisado.",{},{"id":1036,"data":1037,"type":218,"tunes":1039},"p-arch-3",{"text":1038},"El diseño más sólido es bidireccional: los requisitos de gobernanza se convierten en controles de arquitectura, mientras que la arquitectura expone las decisiones reales que la gobernanza debe asumir.",{},{"id":1041,"data":1042,"type":42,"tunes":1044},"h-implementation",{"text":1043,"level":247},"Evidencia del proyecto original",{},{"id":1046,"data":1047,"type":42,"tunes":1049},"h-enterprise",{"text":1048,"level":246},"Enterprise Aaasaasa 0.1: la gobernanza como estructura de entrega",{},{"id":1051,"data":1052,"type":226,"tunes":1055},"enterprise-note",{"body":1053,"title":1054,"variant":240},"Enterprise Aaasaasa 0.1 es evidencia de proyecto y de formación\u002FPoC, no evidencia de adopción empresarial comercial. Es útil aquí porque su estructura de entrega conecta explícitamente arquitectura, hitos, riesgos, partes interesadas, validación y decisiones de proyecto.","Evidencia de proyecto \u002F PoC",{},{"id":1057,"data":1058,"type":218,"tunes":1060},"p-ent-1",{"text":1059},"Enterprise Aaasaasa 0.1 utiliza hitos definidos para requisitos, arquitectura, prototipo, validación y cierre del proyecto. Esa estructura ilustra un principio central de gobernanza: las transiciones del ciclo de vida deben tener salidas explícitas y puntos de decisión en lugar de un proceso informal de “construir primero, revisar después”.",{},{"id":1062,"data":1063,"type":218,"tunes":1065},"p-ent-2",{"text":1064},"El proyecto también rastrea riesgos como la expansión del alcance, el retraso de la arquitectura y las preocupaciones sobre IA\u002FRGPD, e identifica grupos de partes interesadas, incluidos patrocinio, dirección, arquitectura, seguridad, marketing, API externas y alojamiento.",{},{"id":1067,"data":1068,"type":218,"tunes":1070},"p-ent-3",{"text":1069},"Esto no constituye un sistema de gestión ISO\u002FIEC 42001. Es evidencia de proyecto más acotada que muestra cómo la propiedad, el riesgo, los hitos y la validación pueden integrarse en la entrega técnica.",{},{"id":1072,"data":1073,"type":42,"tunes":1075},"h-senseflow",{"text":1074,"level":246},"SenseFlow: trazabilidad de requisitos y decisiones",{},{"id":1077,"data":1078,"type":218,"tunes":1080},"p-sense-1",{"text":1079},"SenseFlow utiliza una ruta estructurada desde el objetivo del producto y la necesidad del usuario a través de epics, historias de usuario, criterios de aceptación, arquitectura, implementación y validación. Los registros de decisiones conservan la decisión, la justificación, las alternativas, las compensaciones, el estado y la fecha\u002Fversión.",{},{"id":1082,"data":1083,"type":218,"tunes":1085},"p-sense-2",{"text":1084},"Ese patrón de trazabilidad es directamente relevante para la gobernanza porque un control de IA debe conectarse con el requisito o riesgo que lo justificó. Un sistema de gobernanza se vuelve más sólido cuando la cadena desde la necesidad del negocio hasta la decisión de arquitectura y la evidencia de validación puede reconstruirse.",{},{"id":1087,"data":1088,"type":42,"tunes":1090},"h-client",{"text":1089,"level":246},"Aaasaasa AI Client: permisos y tiempo de ejecución como configuración gobernada",{},{"id":1092,"data":1093,"type":218,"tunes":1095},"p-client-1",{"text":1094},"Aaasaasa AI Client separa proveedor, modelo, ubicación de ejecución y permisos en lugar de tratarlos como una única “configuración de IA”. Los perfiles de permisos del espacio de trabajo central gobiernan el acceso a herramientas, Direct Chat no tiene herramientas de sistema de archivos\u002Fshell, y los tiempos de ejecución con capacidad de agente operan bajo perfiles de permisos explícitos.",{},{"id":1097,"data":1098,"type":218,"tunes":1100},"p-client-2",{"text":1099},"Esa separación demuestra un patrón de gobernanza importante: la elección del modelo y la autoridad de acción deben ser objetos de configuración independientes. Un modelo más potente no recibe automáticamente permisos más amplios de sistema de archivos, shell o negocio.",{},{"id":1102,"data":1103,"type":218,"tunes":1105},"p-client-3",{"text":1104},"La evidencia de implementación es arquitectónica, no una afirmación de que la aplicación constituya un sistema certificado de gobernanza organizacional de IA.",{},{"id":1107,"data":1108,"type":377,"tunes":1134},"impl-table",{"content":1109,"stretched":43,"withHeadings":14},[1110,1113,1116,1119,1122,1125,1128,1131],[1111,1112],"Patrón de proyecto observado","Lección de gobernanza",[1114,1115],"Puertas de hitos","Las transiciones del ciclo de vida pueden requerir evidencia explícita",[1117,1118],"Registro de riesgos","Las incertidumbres conocidas se convierten en objetos gestionados en lugar de preocupaciones informales",[1120,1121],"Mapeo de partes interesadas","La responsabilidad de decisión puede distribuirse deliberadamente",[1123,1124],"Criterios de aceptación + validación","Las decisiones de despliegue pueden depender de la evidencia",[1126,1127],"Registros de decisiones","Las compensaciones de arquitectura permanecen trazables",[1129,1130],"Separar modelo\u002Fproveedor\u002Ftiempo de ejecución\u002Fpermisos","La capacidad y la autoridad pueden gobernarse de forma independiente",[1132,1133],"Etiquetas explícitas de madurez del proyecto","La evidencia de PoC no se presenta erróneamente como prueba de producción o de mercado",{},{"id":1136,"data":1137,"type":42,"tunes":1139},"h-failures",{"text":1138,"level":247},"Modos comunes de fallo en la gobernanza de IA",{},{"id":1141,"data":1142,"type":377,"tunes":1186},"failures-table",{"content":1143,"stretched":43,"withHeadings":14},[1144,1147,1150,1153,1156,1159,1162,1165,1168,1171,1174,1177,1180,1183],[1145,1146],"Modo de fallo","Qué sale mal",[1148,1149],"La gobernanza es solo un PDF de políticas","Los equipos no pueden traducir la política en controles de tiempo de ejecución o decisiones de despliegue",[1151,1152],"Sin inventario de IA","La organización no puede identificar dónde se utilizan modelos, agentes o IA integrada",[1154,1155],"La aprobación del modelo se trata como aprobación del caso de uso","Un modelo aprobado se utiliza para un contexto de riesgo materialmente diferente",[1157,1158],"Sin propietario de negocio designado","Los equipos técnicos heredan por defecto las decisiones de riesgo de negocio",[1160,1161],"La clasificación de riesgo no tiene consecuencia de control","Todos los sistemas reciben la misma revisión independientemente de las consecuencias",[1163,1164],"Los permisos viven solo en los prompts","Las instrucciones del modelo se convierten en un sustituto de la autorización real",[1166,1167],"El cambio de proveedor es invisible","Los supuestos de comportamiento\u002Fdatos\u002Fcumplimiento cambian sin reevaluación",[1169,1170],"El éxito de la demo es evidencia de aprobación","El riesgo de producción se infiere de una pequeña prueba de camino feliz",[1172,1173],"La supervisión humana es ceremonial","El revisor no puede inspeccionar la evidencia ni detener la acción",[1175,1176],"La excepción no tiene vencimiento","La solución temporal se convierte en deuda de gobernanza permanente",[1178,1179],"Existen registros pero no pueden reconstruir decisiones","La auditabilidad se confunde con la retención de datos brutos",[1181,1182],"Cumplimiento posee la gobernanza en solitario","Producto, ingeniería, seguridad y operaciones se desvinculan de la responsabilidad",[1184,1185],"Cada decisión va a un consejo central","La gobernanza se convierte en un cuello de botella en lugar de un sistema de control escalable",{},{"id":1188,"data":1189,"type":42,"tunes":1191},"h-federated",{"text":1190,"level":247},"Gobernanza central no significa centralizar cada decisión",{},{"id":1193,"data":1194,"type":218,"tunes":1196},"p-fed-1",{"text":1195},"Una organización madura puede centralizar la política, los patrones de control y la escalada, mientras delega las decisiones de bajo riesgo a los equipos de producto o de plataforma.",{},{"id":1198,"data":1199,"type":218,"tunes":1201},"p-fed-2",{"text":1200},"Este modelo federado escala mejor que exigir que un comité central apruebe cada cambio de prompt. La función central define los niveles de riesgo, los controles obligatorios, la política de proveedores, la autoridad de excepción y los requisitos de auditoría; los equipos operan de forma autónoma dentro de esos límites.",{},{"id":1203,"data":1204,"type":218,"tunes":1206},"p-fed-3",{"text":1205},"El objetivo de diseño es una rendición de cuentas consistente, no la máxima centralización.",{},{"id":1208,"data":1209,"type":42,"tunes":1211},"h-metrics",{"text":1210,"level":247},"Gobernar el propio sistema de gobernanza",{},{"id":1213,"data":1214,"type":218,"tunes":1216},"p-metric-1",{"text":1215},"La gobernanza necesita retroalimentación. De lo contrario, los controles pueden convertirse en rituales costosos que no reducen el riesgo.",{},{"id":1218,"data":1219,"type":377,"tunes":1251},"metrics-table",{"content":1220,"stretched":43,"withHeadings":14},[1221,1224,1227,1230,1233,1236,1239,1242,1245,1248],[1222,1223],"Métrica \u002F señal","Qué puede revelar",[1225,1226],"Cobertura del inventario","Si la adopción de IA es visible para la gobernanza",[1228,1229],"Tiempo hasta la decisión","Si la gobernanza bloquea la entrega innecesariamente",[1231,1232],"Número y antigüedad de excepciones","Si las políticas son realistas o se eluden de forma rutinaria",[1234,1235],"Tasa de fallo en la evaluación","Si los controles previos al despliegue detectan defectos",[1237,1238],"Tasa de incidentes posteriores al despliegue","Si la evidencia de aprobación predice el comportamiento en producción",[1240,1241],"Tasa de denegación de herramientas no autorizadas","Si los límites de permisos se ejercen activamente",[1243,1244],"Frecuencia de cambios de modelo\u002Fproveedor","Con qué frecuencia los supuestos aprobados pueden quedar obsoletos",[1246,1247],"Sistemas retirados pero activos","Fallo en la limpieza\u002Fcontrol del ciclo de vida",[1249,1250],"Patrones de incidentes repetidos","Si las lecciones se están convirtiendo en controles de plataforma reutilizables",{},{"id":1253,"data":1254,"type":218,"tunes":1256},"p-metric-2",{"text":1255},"Las métricas de gobernanza no deben recompensar el volumen de papeleo. La medida útil es si mejoran la calidad de las decisiones, la trazabilidad, la detección de riesgos y la entrega segura.",{},{"id":1258,"data":1259,"type":42,"tunes":1261},"h-sequence",{"text":1260,"level":247},"Una secuencia práctica de implementación de gobernanza de IA",{},{"id":1263,"data":1264,"type":320,"tunes":1303},"design-flow",{"steps":1265,"title":1302,"orientation":319},[1266,1269,1272,1275,1278,1281,1284,1287,1290,1293,1296,1299],{"label":1267,"description":1268},"1. Definir el alcance de la gobernanza","Decidir qué sistemas de IA desarrollados internamente, adquiridos, integrados y experimentales están cubiertos.",{"label":1270,"description":1271},"2. Crear el inventario de IA","Registrar propietarios, casos de uso, modelos\u002Fproveedores, datos, herramientas, usuarios, estado del ciclo de vida y clase de riesgo.",{"label":1273,"description":1274},"3. Definir los derechos de decisión","Designar quién puede aprobar proveedores, uso de datos, aceptación de riesgos, excepciones, despliegue y retirada.",{"label":1276,"description":1277},"4. Establecer niveles de riesgo","Asignar la consecuencia y la exposición a diferentes requisitos de control.",{"label":1279,"description":1280},"5. Definir controles mínimos reutilizables","Establecer requisitos de referencia para identidad, permisos, datos, seguridad, evaluación, registro y supervisión humana.",{"label":1282,"description":1283},"6. Conectar la gobernanza con la arquitectura","Convertir la política en controles de plataforma\u002Ftiempo de ejecución que los equipos no puedan eludir accidentalmente.",{"label":1285,"description":1286},"7. Construir puertas basadas en evidencia","Exigir evidencia relevante de evaluación, seguridad, privacidad, arquitectura y cumplimiento antes de las transiciones del ciclo de vida.",{"label":1288,"description":1289},"8. Gobernar el cambio de modelo\u002Fproveedor","Rastrear versiones, obsolescencias y cambios materiales con evidencia de regresión.",{"label":1291,"description":1292},"9. Añadir monitoreo y disparadores de incidentes","Definir qué señales de producción obligan a investigar, restringir o suspender.",{"label":1294,"description":1295},"10. Formalizar las excepciones","Exigir alcance, propietario, riesgo residual, controles compensatorios y caducidad.",{"label":1297,"description":1298},"11. Auditar las decisiones y la ejecución","Conservar evidencia proporcionada que vincule propietarios, configuración, permisos, evaluaciones y acciones significativas.",{"label":1300,"description":1301},"12. Mejorar el sistema de gobernanza","Usar incidentes, retrasos y excepciones repetidas para revisar los controles y los patrones de plataforma.","Construir la gobernanza desde la visibilidad hasta el control",{},{"id":1305,"data":1306,"type":42,"tunes":1308},"h-checklist",{"text":1307,"level":247},"Lista de verificación de gobernanza de IA",{},{"id":1310,"data":1311,"type":377,"tunes":1361},"checklist-table",{"content":1312,"stretched":43,"withHeadings":14},[1313,1316,1319,1322,1325,1328,1331,1334,1337,1340,1343,1346,1349,1352,1355,1358],[1314,1315],"Pregunta","Evidencia de gobernanza esperada",[1317,1318],"¿Por qué existe este sistema de IA?","Propósito, propietario empresarial y resultado previsto",[1320,1321],"¿Quién es el propietario de la operación técnica?","Propietario técnico\u002Fde plataforma designado",[1323,1324],"¿Qué modelo\u002Fproveedor\u002Fversión se utiliza?","Dependencia registrada y versionada",[1326,1327],"¿Qué datos pueden entrar en el sistema?","Clasificación, autoridad y decisión de uso permitido",[1329,1330],"¿Qué identidades pueden usarlo?","Modelo de autenticación y autorización",[1332,1333],"¿Qué acciones puede realizar?","Matriz de herramientas\u002Fpermisos y límite de autonomía",[1335,1336],"¿Cuál es el nivel de riesgo?","Clasificación documentada con justificación",[1338,1339],"¿Qué controles son obligatorios?","Línea base de controles por nivel de riesgo",[1341,1342],"¿Cómo se evaluó?","Pruebas representativas y criterios de aceptación",[1344,1345],"¿Quién aceptó el riesgo residual?","Autoridad responsable designada",[1347,1348],"¿Qué requiere revisión humana?","Reglas explícitas de supervisión\u002Faprobación",[1350,1351],"¿Qué se registra?","Política de auditoría\u002Fobservabilidad proporcional a la consecuencia",[1353,1354],"¿Qué desencadena una nueva revisión?","Eventos de cambio de modelo\u002Fproveedor\u002Fdatos\u002Fherramientas\u002Fregulatorios\u002Fmateriales",[1356,1357],"¿Cómo se puede suspender?","Ruta operativa de inhabilitación\u002Frestricción y propietario",[1359,1360],"¿Cómo se retira?","Limpieza de credenciales, datos, derivados, endpoints y registros",{},{"id":1363,"data":1364,"type":42,"tunes":1366},"h-misconceptions",{"text":1365,"level":247},"Conceptos erróneos comunes",{},{"id":1368,"data":1369,"type":377,"tunes":1404},"misconceptions-table",{"content":1370,"stretched":43,"withHeadings":14},[1371,1374,1377,1380,1383,1386,1389,1392,1395,1398,1401],[1372,1373],"Concepto erróneo","Corrección",[1375,1376],"“La gobernanza de IA es cumplimiento.”","El cumplimiento es una entrada de la gobernanza; la gobernanza también cubre decisiones de propiedad, arquitectura, permisos, calidad, riesgo y ciclo de vida.",[1378,1379],"“Gobernanza significa un comité de revisión.”","Los comités pueden aprobar excepciones o sistemas de alto riesgo, pero muchos controles deben integrarse en la entrega normal y en la arquitectura de plataforma.",[1381,1382],"“Un modelo aprobado es seguro para cualquier uso.”","El riesgo pertenece al caso de uso y al contexto del sistema, no solo al modelo.",[1384,1385],"“Un proveedor gestiona la gobernanza por nosotros.”","Un proveedor controla parte de la pila; la organización sigue siendo propietaria de su caso de uso, datos, permisos y consecuencias empresariales.",[1387,1388],"“El humano en el bucle resuelve automáticamente el riesgo.”","La supervisión solo funciona cuando los revisores tienen autoridad, contexto y capacidad de intervención.",[1390,1391],"“Registrar todo proporciona auditabilidad.”","La auditabilidad requiere evidencia relevante reconstruible con retención y acceso controlados.",[1393,1394],"“La gobernanza bloquea la innovación.”","Una gobernanza deficiente puede bloquear la entrega; una gobernanza bien diseñada crea rutas seguras reutilizables y una propiedad de decisión más clara.",[1396,1397],"“Los pilotos de bajo riesgo no necesitan gobernanza.”","Pueden usar una gobernanza ligera, pero el inventario, la propiedad y los límites de datos\u002Fherramientas siguen importando.",[1399,1400],"“La IA local necesita menos gobernanza.”","El alojamiento local puede cambiar el riesgo de privacidad\u002Fproveedor, pero la calidad del modelo, los permisos, la seguridad y la gobernanza del ciclo de vida permanecen.",[1402,1403],"“Una vez aprobado, el sistema permanece aprobado.”","El modelo, el proveedor, los datos, la regulación y el uso pueden cambiar; las decisiones de gobernanza necesitan disparadores de revisión.",{},{"id":1406,"data":1407,"type":42,"tunes":1409},"h-edge",{"text":1408,"level":247},"Casos límite y limitaciones",{},{"id":1411,"data":1412,"type":218,"tunes":1414},"p-edge-1",{"text":1413},"Las organizaciones muy pequeñas pueden no necesitar una función dedicada de gobernanza de IA. Los mismos principios pueden implementarse mediante decisiones de arquitectura ligeras, registros de riesgos, mapeos de propietarios y puertas de liberación.",{},{"id":1416,"data":1417,"type":218,"tunes":1419},"p-edge-2",{"text":1418},"Las organizaciones altamente reguladas pueden necesitar una gobernanza mucho más formal, aseguramiento independiente, procesos de conformidad documentados e interpretación legal de lo que describe este artículo a nivel de arquitectura.",{},{"id":1421,"data":1422,"type":218,"tunes":1424},"p-edge-3",{"text":1423},"Los modelos de código abierto y autoalojados reducen algunas dependencias de proveedores pero crean otras: parcheo, procedencia del modelo, evaluación, seguridad de la infraestructura, licencias y propiedad operativa.",{},{"id":1426,"data":1427,"type":218,"tunes":1429},"p-edge-4",{"text":1428},"Los modelos de IA de propósito general pueden usarse en muchos contextos. La gobernanza debe evitar asumir que los controles del modelo a nivel de proveedor determinan por completo el riesgo de la aplicación posterior.",{},{"id":1431,"data":1432,"type":218,"tunes":1434},"p-edge-5",{"text":1433},"Ningún marco de gobernanza garantiza que un sistema de IA sea seguro o correcto. La gobernanza mejora la rendición de cuentas y la calidad de las decisiones; la validación técnica, el monitoreo y el juicio humano siguen siendo necesarios.",{},{"id":1436,"data":1437,"type":42,"tunes":1439},"h-change-answer",{"text":1438,"level":247},"¿Qué cambiaría esta respuesta?",{},{"id":1441,"data":1442,"type":218,"tunes":1444},"p-change-answer-1",{"text":1443},"El conjunto exacto de controles cambia según la ley, la industria, el tamaño de la organización, la sensibilidad de los datos, la autonomía, el modelo de despliegue y las consecuencias empresariales.",{},{"id":1446,"data":1447,"type":218,"tunes":1449},"p-change-answer-2",{"text":1448},"NIST está revisando actualmente AI RMF 1.0, por lo que la terminología o las prácticas recomendadas futuras de NIST pueden cambiar. Las normas ISO también pueden revisarse, y las directrices y los detalles de transición del Reglamento de IA de la UE continúan evolucionando.",{},{"id":1451,"data":1452,"type":218,"tunes":1454},"p-change-answer-3",{"text":1453},"El principio arquitectónico estable es que las decisiones de IA necesitan propietarios explícitos, evidencia, permisos, tratamiento de riesgos y revisión del ciclo de vida en lugar de estar ocultas dentro de la configuración del modelo o de la aplicación.",{},{"id":1456,"data":1457,"type":42,"tunes":1459},"h-related",{"text":1458,"level":247},"Conocimiento canónico relacionado",{},{"id":1461,"data":1462,"type":218,"tunes":1464},"p-related-1",{"text":1463},"La gobernanza de IA depende de conceptos ya separados en otro lugar de este grafo de conocimiento: la Fuente de Verdad determina la autoridad, RBAC y el aislamiento de inquilinos restringen el acceso, la ingeniería de contexto controla la información visible para el modelo, y la arquitectura agéntica define cómo las herramientas y acciones entran en un bucle de ejecución.",{},{"id":1466,"data":1467,"type":218,"tunes":1469},"p-related-2",{"text":1468},"La Arquitectura Empresarial de IA es el concepto de arquitectura organizacional padre. La gobernanza es la capa de control operativo que determina cómo esos componentes empresariales de IA pueden introducirse, modificarse y retirarse.",{},{"id":1471,"data":1472,"type":218,"tunes":1474},"p-related-3",{"text":1473},"Los sistemas agénticos aumentan los requisitos de gobernanza porque las decisiones del modelo pueden convertirse en efectos secundarios reales. Por lo tanto, los controles de permisos, aprobación y auditoría deben existir fuera del propio modelo.",{},{"id":1476,"data":1477,"type":1482,"tunes":1483},"ref-agent-reliability",{"url":1478,"title":1479,"excerpt":1480,"ctaLabel":1481},"https:\u002F\u002Fstajic.de\u002Fes\u002Fblog\u002Fai-agent-reliability-why-the-final-answer-is-not-enough","Confiabilidad de los agentes de IA: por qué la respuesta final no es suficiente","La gobernanza de agentes requiere evidencia sobre las trayectorias de ejecución, el uso de herramientas, los cambios de estado y la recuperabilidad, no solo la calidad del resultado final.","Leer el artículo sobre confiabilidad de agentes","referralArticle",{},{"id":1485,"data":1486,"type":1482,"tunes":1491},"ref-memory",{"url":1487,"title":1488,"excerpt":1489,"ctaLabel":1490},"https:\u002F\u002Fstajic.de\u002Fes\u002Fblog\u002Fai-agent-memory-is-not-rag-how-to-separate-memory-retrieval-state-and-context","La memoria de los agentes de IA no es RAG: cómo separar memoria, recuperación, estado y contexto","La gobernanza necesita políticas diferentes para la memoria duradera, el estado autoritativo, la información recuperada y el contexto temporal del modelo.","Leer el artículo sobre arquitectura de memoria",{},{"id":1493,"data":1494,"type":1482,"tunes":1499},"ref-avb",{"url":1495,"title":1496,"excerpt":1497,"ctaLabel":1498},"https:\u002F\u002Fstajic.de\u002Fes\u002Fblog\u002Fthe-answer-validity-boundary-the-missing-layer-between-relevance-and-reliable-ai-answers","La frontera de validez de la respuesta: la capa faltante entre la relevancia y las respuestas confiables de IA","Las decisiones de gobernanza deben preservar las condiciones bajo las cuales la evidencia y la aprobación siguen siendo válidas, incluidos la versión, el alcance, la fuente y el tiempo.","Leer la frontera de validez de la respuesta",{},{"id":1501,"data":1502,"type":42,"tunes":1504},"h-faq",{"text":1503,"level":247},"Preguntas frecuentes",{},{"id":1506,"data":1507,"type":1506,"tunes":1546},"faq",{"items":1508,"title":1545},[1509,1513,1517,1521,1525,1529,1533,1537,1541],{"id":1510,"answer":1511,"question":1512},"faq1","La gobernanza de IA es el sistema de propiedad, derechos de decisión, controles y evidencia utilizado para gestionar cómo se desarrollan, adquieren, despliegan, operan, modifican y retiran los sistemas de IA.","¿Qué es la gobernanza de IA?",{"id":1514,"answer":1515,"question":1516},"faq2","No. La gestión de riesgos identifica, evalúa y trata el riesgo. La gobernanza define quién debe realizar ese trabajo, qué decisiones lo requieren y qué evidencia o autoridad se necesita.","¿Es la gobernanza de IA lo mismo que la gestión de riesgos de IA?",{"id":1518,"answer":1519,"question":1520},"faq3","No. El cumplimiento se refiere a obligaciones legales, regulatorias, contractuales o internas aplicables. La gobernanza integra el cumplimiento con la arquitectura, la seguridad, los datos, la calidad, los permisos y la propiedad empresarial.","¿Es la gobernanza de IA lo mismo que el cumplimiento normativo?",{"id":1522,"answer":1523,"question":1524},"faq4","La Arquitectura Empresarial de IA define cómo encajan las capacidades y los sistemas de IA en la organización. La gobernanza de IA define el sistema de decisión y control que rige cómo esos componentes pueden introducirse, operarse y modificarse.","¿Cuál es la diferencia entre la gobernanza de IA y la Arquitectura Empresarial de IA?",{"id":1526,"answer":1527,"question":1528},"faq5","Sí, pero no necesariamente un departamento dedicado. Un inventario ligero, la propiedad, los permisos, la evaluación y los controles de cambio pueden implementar los mismos principios.","¿Necesitan las pequeñas empresas gobernanza de IA?",{"id":1530,"answer":1531,"question":1532},"faq6","Como mínimo: caso de uso, propietarios, modelo\u002Fproveedor\u002Fversión, clases de datos, usuarios, herramientas\u002Facciones, permisos, clasificación de riesgos, estado de evaluación, estado del ciclo de vida y desencadenantes de revisión.","¿Qué debe contener un inventario de IA?",{"id":1534,"answer":1535,"question":1536},"faq7","No. El riesgo depende del contexto de la aplicación: datos, usuarios, herramientas, autonomía, consecuencias y proceso empresarial.","¿Usar un modelo aprobado significa que un caso de uso está aprobado?",{"id":1538,"answer":1539,"question":1540},"faq8","La organización puede reconstruir la propiedad relevante, la configuración aprobada, el modelo\u002Fproveedor\u002Fversión, el contexto de datos\u002Fpermisos, la evidencia de evaluación, las acciones significativas y las decisiones del ciclo de vida.","¿Qué hace que un sistema de IA sea auditable?",{"id":1542,"answer":1543,"question":1544},"faq9","Utilice intervalos de revisión basados en riesgos más desencadenantes de eventos como cambios de modelo\u002Fproveedor, nuevos datos, nuevas herramientas, incidentes, cambios materiales en el rendimiento o actualizaciones regulatorias.","¿Con qué frecuencia deben revisarse las decisiones de gobernanza de IA?","Preguntas frecuentes sobre gobernanza de IA",{},{"id":1548,"data":1549,"type":42,"tunes":1551},"h-glossary",{"text":1550,"level":247},"Glosario",{},{"id":1553,"data":1554,"type":1553,"tunes":1604},"glossary",{"title":1555,"entries":1556},"Términos clave de gobernanza de IA",[1557,1560,1564,1568,1572,1576,1580,1584,1588,1592,1596,1600],{"term":381,"anchor":1558,"definition":1559},"ai-governance","Sistema organizacional de propiedad, derechos de decisión, controles y evidencia que rige el ciclo de vida de la IA.",{"term":1561,"anchor":1562,"definition":1563},"Sistema de gestión de IA","ai-management-system","Políticas, objetivos y procesos organizacionales interrelacionados para el desarrollo, la provisión o el uso responsable de la IA; ISO\u002FIEC 42001 especifica los requisitos para dicho sistema.",{"term":1565,"anchor":1566,"definition":1567},"Inventario de IA","ai-inventory","Registro de sistemas de IA, modelos, proveedores, casos de uso, propietarios, datos, clasificaciones de riesgo y estado del ciclo de vida.",{"term":1569,"anchor":1570,"definition":1571},"Propietario del riesgo","risk-owner","Autoridad designada responsable de decidir cómo se trata un riesgo definido o si se acepta el riesgo residual.",{"term":1573,"anchor":1574,"definition":1575},"Control","control","Medida técnica, organizacional o procedimental destinada a prevenir, detectar, reducir o responder a un riesgo.",{"term":1577,"anchor":1578,"definition":1579},"Puerta de gobernanza","governance-gate","Punto de decisión del ciclo de vida en el que se requieren evidencia y autoridad definidas antes de continuar.",{"term":1581,"anchor":1582,"definition":1583},"Riesgo residual","residual-risk","Riesgo que permanece después de aplicar controles o mitigación.",{"term":1585,"anchor":1586,"definition":1587},"Excepción","exception","Autorización explícita, con alcance definido y generalmente limitada en el tiempo, para desviarse de un requisito normal de gobernanza.",{"term":1589,"anchor":1590,"definition":1591},"Auditabilidad","auditability","Capacidad de reconstruir decisiones, configuraciones, evidencia, identidades y eventos de ejecución relevantes.",{"term":1593,"anchor":1594,"definition":1595},"Gobernanza de modelos","model-governance","Controles y decisiones que cubren la selección, el versionado, la evaluación, el uso permitido, el cambio y la retirada de modelos.",{"term":1597,"anchor":1598,"definition":1599},"Gobernanza de proveedores","provider-governance","Controles que cubren las dependencias de proveedores de IA externos o internos, el manejo de datos, la seguridad, los contratos, el ciclo de vida y la salida.",{"term":1601,"anchor":1602,"definition":1603},"Supervisión humana","human-oversight","Capacidad diseñada de revisión o intervención humana para decisiones o acciones de IA en puntos definidos.",{},{"id":1606,"data":1607,"type":42,"tunes":1609},"h-conclusion",{"text":1608,"level":247},"Conclusión",{},{"id":1611,"data":1612,"type":218,"tunes":1614},"p-conclusion-1",{"text":1613},"La gobernanza de IA es el plano de control organizacional en torno a la IA. Da nombres y evidencia a decisiones que de otro modo permanecen ocultas dentro del código, la configuración del proveedor, los prompts o el juicio informal del equipo.",{},{"id":1616,"data":1617,"type":218,"tunes":1619},"p-conclusion-2",{"text":1618},"Una gobernanza sólida conecta el sistema completo: propósito empresarial, modelos, proveedores, autoridad sobre los datos, identidad, permisos, evaluación, riesgo, cumplimiento, monitoreo, incidentes, cambio y retiro.",{},{"id":1621,"data":1622,"type":218,"tunes":1624},"p-conclusion-3",{"text":1623},"El objetivo práctico no es el máximo proceso. Es la estructura de gobernanza mínima que hace que las decisiones importantes de IA sean propiedad de alguien, estén basadas en evidencia, sean exigibles, revisables y auditables a lo largo de todo el ciclo de vida.",{},{"id":1626,"data":1627,"type":42,"tunes":1629},"h-sources",{"text":1628,"level":247},"Fuentes primarias y referencias actuales",{},{"id":1631,"data":1632,"type":218,"tunes":1634},"p-sources-note",{"text":1633},"Las fuentes a continuación proporcionan un fundamento externo actual para la gestión, el riesgo y la regulación de la IA. Las secciones del proyecto son evidencia original de implementación\u002Fproyecto y se distinguen explícitamente de los estándares formales o los sistemas de gobernanza certificados.",{},{"id":1636,"data":1637,"type":1643,"tunes":1644},"src-nist-rmf",{"link":1638,"meta":1639},"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework",{"image":1640,"title":1641,"description":1642},{"url":355},"NIST — Marco de Gestión de Riesgos de IA","Centro actual del NIST para el AI RMF 1.0, la revisión en curso, el Perfil de IA Generativa y los recursos relacionados con la gestión de riesgos.","linkTool",{},{"id":1646,"data":1647,"type":1643,"tunes":1653},"src-nist-core",{"link":1648,"meta":1649},"https:\u002F\u002Fairc.nist.gov\u002Fairmf-resources\u002Fairmf\u002F5-sec-core\u002F",{"image":1650,"title":1651,"description":1652},{"url":355},"NIST AIRC — Núcleo del AI RMF","Núcleo oficial del AI RMF que describe GOBERNAR, MAPEAR, MEDIR y GESTIONAR, con GOBERNAR como una función transversal del ciclo de vida.",{},{"id":1655,"data":1656,"type":1643,"tunes":1662},"src-nist-playbook",{"link":1657,"meta":1658},"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework\u002Fnist-ai-rmf-playbook",{"image":1659,"title":1660,"description":1661},{"url":355},"NIST — Guía práctica del AI RMF","Acciones sugeridas para operacionalizar la confiabilidad y la gestión de riesgos a lo largo del ciclo de vida de la IA.",{},{"id":1664,"data":1665,"type":1643,"tunes":1671},"src-nist-genai",{"link":1666,"meta":1667},"https:\u002F\u002Fwww.nist.gov\u002Fpublications\u002Fartificial-intelligence-risk-management-framework-generative-artificial-intelligence",{"image":1668,"title":1669,"description":1670},{"url":355},"NIST AI 600-1 — Perfil de IA Generativa","Perfil complementario del NIST que aplica los conceptos del AI RMF a los riesgos de la IA generativa y la gestión del ciclo de vida.",{},{"id":1673,"data":1674,"type":1643,"tunes":1680},"src-iso42001",{"link":1675,"meta":1676},"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F42001",{"image":1677,"title":1678,"description":1679},{"url":355},"ISO\u002FIEC 42001:2023 — Sistemas de gestión de IA","Estándar internacional que especifica los requisitos para establecer, implementar, mantener y mejorar continuamente un sistema de gestión de IA.",{},{"id":1682,"data":1683,"type":1643,"tunes":1689},"src-iso23894",{"link":1684,"meta":1685},"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F77304.html",{"image":1686,"title":1687,"description":1688},{"url":355},"ISO\u002FIEC 23894:2023 — Gestión de riesgos de IA","Guía internacional para integrar la gestión de riesgos específicos de la IA en las actividades y funciones organizacionales.",{},{"id":1691,"data":1692,"type":1643,"tunes":1698},"src-eu-act",{"link":1693,"meta":1694},"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Fpolicies\u002Fregulatory-framework-ai",{"image":1695,"title":1696,"description":1697},{"url":355},"Comisión Europea — Ley de IA","Resumen actual de la Comisión sobre la Ley de IA de la UE, el calendario de aplicación y el marco de implementación.",{},{"id":1700,"data":1701,"type":1643,"tunes":1707},"src-eu-faq",{"link":1702,"meta":1703},"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Ffaqs\u002Fnavigating-ai-act",{"image":1704,"title":1705,"description":1706},{"url":355},"Comisión Europea — Navegando la Ley de IA","Preguntas frecuentes actuales que cubren gobernanza, aplicación, implementación y el calendario de aplicación en evolución.",{},{"id":1709,"data":1710,"type":1643,"tunes":1716},"src-eu-gpai",{"link":1711,"meta":1712},"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Ffactpages\u002Fgeneral-purpose-ai-obligations-under-ai-act",{"image":1713,"title":1714,"description":1715},{"url":355},"Comisión Europea — Obligaciones de IA de propósito general","Resumen actual de las obligaciones de documentación, derechos de autor, contenido de entrenamiento y riesgo sistémico para los proveedores de GPAI.",{},"2.31","La gobernanza de la IA define quién puede aprobar, operar, cambiar y auditar los sistemas de IA en todos los modelos, proveedores, datos, permisos, riesgos, evaluación y el ciclo de vida completo.","\u002Fuploads\u002F2026\u002F10\u002Fai-governance-models-data-permissions-risk-and-auditability-1791485901301-g60xyu.webp","ai-governance-models-data-permissions-risk-and-auditability-1791485901301-g60xyu","PUBLISHED","2026-10-08T14:56:00.000Z","2026-10-08T18:56:36.234Z","2026-10-08T19:08:41.676Z",{"en":1726,"de":1727,"sr":1728,"es":1729,"fr":1730,"it":1731,"ru":1732,"zh":1733},"\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability","\u002Fde\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability","\u002Fsr\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability","\u002Fes\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability","\u002Ffr\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability","\u002Fit\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability","\u002Fru\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability","\u002Fzh\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability",[],{"id":1736,"login":1737,"email":1738,"displayName":1739},"20","rooth8233","aleksandar@stajic.de","Aleksandar Stajić",[1741,3012],{"lang":1742,"title":1743,"content":1744,"contentJson":1745,"excerpt":3011},"en","AI Governance: Models, Data, Permissions, Risk and Auditability","{\"time\":1791485902655,\"blocks\":[{\"id\":\"intro\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI governance is the system of decision rights, responsibilities, controls and evidence used to decide how an organization may develop, acquire, deploy, operate, change and retire AI systems. It is broader than a policy document and narrower than enterprise architecture as a whole. Effective AI governance connects business ownership, model and provider choices, data authority, permissions, risk classification, evaluation, monitoring, incident handling, auditability and lifecycle decisions so that someone can answer not only “does the AI work?” but also “who approved it, under which conditions, with what evidence, and when must that decision be revisited?”\"},\"tunes\":{}},{\"id\":\"direct\",\"type\":\"callout\",\"data\":{\"variant\":\"info\",\"title\":\"Direct answer\",\"body\":\"\u003Cstrong>AI governance turns AI from an informal technical capability into an accountable organizational capability.\u003C\u002Fstrong>\u003Cbr>\u003Cbr>Architecture determines how the system is built. Engineering implements it. Risk management evaluates uncertainty and harm. Compliance addresses applicable obligations. Governance connects these activities through ownership, decision rights, required controls, evidence and lifecycle gates.\"},\"tunes\":{}},{\"id\":\"boundary\",\"type\":\"callout\",\"data\":{\"variant\":\"warning\",\"title\":\"Governance is not a committee and not a PDF\",\"body\":\"A governance board can be one mechanism, and policies can document expectations, but governance only becomes operational when decisions change what systems are allowed to do: which models may be used, which data may enter them, which tools an agent may execute, which evaluations are required, who can approve exceptions, what must be logged and what triggers suspension or retirement.\"},\"tunes\":{}},{\"id\":\"current\",\"type\":\"callout\",\"data\":{\"variant\":\"note\",\"title\":\"Current-source note — 8 October 2026\",\"body\":\"NIST AI RMF 1.0 remains the current published framework while NIST is revising it. Its core is organized around \u003Cstrong>GOVERN, MAP, MEASURE and MANAGE\u003C\u002Fstrong>, with GOVERN as a cross-cutting function. ISO\u002FIEC 42001:2023 remains the international AI management-system standard for establishing, operating and continually improving an AI management system. The EU AI Act is now generally applicable from 2 August 2026, while some obligations had earlier application dates and some high-risk requirements have later transition dates. Regulatory timelines should always be rechecked before making a concrete compliance decision.\"},\"tunes\":{}},{\"id\":\"toc\",\"type\":\"tableOfContents\",\"data\":{\"title\":\"Contents\",\"minLevel\":2,\"maxLevel\":3},\"tunes\":{}},{\"id\":\"h-meaning\",\"type\":\"header\",\"data\":{\"text\":\"What AI governance really means\",\"level\":2},\"tunes\":{}},{\"id\":\"p-meaning-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI governance answers organizational questions that a model, SDK or architecture diagram cannot answer by itself. Who owns the business outcome? Who may approve a new provider? Which data classes are prohibited from external processing? What evidence is required before deployment? Which permissions may an agent receive? Who can accept residual risk? What happens when a model changes behavior after an upgrade?\"},\"tunes\":{}},{\"id\":\"p-meaning-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The purpose is not to prevent change. Good governance makes change legible: decisions have owners, evidence, conditions, exceptions, review dates and rollback or escalation paths.\"},\"tunes\":{}},{\"id\":\"p-meaning-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"This is why NIST places GOVERN across the entire AI risk-management lifecycle rather than treating governance as one final approval step. Governance establishes the culture, policies, accountability and organizational structures that make mapping, measuring and managing AI risk possible.\"},\"tunes\":{}},{\"id\":\"h-simple\",\"type\":\"header\",\"data\":{\"text\":\"The simplest example\",\"level\":2},\"tunes\":{}},{\"id\":\"p-simple-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"A product team wants to add an external generative-AI provider to summarize internal customer-support tickets. Technically, the integration may require only an API call.\"},\"tunes\":{}},{\"id\":\"p-simple-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance asks a different set of questions: Are the ticket contents permitted to leave the organization's environment? Which provider and model version are approved? Is retention disabled? Which users may invoke the feature? How is output evaluated? Is human review required? What gets logged? Who owns incidents? What happens if the provider changes its terms or model behavior?\"},\"tunes\":{}},{\"id\":\"p-simple-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The governance result may still be “deploy it.” The difference is that deployment is now a traceable decision with explicit conditions instead of an unrecorded engineering choice.\"},\"tunes\":{}},{\"id\":\"simple-flow\",\"type\":\"processFlow\",\"data\":{\"title\":\"A basic governed AI decision\",\"orientation\":\"auto\",\"steps\":[{\"label\":\"1. Register the use case\",\"description\":\"Record purpose, owner, users, data, model\u002Fprovider and intended outcome.\"},{\"label\":\"2. Classify risk and obligations\",\"description\":\"Determine business consequence, data sensitivity, autonomy, regulatory exposure and misuse potential.\"},{\"label\":\"3. Define required controls\",\"description\":\"Specify permissions, data handling, evaluations, human oversight, security, logging and provider constraints.\"},{\"label\":\"4. Collect evidence\",\"description\":\"Run tests, security\u002Fprivacy review, architecture review and relevant legal\u002Fcompliance checks.\"},{\"label\":\"5. Make a decision\",\"description\":\"Approve, approve with conditions, request changes, hold or reject.\"},{\"label\":\"6. Deploy under controlled configuration\",\"description\":\"Pin the approved model\u002Fprovider\u002Fruntime and enforce required boundaries.\"},{\"label\":\"7. Monitor and re-evaluate\",\"description\":\"Track incidents, quality, drift, provider changes, new risks and changed regulations.\"},{\"label\":\"8. Change, suspend or retire\",\"description\":\"Use evidence and ownership rules to decide the next lifecycle state.\"}]},\"tunes\":{}},{\"id\":\"h-stops\",\"type\":\"header\",\"data\":{\"text\":\"Where the simple example stops\",\"level\":2},\"tunes\":{}},{\"id\":\"p-stops-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Large organizations rarely govern one AI system in isolation. The same model may support dozens of products; one provider may process several data classes; an agent platform may expose shared tools to many teams.\"},\"tunes\":{}},{\"id\":\"p-stops-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance therefore needs portfolio-level structures as well as system-level controls: AI inventory, approved providers, model catalogs, shared evaluation baselines, security patterns, risk thresholds, exception registers and ownership mappings.\"},\"tunes\":{}},{\"id\":\"p-stops-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance also cannot be identical for every AI use. A public-content summarizer, an internal coding assistant, a hiring-support system and an agent that can initiate payments have materially different consequence and control profiles.\"},\"tunes\":{}},{\"id\":\"h-not\",\"type\":\"header\",\"data\":{\"text\":\"What AI governance is — and what it is not\",\"level\":2},\"tunes\":{}},{\"id\":\"not-comparison\",\"type\":\"comparison\",\"data\":{\"title\":\"AI governance compared with adjacent disciplines\",\"layout\":\"table\",\"columns\":[{\"id\":\"governance\",\"label\":\"AI governance\"},{\"id\":\"adjacent\",\"label\":\"Adjacent discipline\"}],\"rows\":[{\"id\":\"architecture\",\"label\":\"Enterprise \u002F solution architecture\",\"values\":[\"\",\"\"]},{\"id\":\"risk\",\"label\":\"AI risk management\",\"values\":[\"\",\"\"]},{\"id\":\"compliance\",\"label\":\"Compliance\",\"values\":[\"\",\"\"]},{\"id\":\"security\",\"label\":\"Security\",\"values\":[\"\",\"\"]},{\"id\":\"mlops\",\"label\":\"MLOps \u002F LLMOps\",\"values\":[\"\",\"\"]},{\"id\":\"ethics\",\"label\":\"AI ethics principles\",\"values\":[\"\",\"\"]}]},\"tunes\":{}},{\"id\":\"h-governance-compliance\",\"type\":\"header\",\"data\":{\"text\":\"Governance is broader than compliance\",\"level\":2},\"tunes\":{}},{\"id\":\"p-compliance-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Compliance is one input to governance, not the entire governance system. An AI use case can be legally permitted yet still violate company risk appetite, security policy, contractual obligations or product-quality requirements.\"},\"tunes\":{}},{\"id\":\"p-compliance-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The reverse also matters: internal approval does not override law. Governance should make applicable legal obligations visible inside the same decision path used for architecture, security and business risk.\"},\"tunes\":{}},{\"id\":\"p-compliance-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"ISO\u002FIEC 42001 explicitly frames an AI management system as a structured way to establish policies, objectives and processes for responsible AI. ISO also states that the standard does not replace laws or regulations; it provides a management framework that can support compliance.\"},\"tunes\":{}},{\"id\":\"h-frameworks\",\"type\":\"header\",\"data\":{\"text\":\"NIST AI RMF and ISO\u002FIEC 42001 solve different governance needs\",\"level\":2},\"tunes\":{}},{\"id\":\"framework-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Framework \u002F standard\",\"Primary role\",\"Useful governance value\"],[\"NIST AI RMF 1.0\",\"Voluntary AI risk-management framework\",\"Organizes outcomes around GOVERN, MAP, MEASURE and MANAGE across the lifecycle\"],[\"NIST AI 600-1\",\"Generative-AI profile for AI RMF\",\"Adds GenAI-specific risk considerations and actions\"],[\"ISO\u002FIEC 42001:2023\",\"AI management-system requirements\",\"Creates an organization-wide management system with policy, roles, processes and continual improvement\"],[\"ISO\u002FIEC 23894:2023\",\"AI risk-management guidance\",\"Guides integration of AI-specific risk management into organizational activities\"],[\"EU AI Act\",\"Binding regulation in the EU\",\"Creates legal obligations according to actor, AI category and use case\"]]},\"tunes\":{}},{\"id\":\"p-framework-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"These sources should not be collapsed into one checklist. NIST AI RMF is risk-management guidance. ISO\u002FIEC 42001 is a management-system standard. The EU AI Act is law. An organization can use them together, but their authority, scope and implementation purpose are different.\"},\"tunes\":{}},{\"id\":\"h-current-eu\",\"type\":\"header\",\"data\":{\"text\":\"Current EU AI Act timing matters\",\"level\":2},\"tunes\":{}},{\"id\":\"p-eu-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"As of 8 October 2026, the European Commission states that the AI Act became generally applicable on 2 August 2026. Prohibited-practice and AI-literacy provisions applied from 2 February 2025, while governance rules and obligations for general-purpose AI models applied from 2 August 2025.\"},\"tunes\":{}},{\"id\":\"p-eu-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The Commission's current guidance also reflects later application dates for certain high-risk requirements. Exact dates and transition rules are a moving compliance input and should be verified against current Commission material before a deployment decision.\"},\"tunes\":{}},{\"id\":\"eu-boundary\",\"type\":\"callout\",\"data\":{\"variant\":\"warning\",\"title\":\"Architecture article, not legal advice\",\"body\":\"The regulatory examples here explain why governance needs versioned legal\u002Fcompliance inputs. They do not determine whether a specific product is legally classified as prohibited, high-risk, GPAI, deployer, provider or another regulated actor.\"},\"tunes\":{}},{\"id\":\"h-inventory\",\"type\":\"header\",\"data\":{\"text\":\"AI governance starts with an inventory\",\"level\":2},\"tunes\":{}},{\"id\":\"p-inventory-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"An organization cannot govern AI systems it cannot identify. The inventory should cover more than custom-trained models. It may include external model APIs, embedded copilots, local models, AI-enabled SaaS features, agent runtimes, retrieval systems and automated decision components.\"},\"tunes\":{}},{\"id\":\"p-inventory-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"A useful inventory connects the AI capability to its business owner, technical owner, use case, users, data classes, model\u002Fprovider, deployment environment, permissions, risk classification, evaluation status, applicable obligations and lifecycle state.\"},\"tunes\":{}},{\"id\":\"p-inventory-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The inventory is not only a spreadsheet for auditors. It is the index that lets the organization know what must be reviewed when a provider changes, a vulnerability appears, a regulation becomes applicable or a model is retired.\"},\"tunes\":{}},{\"id\":\"inventory-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Inventory field\",\"Why governance needs it\"],[\"Use case \u002F purpose\",\"Defines why AI exists and what success means\"],[\"Business owner\",\"Owns outcome and business risk\"],[\"Technical owner\",\"Owns architecture, implementation and operation\"],[\"Model + version\",\"Identifies the behavior-producing dependency\"],[\"Provider \u002F runtime\",\"Identifies contractual, hosting and operational dependency\"],[\"Data classes\",\"Determines privacy, confidentiality and Source-of-Truth constraints\"],[\"Users \u002F affected parties\",\"Determines exposure and human-impact context\"],[\"Tools \u002F actions\",\"Determines autonomy and side-effect risk\"],[\"Permissions \u002F identity\",\"Defines who or what may invoke the capability\"],[\"Risk classification\",\"Determines required controls and approval path\"],[\"Evaluation evidence\",\"Shows whether intended behavior was tested\"],[\"Lifecycle state\",\"Draft, review, approved, restricted, suspended or retired\"],[\"Review date \u002F triggers\",\"Defines when the governance decision must be revisited\"]]},\"tunes\":{}},{\"id\":\"h-ownership\",\"type\":\"header\",\"data\":{\"text\":\"Governance requires named ownership\",\"level\":2},\"tunes\":{}},{\"id\":\"p-own-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI failures often cross organizational boundaries. A model-quality problem may become a product failure, security issue, privacy incident or contractual breach. Governance needs named owners before the incident occurs.\"},\"tunes\":{}},{\"id\":\"p-own-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Ownership does not mean one person is responsible for everything. A strong model separates decision rights: business owner, product owner, technical owner, data owner, security\u002Fprivacy specialists, legal\u002Fcompliance actors and operational support.\"},\"tunes\":{}},{\"id\":\"p-own-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The critical property is that every required decision has an owner and every owner knows which evidence they are expected to review.\"},\"tunes\":{}},{\"id\":\"h-decision-rights\",\"type\":\"header\",\"data\":{\"text\":\"Decision rights should be explicit\",\"level\":2},\"tunes\":{}},{\"id\":\"decision-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Decision\",\"Typical accountable function\"],[\"May this AI use case exist?\",\"Business\u002Fproduct owner with governance\u002Frisk input\"],[\"May this data class be processed?\",\"Data owner + privacy\u002Fsecurity according to policy\"],[\"May this provider\u002Fmodel be used?\",\"Architecture\u002Fplatform + security\u002Fprocurement + governance\"],[\"May this agent execute this action?\",\"Application owner + authorization\u002Fbusiness-policy owner\"],[\"Is quality sufficient for deployment?\",\"Product\u002Ftechnical owner against defined acceptance criteria\"],[\"Can residual risk be accepted?\",\"Named risk owner at appropriate authority level\"],[\"Can an exception be granted?\",\"Explicit exception authority, time-bounded and documented\"],[\"Should the system be suspended?\",\"Operational\u002Fbusiness owner under incident or risk triggers\"],[\"Can a model upgrade go live?\",\"Change owner after regression\u002Fevaluation evidence\"]]},\"tunes\":{}},{\"id\":\"h-model\",\"type\":\"header\",\"data\":{\"text\":\"Model governance is more than choosing a model\",\"level\":2},\"tunes\":{}},{\"id\":\"p-model-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Model governance tracks which model is used, for what purpose, under which configuration and evidence. This applies to external APIs, locally hosted models, fine-tuned models and models embedded in third-party software.\"},\"tunes\":{}},{\"id\":\"p-model-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"A model decision should consider capability, evaluation results, cost, latency, data handling, provider terms, lifecycle support, geographic\u002Fhosting constraints, security, fallback behavior and the consequences of version change.\"},\"tunes\":{}},{\"id\":\"p-model-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Model aliases such as “latest” can be operationally convenient but weaken reproducibility if behavior changes without a governed release process. Consequential systems benefit from explicit version tracking and regression evaluation.\"},\"tunes\":{}},{\"id\":\"h-provider\",\"type\":\"header\",\"data\":{\"text\":\"Provider governance is a separate dependency layer\",\"level\":2},\"tunes\":{}},{\"id\":\"p-provider-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Two systems using the same model family can have different governance risk if one runs locally and another sends data to an external provider. Provider governance covers contractual terms, processing location, retention, logging, sub-processors, availability, deprecation and exit strategy.\"},\"tunes\":{}},{\"id\":\"p-provider-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Provider abstraction can reduce technical lock-in, but it does not remove governance work. Swapping providers can change data flows, model behavior, security assumptions, cost and compliance obligations.\"},\"tunes\":{}},{\"id\":\"p-provider-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"An approved provider list should therefore not be interpreted as “every model and every data class from this provider is automatically approved.” Approval needs scope.\"},\"tunes\":{}},{\"id\":\"h-data\",\"type\":\"header\",\"data\":{\"text\":\"Data governance remains the Source-of-Truth layer\",\"level\":2},\"tunes\":{}},{\"id\":\"p-data-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI governance does not make the model the authority for organizational facts. Data governance still determines ownership, classification, retention, quality and permitted use of source data.\"},\"tunes\":{}},{\"id\":\"p-data-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"For RAG and agents, governance should identify which sources are authoritative, which are advisory, how provenance is preserved, which data may enter model context and which tenant\u002Fuser boundaries must be enforced.\"},\"tunes\":{}},{\"id\":\"p-data-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Generated outputs create new data-governance questions as well: whether prompts and responses are retained, who may access traces, whether generated summaries become records and how derived embeddings or indexes are deleted when source data is removed.\"},\"tunes\":{}},{\"id\":\"h-permissions\",\"type\":\"header\",\"data\":{\"text\":\"Permissions are governance decisions with runtime enforcement\",\"level\":2},\"tunes\":{}},{\"id\":\"p-perm-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Agentic AI makes permissions a first-class governance object. The organization needs to decide which tools, files, APIs, databases and side effects each agent or user may access.\"},\"tunes\":{}},{\"id\":\"p-perm-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance defines the policy and approval logic; the trusted runtime enforces it. Natural-language instructions such as “do not delete files” are not a substitute for filesystem, API or service authorization.\"},\"tunes\":{}},{\"id\":\"p-perm-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The same principle applies to tenant isolation: a role can authorize an operation while tenant scope constrains which customer's resources that operation may reach.\"},\"tunes\":{}},{\"id\":\"h-risk\",\"type\":\"header\",\"data\":{\"text\":\"Risk classification should change the control set\",\"level\":2},\"tunes\":{}},{\"id\":\"p-risk-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Not every AI system needs the same review depth. Governance becomes scalable when risk classification changes the evidence, approval and monitoring requirements.\"},\"tunes\":{}},{\"id\":\"risk-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Risk driver\",\"Lower-control example\",\"Higher-control example\"],[\"Business consequence\",\"Draft internal text\",\"Approve financial settlement\"],[\"Human impact\",\"Optional writing aid\",\"Employment or eligibility decision support\"],[\"Data sensitivity\",\"Public documentation\",\"Health, HR, financial or confidential data\"],[\"Autonomy\",\"Read-only recommendation\",\"Agent with write\u002Fpayment\u002Fdeployment tools\"],[\"Reversibility\",\"Easily regenerated summary\",\"Irreversible external transaction\"],[\"Exposure\",\"Small internal pilot\",\"Public\u002Fcustomer-facing system at scale\"],[\"Source authority\",\"Advisory content\",\"System relied on for regulated or contractual fact\"],[\"Failure detectability\",\"Obvious formatting defect\",\"Plausible but materially wrong recommendation\"]]},\"tunes\":{}},{\"id\":\"p-risk-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The classification method can be simple or sophisticated, but it should map to concrete consequences: more testing, narrower permissions, required human oversight, security review, executive risk acceptance or deployment prohibition.\"},\"tunes\":{}},{\"id\":\"h-map\",\"type\":\"header\",\"data\":{\"text\":\"Governance must preserve use-case context\",\"level\":2},\"tunes\":{}},{\"id\":\"p-map-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"NIST's MAP function emphasizes intended purpose, users, deployment context, assumptions, impacts and applicable laws or norms. This matters because the same model can be low risk in one use case and high consequence in another.\"},\"tunes\":{}},{\"id\":\"p-map-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance records should therefore classify the application, not only the model. “We use model X” is not enough to determine risk.\"},\"tunes\":{}},{\"id\":\"p-map-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The relevant governance object is the system\u002Fuse case: model + data + context + tools + users + deployment environment + business process.\"},\"tunes\":{}},{\"id\":\"h-evaluation\",\"type\":\"header\",\"data\":{\"text\":\"Evaluation is governance evidence\",\"level\":2},\"tunes\":{}},{\"id\":\"p-eval-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"An AI governance process should not approve deployment based only on vendor benchmarks or a successful demo. The system needs evidence tied to its actual intended use.\"},\"tunes\":{}},{\"id\":\"p-eval-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Useful evidence can include task-success evaluation, retrieval quality, factual grounding, security tests, permission tests, adversarial scenarios, human-review studies, latency\u002Fcost, robustness and regression comparisons.\"},\"tunes\":{}},{\"id\":\"p-eval-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"NIST's MEASURE function makes this explicit: organizations should identify and apply appropriate methods and metrics for risks identified during mapping, while documenting risks that cannot or will not be measured.\"},\"tunes\":{}},{\"id\":\"eval-boundary\",\"type\":\"callout\",\"data\":{\"variant\":\"success\",\"title\":\"A governance gate should ask for evidence, not confidence\",\"body\":\"“The team thinks the model is good enough” is a weak approval artifact. “The system met defined acceptance criteria on representative tests, with these known limitations and residual risks” is governable.\"},\"tunes\":{}},{\"id\":\"h-gates\",\"type\":\"header\",\"data\":{\"text\":\"Governance gates should exist across the lifecycle\",\"level\":2},\"tunes\":{}},{\"id\":\"gate-flow\",\"type\":\"processFlow\",\"data\":{\"title\":\"Example lifecycle gates\",\"orientation\":\"auto\",\"steps\":[{\"label\":\"Idea \u002F discovery gate\",\"description\":\"Confirm business purpose, owner and whether AI is an appropriate solution.\"},{\"label\":\"Architecture gate\",\"description\":\"Review model\u002Fprovider, data flow, identity, permissions, isolation and operational design.\"},{\"label\":\"Risk\u002Fcompliance gate\",\"description\":\"Classify risk and applicable obligations; define required controls.\"},{\"label\":\"Validation gate\",\"description\":\"Require evidence that functional, safety, security and quality criteria are met.\"},{\"label\":\"Deployment gate\",\"description\":\"Approve concrete configuration, version, environment and operational owner.\"},{\"label\":\"Change gate\",\"description\":\"Re-evaluate model\u002Fprovider\u002Ftool\u002Fdata changes according to materiality.\"},{\"label\":\"Incident gate\",\"description\":\"Pause, restrict or roll back when defined risk triggers occur.\"},{\"label\":\"Retirement gate\",\"description\":\"Remove access, data derivatives, credentials and obsolete dependencies cleanly.\"}]},\"tunes\":{}},{\"id\":\"h-change\",\"type\":\"header\",\"data\":{\"text\":\"Change management is central to AI governance\",\"level\":2},\"tunes\":{}},{\"id\":\"p-change-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI systems change even when application code does not. Providers update models, safety filters, context limits, pricing, policies and infrastructure. Retrieval corpora change. Agent tools gain permissions. Regulations and contracts evolve.\"},\"tunes\":{}},{\"id\":\"p-change-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance should therefore define material-change triggers. A minor prompt wording adjustment may need ordinary regression tests; replacing the model, enabling write tools or introducing sensitive data may require a new approval gate.\"},\"tunes\":{}},{\"id\":\"p-change-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The governance record should preserve which version was approved and what conditions made the approval valid.\"},\"tunes\":{}},{\"id\":\"h-exceptions\",\"type\":\"header\",\"data\":{\"text\":\"Exceptions need owners, expiry and compensating controls\",\"level\":2},\"tunes\":{}},{\"id\":\"p-exc-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Real organizations need exceptions. A team may need an unapproved model for a time-bounded experiment, or a legacy system may not yet meet a new logging requirement.\"},\"tunes\":{}},{\"id\":\"p-exc-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The dangerous pattern is a permanent undocumented exception. Governable exceptions specify owner, rationale, scope, residual risk, compensating control, expiration date and review condition.\"},\"tunes\":{}},{\"id\":\"p-exc-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Exception handling should be part of the normal governance system rather than an informal side channel.\"},\"tunes\":{}},{\"id\":\"h-audit\",\"type\":\"header\",\"data\":{\"text\":\"Auditability is the ability to reconstruct the decision and execution\",\"level\":2},\"tunes\":{}},{\"id\":\"p-audit-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI auditability is not merely storing model prompts. It means being able to reconstruct which system version was used, which data and permissions applied, who approved the configuration, what evaluations supported deployment and what happened during relevant execution.\"},\"tunes\":{}},{\"id\":\"p-audit-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"For an agent, this may require principal identity, tool calls, approvals, target resources, state changes and outcomes. For RAG, it may require corpus\u002Findex version, retrieval query, selected evidence and provenance. For a model change, it may require the previous and new evaluation results.\"},\"tunes\":{}},{\"id\":\"p-audit-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Audit evidence should be proportionate. Logging every possible token can create privacy and security risk of its own. Governance should define which evidence is necessary, how long it is retained and who may access it.\"},\"tunes\":{}},{\"id\":\"audit-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Audit object\",\"Useful evidence\"],[\"Governance decision\",\"Owner, date, decision, conditions, evidence, exceptions\"],[\"Model release\",\"Model\u002Fprovider\u002Fversion, configuration, regression results\"],[\"Data access\",\"Principal, tenant\u002Fscope, source class, policy decision\"],[\"Agent action\",\"Tool, arguments\u002Ftarget, approval, result, state change\"],[\"RAG answer\",\"Corpus\u002Findex version, retrieval set, selected evidence, citations\"],[\"Incident\",\"Trigger, affected systems, containment, decision owner, remediation\"],[\"Retirement\",\"Disabled endpoints, revoked credentials, deleted derived data, archive decision\"]]},\"tunes\":{}},{\"id\":\"h-observability\",\"type\":\"header\",\"data\":{\"text\":\"Monitoring closes the governance loop\",\"level\":2},\"tunes\":{}},{\"id\":\"p-monitor-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Approval is a snapshot. Production monitoring tells governance whether the assumptions behind approval still hold.\"},\"tunes\":{}},{\"id\":\"p-monitor-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Useful signals depend on the use case: quality regression, unsafe outputs, tool failures, policy denials, unusual cost, latency, user complaints, drift, retrieval freshness, provider incidents, security alerts or new regulatory classifications.\"},\"tunes\":{}},{\"id\":\"p-monitor-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance should define thresholds that cause action: investigate, restrict, require human review, roll back, switch provider, suspend or retire.\"},\"tunes\":{}},{\"id\":\"h-incidents\",\"type\":\"header\",\"data\":{\"text\":\"AI incidents need a defined operational path\",\"level\":2},\"tunes\":{}},{\"id\":\"p-inc-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI-specific incidents may involve harmful content, data leakage, unauthorized actions, persistent factual failure, model\u002Fprovider outage, prompt injection, cross-tenant retrieval or unexpected behavior after a model update.\"},\"tunes\":{}},{\"id\":\"p-inc-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The incident process should connect technical response with governance ownership. Someone must be authorized to disable a model, remove a tool, revoke credentials, restrict users, notify affected functions and decide whether the system may return to service.\"},\"tunes\":{}},{\"id\":\"p-inc-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The lessons from incidents should update policies, tests, risk classification and reusable platform controls rather than remain isolated in one team.\"},\"tunes\":{}},{\"id\":\"h-procurement\",\"type\":\"header\",\"data\":{\"text\":\"Procurement is part of AI governance\",\"level\":2},\"tunes\":{}},{\"id\":\"p-proc-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Organizations can acquire substantial AI capability through ordinary SaaS procurement. Governance should therefore cover purchased AI features as well as internally engineered systems.\"},\"tunes\":{}},{\"id\":\"p-proc-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Vendor review can include data use, retention, model training policy, sub-processors, security, incident notification, export\u002Fdeletion, geographic processing, version change, service continuity and contractual exit.\"},\"tunes\":{}},{\"id\":\"p-proc-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"A technical architecture review and procurement review should share the same system inventory so commercial approval does not drift away from the actual deployed data flow.\"},\"tunes\":{}},{\"id\":\"h-human\",\"type\":\"header\",\"data\":{\"text\":\"Human oversight should be designed, not merely declared\",\"level\":2},\"tunes\":{}},{\"id\":\"p-human-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"“Human in the loop” is meaningful only if the human has authority, time, information and a usable intervention mechanism.\"},\"tunes\":{}},{\"id\":\"p-human-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"A reviewer who sees only the AI recommendation but not its evidence, uncertainty or source state may simply rubber-stamp the output. Governance should specify what the reviewer can inspect and what actions are available: approve, reject, edit, escalate or stop.\"},\"tunes\":{}},{\"id\":\"p-human-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Human oversight should also be risk-based. Low-consequence systems may use sampling or post-hoc review, while high-consequence side effects may require approval before execution.\"},\"tunes\":{}},{\"id\":\"h-platform\",\"type\":\"header\",\"data\":{\"text\":\"Platform governance and use-case governance are different\",\"level\":2},\"tunes\":{}},{\"id\":\"platform-comparison\",\"type\":\"comparison\",\"data\":{\"title\":\"Two governance levels\",\"layout\":\"table\",\"columns\":[{\"id\":\"platform\",\"label\":\"Shared AI platform\"},{\"id\":\"usecase\",\"label\":\"Individual AI use case\"}],\"rows\":[{\"id\":\"owner\",\"label\":\"Primary concern\",\"values\":[\"\",\"\"]},{\"id\":\"approval\",\"label\":\"Typical approval\",\"values\":[\"\",\"\"]},{\"id\":\"evidence\",\"label\":\"Evidence\",\"values\":[\"\",\"\"]},{\"id\":\"failure\",\"label\":\"Governance failure\",\"values\":[\"\",\"\"]}]},\"tunes\":{}},{\"id\":\"p-platform-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Platform approval should therefore reduce repeated work, not eliminate use-case accountability. “The model is approved” is different from “this application of the model is approved.”\"},\"tunes\":{}},{\"id\":\"h-architecture\",\"type\":\"header\",\"data\":{\"text\":\"AI governance and Enterprise AI Architecture\",\"level\":2},\"tunes\":{}},{\"id\":\"p-arch-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Enterprise AI Architecture describes how AI systems, platforms, data, identities, providers, operations and organizational systems fit together. AI governance describes the decision and control system that determines how those architectures may be created and changed.\"},\"tunes\":{}},{\"id\":\"p-arch-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The two are tightly coupled. Governance without architecture can become abstract policy. Architecture without governance can produce technically elegant systems with unclear ownership, uncontrolled provider adoption or unreviewed risk.\"},\"tunes\":{}},{\"id\":\"p-arch-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The strongest design is bidirectional: governance requirements become architecture controls, while architecture exposes the real decisions that governance must own.\"},\"tunes\":{}},{\"id\":\"h-implementation\",\"type\":\"header\",\"data\":{\"text\":\"Original project evidence\",\"level\":2},\"tunes\":{}},{\"id\":\"h-enterprise\",\"type\":\"header\",\"data\":{\"text\":\"Enterprise Aaasaasa 0.1: governance as delivery structure\",\"level\":3},\"tunes\":{}},{\"id\":\"enterprise-note\",\"type\":\"callout\",\"data\":{\"variant\":\"note\",\"title\":\"Project \u002F PoC evidence\",\"body\":\"Enterprise Aaasaasa 0.1 is project and training\u002FPoC evidence, not evidence of commercial enterprise adoption. It is useful here because its delivery structure explicitly connects architecture, milestones, risks, stakeholders, validation and project decisions.\"},\"tunes\":{}},{\"id\":\"p-ent-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Enterprise Aaasaasa 0.1 uses defined milestones for requirements, architecture, prototype, validation and project closure. That structure illustrates a core governance principle: lifecycle transitions should have explicit outputs and decision points instead of an informal “build first, review later” process.\"},\"tunes\":{}},{\"id\":\"p-ent-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The project also tracks risks such as scope creep, architecture delay and AI\u002FGDPR concerns and identifies stakeholder groups including sponsorship, steering, architecture, security, marketing, external APIs and hosting.\"},\"tunes\":{}},{\"id\":\"p-ent-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"This does not constitute an ISO\u002FIEC 42001 management system. It is narrower project evidence showing how ownership, risk, milestones and validation can be integrated into technical delivery.\"},\"tunes\":{}},{\"id\":\"h-senseflow\",\"type\":\"header\",\"data\":{\"text\":\"SenseFlow: requirements and decision traceability\",\"level\":3},\"tunes\":{}},{\"id\":\"p-sense-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"SenseFlow uses a structured path from product goal and user need through epics, user stories, acceptance criteria, architecture, implementation and validation. Decision records preserve the decision, rationale, alternatives, trade-offs, status and date\u002Fversion.\"},\"tunes\":{}},{\"id\":\"p-sense-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"That traceability pattern is directly relevant to governance because an AI control should connect to the requirement or risk that justified it. A governance system becomes stronger when the chain from business need to architecture decision to validation evidence can be reconstructed.\"},\"tunes\":{}},{\"id\":\"h-client\",\"type\":\"header\",\"data\":{\"text\":\"Aaasaasa AI Client: permissions and runtime as governed configuration\",\"level\":3},\"tunes\":{}},{\"id\":\"p-client-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Aaasaasa AI Client separates provider, model, runtime location and permissions rather than treating them as one “AI setting.” Central workspace permission profiles govern tool access, Direct Chat has no filesystem\u002Fshell tools, and agent-capable runtimes operate under explicit permission profiles.\"},\"tunes\":{}},{\"id\":\"p-client-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"That separation demonstrates an important governance pattern: model choice and action authority should be independent configuration objects. A stronger model does not automatically receive broader filesystem, shell or business permissions.\"},\"tunes\":{}},{\"id\":\"p-client-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The implementation evidence is architectural, not a claim that the application constitutes a certified organizational AI governance system.\"},\"tunes\":{}},{\"id\":\"impl-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Observed project pattern\",\"Governance lesson\"],[\"Milestone gates\",\"Lifecycle transitions can require explicit evidence\"],[\"Risk register\",\"Known uncertainties become managed objects rather than informal concerns\"],[\"Stakeholder mapping\",\"Decision responsibility can be distributed deliberately\"],[\"Acceptance criteria + validation\",\"Deployment decisions can depend on evidence\"],[\"Decision records\",\"Architecture trade-offs remain traceable\"],[\"Separate model\u002Fprovider\u002Fruntime\u002Fpermissions\",\"Capability and authority can be governed independently\"],[\"Explicit project maturity labels\",\"PoC evidence is not misrepresented as production or market proof\"]]},\"tunes\":{}},{\"id\":\"h-failures\",\"type\":\"header\",\"data\":{\"text\":\"Common AI governance failure modes\",\"level\":2},\"tunes\":{}},{\"id\":\"failures-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Failure mode\",\"What goes wrong\"],[\"Governance is only a policy PDF\",\"Teams cannot translate policy into runtime controls or deployment decisions\"],[\"No AI inventory\",\"The organization cannot identify where models, agents or embedded AI are used\"],[\"Model approval is treated as use-case approval\",\"An approved model is used for a materially different risk context\"],[\"No named business owner\",\"Technical teams inherit business-risk decisions by default\"],[\"Risk classification has no control consequence\",\"Every system receives the same review regardless of consequence\"],[\"Permissions live only in prompts\",\"Model instructions become a substitute for real authorization\"],[\"Provider change is invisible\",\"Behavior\u002Fdata\u002Fcompliance assumptions change without re-evaluation\"],[\"Demo success is approval evidence\",\"Production risk is inferred from a small happy-path test\"],[\"Human oversight is ceremonial\",\"Reviewer cannot inspect evidence or stop the action\"],[\"Exception has no expiry\",\"Temporary workaround becomes permanent governance debt\"],[\"Logs exist but cannot reconstruct decisions\",\"Auditability is confused with raw data retention\"],[\"Compliance owns governance alone\",\"Product, engineering, security and operations disengage from accountability\"],[\"Every decision goes to a central board\",\"Governance becomes a bottleneck instead of a scalable control system\"]]},\"tunes\":{}},{\"id\":\"h-federated\",\"type\":\"header\",\"data\":{\"text\":\"Central governance does not mean centralizing every decision\",\"level\":2},\"tunes\":{}},{\"id\":\"p-fed-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"A mature organization can centralize policy, control patterns and escalation while delegating low-risk decisions to product or platform teams.\"},\"tunes\":{}},{\"id\":\"p-fed-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"This federated model scales better than requiring a central committee to approve every prompt change. The central function defines risk tiers, mandatory controls, provider policy, exception authority and audit requirements; teams operate autonomously inside those boundaries.\"},\"tunes\":{}},{\"id\":\"p-fed-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The design objective is consistent accountability, not maximum centralization.\"},\"tunes\":{}},{\"id\":\"h-metrics\",\"type\":\"header\",\"data\":{\"text\":\"Govern the governance system itself\",\"level\":2},\"tunes\":{}},{\"id\":\"p-metric-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance needs feedback. Otherwise controls can become expensive rituals that do not reduce risk.\"},\"tunes\":{}},{\"id\":\"metrics-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Metric \u002F signal\",\"What it can reveal\"],[\"Inventory coverage\",\"Whether AI adoption is visible to governance\"],[\"Time to decision\",\"Whether governance blocks delivery unnecessarily\"],[\"Exception count and age\",\"Whether policies are realistic or routinely bypassed\"],[\"Evaluation failure rate\",\"Whether pre-deployment controls catch defects\"],[\"Post-deployment incident rate\",\"Whether approval evidence predicts production behavior\"],[\"Unauthorized-tool denial rate\",\"Whether permission boundaries are actively exercised\"],[\"Model\u002Fprovider change frequency\",\"How often approved assumptions may become stale\"],[\"Retired-but-active systems\",\"Lifecycle cleanup\u002Fcontrol failure\"],[\"Repeated incident patterns\",\"Whether lessons are becoming reusable platform controls\"]]},\"tunes\":{}},{\"id\":\"p-metric-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance metrics should not reward paperwork volume. The useful measure is whether decision quality, traceability, risk detection and safe delivery improve.\"},\"tunes\":{}},{\"id\":\"h-sequence\",\"type\":\"header\",\"data\":{\"text\":\"A practical AI governance implementation sequence\",\"level\":2},\"tunes\":{}},{\"id\":\"design-flow\",\"type\":\"processFlow\",\"data\":{\"title\":\"Build governance from visibility to control\",\"orientation\":\"auto\",\"steps\":[{\"label\":\"1. Define governance scope\",\"description\":\"Decide which internally built, purchased, embedded and experimental AI systems are covered.\"},{\"label\":\"2. Create the AI inventory\",\"description\":\"Capture owners, use cases, models\u002Fproviders, data, tools, users, lifecycle state and risk class.\"},{\"label\":\"3. Define decision rights\",\"description\":\"Name who can approve providers, data use, risk acceptance, exceptions, deployment and retirement.\"},{\"label\":\"4. Establish risk tiers\",\"description\":\"Map consequence and exposure to different control requirements.\"},{\"label\":\"5. Define reusable minimum controls\",\"description\":\"Set baseline requirements for identity, permissions, data, security, evaluation, logging and human oversight.\"},{\"label\":\"6. Connect governance to architecture\",\"description\":\"Turn policy into platform\u002Fruntime controls that teams cannot accidentally bypass.\"},{\"label\":\"7. Build evidence-based gates\",\"description\":\"Require relevant evaluation, security, privacy, architecture and compliance evidence before lifecycle transitions.\"},{\"label\":\"8. Govern model\u002Fprovider change\",\"description\":\"Track versions, deprecations and material changes with regression evidence.\"},{\"label\":\"9. Add monitoring and incident triggers\",\"description\":\"Define which production signals force investigation, restriction or suspension.\"},{\"label\":\"10. Formalize exceptions\",\"description\":\"Require scope, owner, residual risk, compensating controls and expiry.\"},{\"label\":\"11. Audit decisions and execution\",\"description\":\"Retain proportionate evidence that links owners, configuration, permissions, evaluations and significant actions.\"},{\"label\":\"12. Improve the governance system\",\"description\":\"Use incidents, delays and repeated exceptions to revise controls and platform patterns.\"}]},\"tunes\":{}},{\"id\":\"h-checklist\",\"type\":\"header\",\"data\":{\"text\":\"AI governance checklist\",\"level\":2},\"tunes\":{}},{\"id\":\"checklist-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Question\",\"Expected governance evidence\"],[\"Why does this AI system exist?\",\"Purpose, business owner and intended outcome\"],[\"Who owns technical operation?\",\"Named technical\u002Fplatform owner\"],[\"Which model\u002Fprovider\u002Fversion is used?\",\"Registered and versioned dependency\"],[\"Which data may enter the system?\",\"Classification, authority and permitted-use decision\"],[\"Which identities may use it?\",\"Authentication and authorization model\"],[\"Which actions may it perform?\",\"Tool\u002Fpermission matrix and autonomy boundary\"],[\"What is the risk tier?\",\"Documented classification with rationale\"],[\"Which controls are mandatory?\",\"Risk-tier control baseline\"],[\"How was it evaluated?\",\"Representative tests and acceptance criteria\"],[\"Who accepted residual risk?\",\"Named accountable authority\"],[\"What requires human review?\",\"Explicit oversight\u002Fapproval rules\"],[\"What gets logged?\",\"Audit\u002Fobservability policy proportional to consequence\"],[\"What triggers re-review?\",\"Model\u002Fprovider\u002Fdata\u002Ftool\u002Fregulatory\u002Fmaterial-change events\"],[\"How can it be suspended?\",\"Operational kill\u002Frestriction path and owner\"],[\"How is it retired?\",\"Credential, data, derivative, endpoint and record cleanup\"]]},\"tunes\":{}},{\"id\":\"h-misconceptions\",\"type\":\"header\",\"data\":{\"text\":\"Common misconceptions\",\"level\":2},\"tunes\":{}},{\"id\":\"misconceptions-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Misconception\",\"Correction\"],[\"“AI governance is compliance.”\",\"Compliance is one governance input; governance also covers ownership, architecture, permissions, quality, risk and lifecycle decisions.\"],[\"“Governance means a review committee.”\",\"Committees can approve exceptions or high-risk systems, but many controls should be embedded in normal delivery and platform architecture.\"],[\"“An approved model is safe for every use.”\",\"Risk belongs to the use case and system context, not only the model.\"],[\"“A vendor handles governance for us.”\",\"A provider controls part of the stack; the organization still owns its use case, data, permissions and business consequences.\"],[\"“Human-in-the-loop automatically solves risk.”\",\"Oversight only works when reviewers have authority, context and intervention capability.\"],[\"“Logging everything gives auditability.”\",\"Auditability requires reconstructable relevant evidence with controlled retention and access.\"],[\"“Governance blocks innovation.”\",\"Poor governance can block delivery; well-designed governance creates reusable safe paths and clearer decision ownership.\"],[\"“Low-risk pilots need no governance.”\",\"They can use lightweight governance, but inventory, ownership and data\u002Ftool boundaries still matter.\"],[\"“Local AI needs less governance.”\",\"Local hosting can change privacy\u002Fprovider risk, but model quality, permissions, security and lifecycle governance remain.\"],[\"“Once approved, the system stays approved.”\",\"Model, provider, data, regulation and use can change; governance decisions need review triggers.\"]]},\"tunes\":{}},{\"id\":\"h-edge\",\"type\":\"header\",\"data\":{\"text\":\"Edge cases and limitations\",\"level\":2},\"tunes\":{}},{\"id\":\"p-edge-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Very small organizations may not need a dedicated AI governance function. The same principles can be implemented through lightweight architecture decisions, risk registers, owner mappings and release gates.\"},\"tunes\":{}},{\"id\":\"p-edge-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Highly regulated organizations may need much more formal governance, independent assurance, documented conformity processes and legal interpretation than this architecture-level article describes.\"},\"tunes\":{}},{\"id\":\"p-edge-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Open-source and self-hosted models reduce some provider dependencies but create others: patching, model provenance, evaluation, infrastructure security, licensing and operational ownership.\"},\"tunes\":{}},{\"id\":\"p-edge-4\",\"type\":\"paragraph\",\"data\":{\"text\":\"General-purpose AI models can be used across many contexts. Governance should avoid assuming that provider-level model controls fully determine downstream application risk.\"},\"tunes\":{}},{\"id\":\"p-edge-5\",\"type\":\"paragraph\",\"data\":{\"text\":\"No governance framework guarantees that an AI system is safe or correct. Governance improves accountability and decision quality; technical validation, monitoring and human judgment remain necessary.\"},\"tunes\":{}},{\"id\":\"h-change-answer\",\"type\":\"header\",\"data\":{\"text\":\"What would change this answer?\",\"level\":2},\"tunes\":{}},{\"id\":\"p-change-answer-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"The exact control set changes with law, industry, organization size, data sensitivity, autonomy, deployment model and business consequence.\"},\"tunes\":{}},{\"id\":\"p-change-answer-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"NIST is currently revising AI RMF 1.0, so future NIST terminology or recommended practices may change. ISO standards can also be revised, and EU AI Act guidance and transition details continue to evolve.\"},\"tunes\":{}},{\"id\":\"p-change-answer-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The stable architectural principle is that AI decisions need explicit owners, evidence, permissions, risk treatment and lifecycle review rather than being hidden inside model or application configuration.\"},\"tunes\":{}},{\"id\":\"h-related\",\"type\":\"header\",\"data\":{\"text\":\"Related canonical knowledge\",\"level\":2},\"tunes\":{}},{\"id\":\"p-related-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI governance depends on concepts already separated elsewhere in this knowledge graph: Source of Truth determines authority, RBAC and tenant isolation constrain access, context engineering controls model-visible information, and agentic architecture defines how tools and actions enter an execution loop.\"},\"tunes\":{}},{\"id\":\"p-related-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Enterprise AI Architecture is the parent organizational architecture concept. Governance is the operating control layer that determines how those enterprise AI components may be introduced, changed and retired.\"},\"tunes\":{}},{\"id\":\"p-related-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Agentic systems increase governance requirements because model decisions can become real side effects. Permission, approval and audit controls must therefore exist outside the model itself.\"},\"tunes\":{}},{\"id\":\"ref-agent-reliability\",\"type\":\"referralArticle\",\"data\":{\"url\":\"https:\u002F\u002Fstajic.de\u002Fblog\u002Fai-agent-reliability-why-the-final-answer-is-not-enough\",\"title\":\"AI Agent Reliability: Why the Final Answer Is Not Enough\",\"excerpt\":\"Agent governance requires evidence about execution trajectories, tool use, state changes and recoverability — not only final output quality.\",\"ctaLabel\":\"Read the agent reliability article\"},\"tunes\":{}},{\"id\":\"ref-memory\",\"type\":\"referralArticle\",\"data\":{\"url\":\"https:\u002F\u002Fstajic.de\u002Fblog\u002Fai-agent-memory-is-not-rag-how-to-separate-memory-retrieval-state-and-context\",\"title\":\"AI Agent Memory Is Not RAG: How to Separate Memory, Retrieval, State and Context\",\"excerpt\":\"Governance needs different policies for durable memory, authoritative state, retrieved information and temporary model context.\",\"ctaLabel\":\"Read the memory architecture article\"},\"tunes\":{}},{\"id\":\"ref-avb\",\"type\":\"referralArticle\",\"data\":{\"url\":\"https:\u002F\u002Fstajic.de\u002Fblog\u002Fthe-answer-validity-boundary-the-missing-layer-between-relevance-and-reliable-ai-answers\",\"title\":\"The Answer Validity Boundary: The Missing Layer Between Relevance and Reliable AI Answers\",\"excerpt\":\"Governance decisions should preserve the conditions under which evidence and approval remain valid, including version, scope, source and time.\",\"ctaLabel\":\"Read the Answer Validity Boundary\"},\"tunes\":{}},{\"id\":\"h-faq\",\"type\":\"header\",\"data\":{\"text\":\"Frequently asked questions\",\"level\":2},\"tunes\":{}},{\"id\":\"faq\",\"type\":\"faq\",\"data\":{\"title\":\"AI governance FAQ\",\"items\":[{\"id\":\"faq1\",\"question\":\"What is AI governance?\",\"answer\":\"AI governance is the system of ownership, decision rights, controls and evidence used to manage how AI systems are developed, acquired, deployed, operated, changed and retired.\"},{\"id\":\"faq2\",\"question\":\"Is AI governance the same as AI risk management?\",\"answer\":\"No. Risk management identifies, assesses and treats risk. Governance defines who must do that work, which decisions require it and what evidence or authority is required.\"},{\"id\":\"faq3\",\"question\":\"Is AI governance the same as compliance?\",\"answer\":\"No. Compliance concerns applicable legal, regulatory, contractual or internal obligations. Governance integrates compliance with architecture, security, data, quality, permissions and business ownership.\"},{\"id\":\"faq4\",\"question\":\"What is the difference between AI governance and Enterprise AI Architecture?\",\"answer\":\"Enterprise AI Architecture defines how AI capabilities and systems fit into the organization. AI governance defines the decision and control system governing how those components may be introduced, operated and changed.\"},{\"id\":\"faq5\",\"question\":\"Do small companies need AI governance?\",\"answer\":\"Yes, but not necessarily a dedicated department. Lightweight inventory, ownership, permissions, evaluation and change controls can implement the same principles.\"},{\"id\":\"faq6\",\"question\":\"What should an AI inventory contain?\",\"answer\":\"At minimum: use case, owners, model\u002Fprovider\u002Fversion, data classes, users, tools\u002Factions, permissions, risk classification, evaluation status, lifecycle state and review triggers.\"},{\"id\":\"faq7\",\"question\":\"Does using an approved model mean a use case is approved?\",\"answer\":\"No. Risk depends on the application context: data, users, tools, autonomy, consequences and business process.\"},{\"id\":\"faq8\",\"question\":\"What makes an AI system auditable?\",\"answer\":\"The organization can reconstruct relevant ownership, approved configuration, model\u002Fprovider\u002Fversion, data\u002Fpermission context, evaluation evidence, significant actions and lifecycle decisions.\"},{\"id\":\"faq9\",\"question\":\"How often should AI governance decisions be reviewed?\",\"answer\":\"Use risk-based review intervals plus event triggers such as model\u002Fprovider changes, new data, new tools, incidents, material performance change or regulatory updates.\"}]},\"tunes\":{}},{\"id\":\"h-glossary\",\"type\":\"header\",\"data\":{\"text\":\"Glossary\",\"level\":2},\"tunes\":{}},{\"id\":\"glossary\",\"type\":\"glossary\",\"data\":{\"title\":\"Key AI governance terms\",\"entries\":[{\"term\":\"AI governance\",\"definition\":\"Organizational system of ownership, decision rights, controls and evidence governing the AI lifecycle.\",\"anchor\":\"ai-governance\"},{\"term\":\"AI management system\",\"definition\":\"Interrelated organizational policies, objectives and processes for responsible development, provision or use of AI; ISO\u002FIEC 42001 specifies requirements for such a system.\",\"anchor\":\"ai-management-system\"},{\"term\":\"AI inventory\",\"definition\":\"Registry of AI systems, models, providers, use cases, owners, data, risk classifications and lifecycle state.\",\"anchor\":\"ai-inventory\"},{\"term\":\"Risk owner\",\"definition\":\"Named authority accountable for deciding how a defined risk is treated or whether residual risk is accepted.\",\"anchor\":\"risk-owner\"},{\"term\":\"Control\",\"definition\":\"Technical, organizational or procedural measure intended to prevent, detect, reduce or respond to risk.\",\"anchor\":\"control\"},{\"term\":\"Governance gate\",\"definition\":\"Lifecycle decision point at which defined evidence and authority are required before proceeding.\",\"anchor\":\"governance-gate\"},{\"term\":\"Residual risk\",\"definition\":\"Risk that remains after controls or mitigation have been applied.\",\"anchor\":\"residual-risk\"},{\"term\":\"Exception\",\"definition\":\"Explicit, scoped and usually time-bounded authorization to deviate from a normal governance requirement.\",\"anchor\":\"exception\"},{\"term\":\"Auditability\",\"definition\":\"Ability to reconstruct relevant decisions, configurations, evidence, identities and execution events.\",\"anchor\":\"auditability\"},{\"term\":\"Model governance\",\"definition\":\"Controls and decisions covering model selection, versioning, evaluation, permitted use, change and retirement.\",\"anchor\":\"model-governance\"},{\"term\":\"Provider governance\",\"definition\":\"Controls covering external or internal AI provider dependencies, data handling, security, contracts, lifecycle and exit.\",\"anchor\":\"provider-governance\"},{\"term\":\"Human oversight\",\"definition\":\"Designed human review or intervention capability for AI decisions or actions at defined points.\",\"anchor\":\"human-oversight\"}]},\"tunes\":{}},{\"id\":\"h-conclusion\",\"type\":\"header\",\"data\":{\"text\":\"Conclusion\",\"level\":2},\"tunes\":{}},{\"id\":\"p-conclusion-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI governance is the organizational control plane around AI. It gives names and evidence to decisions that otherwise remain hidden inside code, provider settings, prompts or informal team judgment.\"},\"tunes\":{}},{\"id\":\"p-conclusion-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Strong governance connects the complete system: business purpose, models, providers, data authority, identity, permissions, evaluation, risk, compliance, monitoring, incidents, change and retirement.\"},\"tunes\":{}},{\"id\":\"p-conclusion-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The practical goal is not maximum process. It is the minimum governance structure that makes important AI decisions owned, evidence-based, enforceable, reviewable and auditable throughout the lifecycle.\"},\"tunes\":{}},{\"id\":\"h-sources\",\"type\":\"header\",\"data\":{\"text\":\"Primary sources and current references\",\"level\":2},\"tunes\":{}},{\"id\":\"p-sources-note\",\"type\":\"paragraph\",\"data\":{\"text\":\"The sources below provide current external grounding for AI management, risk and regulation. Project sections are original implementation\u002Fproject evidence and are explicitly distinguished from formal standards or certified governance systems.\"},\"tunes\":{}},{\"id\":\"src-nist-rmf\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"NIST — AI Risk Management Framework\",\"description\":\"Current NIST hub for AI RMF 1.0, the ongoing revision, the GenAI Profile and related risk-management resources.\"}},\"tunes\":{}},{\"id\":\"src-nist-core\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fairc.nist.gov\u002Fairmf-resources\u002Fairmf\u002F5-sec-core\u002F\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"NIST AIRC — AI RMF Core\",\"description\":\"Official AI RMF Core describing GOVERN, MAP, MEASURE and MANAGE, with GOVERN as a cross-cutting lifecycle function.\"}},\"tunes\":{}},{\"id\":\"src-nist-playbook\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework\u002Fnist-ai-rmf-playbook\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"NIST — AI RMF Playbook\",\"description\":\"Suggested actions for operationalizing trustworthiness and risk management across the AI lifecycle.\"}},\"tunes\":{}},{\"id\":\"src-nist-genai\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fwww.nist.gov\u002Fpublications\u002Fartificial-intelligence-risk-management-framework-generative-artificial-intelligence\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"NIST AI 600-1 — Generative AI Profile\",\"description\":\"NIST companion profile applying AI RMF concepts to generative-AI risks and lifecycle management.\"}},\"tunes\":{}},{\"id\":\"src-iso42001\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F42001\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"ISO\u002FIEC 42001:2023 — AI management systems\",\"description\":\"International standard specifying requirements for establishing, implementing, maintaining and continually improving an AI management system.\"}},\"tunes\":{}},{\"id\":\"src-iso23894\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F77304.html\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"ISO\u002FIEC 23894:2023 — AI risk management\",\"description\":\"International guidance for integrating AI-specific risk management into organizational activities and functions.\"}},\"tunes\":{}},{\"id\":\"src-eu-act\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Fpolicies\u002Fregulatory-framework-ai\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"European Commission — AI Act\",\"description\":\"Current Commission overview of the EU AI Act, application timeline and implementation framework.\"}},\"tunes\":{}},{\"id\":\"src-eu-faq\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Ffaqs\u002Fnavigating-ai-act\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"European Commission — Navigating the AI Act\",\"description\":\"Current FAQ covering governance, enforcement, implementation and the evolving application timeline.\"}},\"tunes\":{}},{\"id\":\"src-eu-gpai\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Ffactpages\u002Fgeneral-purpose-ai-obligations-under-ai-act\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"European Commission — General-purpose AI obligations\",\"description\":\"Current overview of documentation, copyright, training-content and systemic-risk obligations for GPAI providers.\"}},\"tunes\":{}}],\"version\":\"2.31.6\"}",{"time":1746,"blocks":1747,"version":3010},1791485902655,[1748,1752,1757,1762,1767,1771,1775,1779,1783,1787,1791,1795,1799,1803,1832,1836,1840,1844,1848,1852,1879,1883,1887,1891,1895,1899,1923,1927,1931,1935,1939,1944,1948,1952,1956,1960,2006,2010,2014,2018,2022,2026,2060,2064,2068,2072,2076,2080,2084,2088,2092,2096,2100,2104,2108,2112,2116,2120,2124,2128,2132,2172,2176,2180,2184,2188,2192,2196,2200,2204,2208,2213,2217,2246,2250,2254,2258,2262,2266,2270,2274,2278,2282,2286,2290,2294,2322,2326,2330,2334,2338,2342,2346,2350,2354,2358,2362,2366,2370,2374,2378,2382,2386,2390,2412,2416,2420,2424,2428,2432,2436,2440,2445,2449,2453,2457,2461,2465,2469,2473,2477,2481,2485,2513,2517,2563,2567,2571,2575,2579,2583,2587,2621,2625,2629,2670,2674,2726,2730,2767,2771,2775,2779,2783,2787,2791,2795,2799,2803,2807,2811,2815,2819,2823,2830,2837,2844,2848,2880,2884,2923,2927,2931,2935,2939,2943,2947,2954,2961,2968,2975,2982,2989,2996,3003],{"id":215,"data":1749,"type":218,"tunes":1751},{"text":1750},"AI governance is the system of decision rights, responsibilities, controls and evidence used to decide how an organization may develop, acquire, deploy, operate, change and retire AI systems. It is broader than a policy document and narrower than enterprise architecture as a whole. Effective AI governance connects business ownership, model and provider choices, data authority, permissions, risk classification, evaluation, monitoring, incident handling, auditability and lifecycle decisions so that someone can answer not only “does the AI work?” but also “who approved it, under which conditions, with what evidence, and when must that decision be revisited?”",{},{"id":221,"data":1753,"type":226,"tunes":1756},{"body":1754,"title":1755,"variant":225},"\u003Cstrong>AI governance turns AI from an informal technical capability into an accountable organizational capability.\u003C\u002Fstrong>\u003Cbr>\u003Cbr>Architecture determines how the system is built. Engineering implements it. Risk management evaluates uncertainty and harm. Compliance addresses applicable obligations. Governance connects these activities through ownership, decision rights, required controls, evidence and lifecycle gates.","Direct answer",{},{"id":229,"data":1758,"type":226,"tunes":1761},{"body":1759,"title":1760,"variant":233},"A governance board can be one mechanism, and policies can document expectations, but governance only becomes operational when decisions change what systems are allowed to do: which models may be used, which data may enter them, which tools an agent may execute, which evaluations are required, who can approve exceptions, what must be logged and what triggers suspension or retirement.","Governance is not a committee and not a PDF",{},{"id":236,"data":1763,"type":226,"tunes":1766},{"body":1764,"title":1765,"variant":240},"NIST AI RMF 1.0 remains the current published framework while NIST is revising it. Its core is organized around \u003Cstrong>GOVERN, MAP, MEASURE and MANAGE\u003C\u002Fstrong>, with GOVERN as a cross-cutting function. ISO\u002FIEC 42001:2023 remains the international AI management-system standard for establishing, operating and continually improving an AI management system. The EU AI Act is now generally applicable from 2 August 2026, while some obligations had earlier application dates and some high-risk requirements have later transition dates. Regulatory timelines should always be rechecked before making a concrete compliance decision.","Current-source note — 8 October 2026",{},{"id":243,"data":1768,"type":248,"tunes":1770},{"title":1769,"maxLevel":246,"minLevel":247},"Contents",{},{"id":251,"data":1772,"type":42,"tunes":1774},{"text":1773,"level":247},"What AI governance really means",{},{"id":256,"data":1776,"type":218,"tunes":1778},{"text":1777},"AI governance answers organizational questions that a model, SDK or architecture diagram cannot answer by itself. Who owns the business outcome? Who may approve a new provider? Which data classes are prohibited from external processing? What evidence is required before deployment? Which permissions may an agent receive? Who can accept residual risk? What happens when a model changes behavior after an upgrade?",{},{"id":261,"data":1780,"type":218,"tunes":1782},{"text":1781},"The purpose is not to prevent change. Good governance makes change legible: decisions have owners, evidence, conditions, exceptions, review dates and rollback or escalation paths.",{},{"id":266,"data":1784,"type":218,"tunes":1786},{"text":1785},"This is why NIST places GOVERN across the entire AI risk-management lifecycle rather than treating governance as one final approval step. Governance establishes the culture, policies, accountability and organizational structures that make mapping, measuring and managing AI risk possible.",{},{"id":271,"data":1788,"type":42,"tunes":1790},{"text":1789,"level":247},"The simplest example",{},{"id":276,"data":1792,"type":218,"tunes":1794},{"text":1793},"A product team wants to add an external generative-AI provider to summarize internal customer-support tickets. Technically, the integration may require only an API call.",{},{"id":281,"data":1796,"type":218,"tunes":1798},{"text":1797},"Governance asks a different set of questions: Are the ticket contents permitted to leave the organization's environment? Which provider and model version are approved? Is retention disabled? Which users may invoke the feature? How is output evaluated? Is human review required? What gets logged? Who owns incidents? What happens if the provider changes its terms or model behavior?",{},{"id":286,"data":1800,"type":218,"tunes":1802},{"text":1801},"The governance result may still be “deploy it.” The difference is that deployment is now a traceable decision with explicit conditions instead of an unrecorded engineering choice.",{},{"id":291,"data":1804,"type":320,"tunes":1831},{"steps":1805,"title":1830,"orientation":319},[1806,1809,1812,1815,1818,1821,1824,1827],{"label":1807,"description":1808},"1. Register the use case","Record purpose, owner, users, data, model\u002Fprovider and intended outcome.",{"label":1810,"description":1811},"2. Classify risk and obligations","Determine business consequence, data sensitivity, autonomy, regulatory exposure and misuse potential.",{"label":1813,"description":1814},"3. Define required controls","Specify permissions, data handling, evaluations, human oversight, security, logging and provider constraints.",{"label":1816,"description":1817},"4. Collect evidence","Run tests, security\u002Fprivacy review, architecture review and relevant legal\u002Fcompliance checks.",{"label":1819,"description":1820},"5. Make a decision","Approve, approve with conditions, request changes, hold or reject.",{"label":1822,"description":1823},"6. Deploy under controlled configuration","Pin the approved model\u002Fprovider\u002Fruntime and enforce required boundaries.",{"label":1825,"description":1826},"7. Monitor and re-evaluate","Track incidents, quality, drift, provider changes, new risks and changed regulations.",{"label":1828,"description":1829},"8. Change, suspend or retire","Use evidence and ownership rules to decide the next lifecycle state.","A basic governed AI decision",{},{"id":323,"data":1833,"type":42,"tunes":1835},{"text":1834,"level":247},"Where the simple example stops",{},{"id":328,"data":1837,"type":218,"tunes":1839},{"text":1838},"Large organizations rarely govern one AI system in isolation. The same model may support dozens of products; one provider may process several data classes; an agent platform may expose shared tools to many teams.",{},{"id":333,"data":1841,"type":218,"tunes":1843},{"text":1842},"Governance therefore needs portfolio-level structures as well as system-level controls: AI inventory, approved providers, model catalogs, shared evaluation baselines, security patterns, risk thresholds, exception registers and ownership mappings.",{},{"id":338,"data":1845,"type":218,"tunes":1847},{"text":1846},"Governance also cannot be identical for every AI use. A public-content summarizer, an internal coding assistant, a hiring-support system and an agent that can initiate payments have materially different consequence and control profiles.",{},{"id":343,"data":1849,"type":42,"tunes":1851},{"text":1850,"level":247},"What AI governance is — and what it is not",{},{"id":348,"data":1853,"type":385,"tunes":1878},{"rows":1854,"title":1872,"layout":377,"columns":1873},[1855,1858,1861,1864,1867,1869],{"id":352,"label":1856,"values":1857},"Enterprise \u002F solution architecture",[355,355],{"id":357,"label":1859,"values":1860},"AI risk management",[355,355],{"id":361,"label":1862,"values":1863},"Compliance",[355,355],{"id":365,"label":1865,"values":1866},"Security",[355,355],{"id":369,"label":370,"values":1868},[355,355],{"id":373,"label":1870,"values":1871},"AI ethics principles",[355,355],"AI governance compared with adjacent disciplines",[1874,1876],{"id":380,"label":1875},"AI governance",{"id":383,"label":1877},"Adjacent discipline",{},{"id":388,"data":1880,"type":42,"tunes":1882},{"text":1881,"level":247},"Governance is broader than compliance",{},{"id":393,"data":1884,"type":218,"tunes":1886},{"text":1885},"Compliance is one input to governance, not the entire governance system. An AI use case can be legally permitted yet still violate company risk appetite, security policy, contractual obligations or product-quality requirements.",{},{"id":398,"data":1888,"type":218,"tunes":1890},{"text":1889},"The reverse also matters: internal approval does not override law. Governance should make applicable legal obligations visible inside the same decision path used for architecture, security and business risk.",{},{"id":403,"data":1892,"type":218,"tunes":1894},{"text":1893},"ISO\u002FIEC 42001 explicitly frames an AI management system as a structured way to establish policies, objectives and processes for responsible AI. ISO also states that the standard does not replace laws or regulations; it provides a management framework that can support compliance.",{},{"id":408,"data":1896,"type":42,"tunes":1898},{"text":1897,"level":247},"NIST AI RMF and ISO\u002FIEC 42001 solve different governance needs",{},{"id":413,"data":1900,"type":377,"tunes":1922},{"content":1901,"stretched":43,"withHeadings":14},[1902,1906,1909,1912,1915,1918],[1903,1904,1905],"Framework \u002F standard","Primary role","Useful governance value",[421,1907,1908],"Voluntary AI risk-management framework","Organizes outcomes around GOVERN, MAP, MEASURE and MANAGE across the lifecycle",[425,1910,1911],"Generative-AI profile for AI RMF","Adds GenAI-specific risk considerations and actions",[429,1913,1914],"AI management-system requirements","Creates an organization-wide management system with policy, roles, processes and continual improvement",[433,1916,1917],"AI risk-management guidance","Guides integration of AI-specific risk management into organizational activities",[1919,1920,1921],"EU AI Act","Binding regulation in the EU","Creates legal obligations according to actor, AI category and use case",{},{"id":442,"data":1924,"type":218,"tunes":1926},{"text":1925},"These sources should not be collapsed into one checklist. NIST AI RMF is risk-management guidance. ISO\u002FIEC 42001 is a management-system standard. The EU AI Act is law. An organization can use them together, but their authority, scope and implementation purpose are different.",{},{"id":447,"data":1928,"type":42,"tunes":1930},{"text":1929,"level":247},"Current EU AI Act timing matters",{},{"id":452,"data":1932,"type":218,"tunes":1934},{"text":1933},"As of 8 October 2026, the European Commission states that the AI Act became generally applicable on 2 August 2026. Prohibited-practice and AI-literacy provisions applied from 2 February 2025, while governance rules and obligations for general-purpose AI models applied from 2 August 2025.",{},{"id":457,"data":1936,"type":218,"tunes":1938},{"text":1937},"The Commission's current guidance also reflects later application dates for certain high-risk requirements. Exact dates and transition rules are a moving compliance input and should be verified against current Commission material before a deployment decision.",{},{"id":462,"data":1940,"type":226,"tunes":1943},{"body":1941,"title":1942,"variant":233},"The regulatory examples here explain why governance needs versioned legal\u002Fcompliance inputs. They do not determine whether a specific product is legally classified as prohibited, high-risk, GPAI, deployer, provider or another regulated actor.","Architecture article, not legal advice",{},{"id":468,"data":1945,"type":42,"tunes":1947},{"text":1946,"level":247},"AI governance starts with an inventory",{},{"id":473,"data":1949,"type":218,"tunes":1951},{"text":1950},"An organization cannot govern AI systems it cannot identify. The inventory should cover more than custom-trained models. It may include external model APIs, embedded copilots, local models, AI-enabled SaaS features, agent runtimes, retrieval systems and automated decision components.",{},{"id":478,"data":1953,"type":218,"tunes":1955},{"text":1954},"A useful inventory connects the AI capability to its business owner, technical owner, use case, users, data classes, model\u002Fprovider, deployment environment, permissions, risk classification, evaluation status, applicable obligations and lifecycle state.",{},{"id":483,"data":1957,"type":218,"tunes":1959},{"text":1958},"The inventory is not only a spreadsheet for auditors. It is the index that lets the organization know what must be reviewed when a provider changes, a vulnerability appears, a regulation becomes applicable or a model is retired.",{},{"id":488,"data":1961,"type":377,"tunes":2005},{"content":1962,"stretched":43,"withHeadings":14},[1963,1966,1969,1972,1975,1978,1981,1984,1987,1990,1993,1996,1999,2002],[1964,1965],"Inventory field","Why governance needs it",[1967,1968],"Use case \u002F purpose","Defines why AI exists and what success means",[1970,1971],"Business owner","Owns outcome and business risk",[1973,1974],"Technical owner","Owns architecture, implementation and operation",[1976,1977],"Model + version","Identifies the behavior-producing dependency",[1979,1980],"Provider \u002F runtime","Identifies contractual, hosting and operational dependency",[1982,1983],"Data classes","Determines privacy, confidentiality and Source-of-Truth constraints",[1985,1986],"Users \u002F affected parties","Determines exposure and human-impact context",[1988,1989],"Tools \u002F actions","Determines autonomy and side-effect risk",[1991,1992],"Permissions \u002F identity","Defines who or what may invoke the capability",[1994,1995],"Risk classification","Determines required controls and approval path",[1997,1998],"Evaluation evidence","Shows whether intended behavior was tested",[2000,2001],"Lifecycle state","Draft, review, approved, restricted, suspended or retired",[2003,2004],"Review date \u002F triggers","Defines when the governance decision must be revisited",{},{"id":535,"data":2007,"type":42,"tunes":2009},{"text":2008,"level":247},"Governance requires named ownership",{},{"id":540,"data":2011,"type":218,"tunes":2013},{"text":2012},"AI failures often cross organizational boundaries. A model-quality problem may become a product failure, security issue, privacy incident or contractual breach. Governance needs named owners before the incident occurs.",{},{"id":545,"data":2015,"type":218,"tunes":2017},{"text":2016},"Ownership does not mean one person is responsible for everything. A strong model separates decision rights: business owner, product owner, technical owner, data owner, security\u002Fprivacy specialists, legal\u002Fcompliance actors and operational support.",{},{"id":550,"data":2019,"type":218,"tunes":2021},{"text":2020},"The critical property is that every required decision has an owner and every owner knows which evidence they are expected to review.",{},{"id":555,"data":2023,"type":42,"tunes":2025},{"text":2024,"level":247},"Decision rights should be explicit",{},{"id":560,"data":2027,"type":377,"tunes":2059},{"content":2028,"stretched":43,"withHeadings":14},[2029,2032,2035,2038,2041,2044,2047,2050,2053,2056],[2030,2031],"Decision","Typical accountable function",[2033,2034],"May this AI use case exist?","Business\u002Fproduct owner with governance\u002Frisk input",[2036,2037],"May this data class be processed?","Data owner + privacy\u002Fsecurity according to policy",[2039,2040],"May this provider\u002Fmodel be used?","Architecture\u002Fplatform + security\u002Fprocurement + governance",[2042,2043],"May this agent execute this action?","Application owner + authorization\u002Fbusiness-policy owner",[2045,2046],"Is quality sufficient for deployment?","Product\u002Ftechnical owner against defined acceptance criteria",[2048,2049],"Can residual risk be accepted?","Named risk owner at appropriate authority level",[2051,2052],"Can an exception be granted?","Explicit exception authority, time-bounded and documented",[2054,2055],"Should the system be suspended?","Operational\u002Fbusiness owner under incident or risk triggers",[2057,2058],"Can a model upgrade go live?","Change owner after regression\u002Fevaluation evidence",{},{"id":595,"data":2061,"type":42,"tunes":2063},{"text":2062,"level":247},"Model governance is more than choosing a model",{},{"id":600,"data":2065,"type":218,"tunes":2067},{"text":2066},"Model governance tracks which model is used, for what purpose, under which configuration and evidence. This applies to external APIs, locally hosted models, fine-tuned models and models embedded in third-party software.",{},{"id":605,"data":2069,"type":218,"tunes":2071},{"text":2070},"A model decision should consider capability, evaluation results, cost, latency, data handling, provider terms, lifecycle support, geographic\u002Fhosting constraints, security, fallback behavior and the consequences of version change.",{},{"id":610,"data":2073,"type":218,"tunes":2075},{"text":2074},"Model aliases such as “latest” can be operationally convenient but weaken reproducibility if behavior changes without a governed release process. Consequential systems benefit from explicit version tracking and regression evaluation.",{},{"id":615,"data":2077,"type":42,"tunes":2079},{"text":2078,"level":247},"Provider governance is a separate dependency layer",{},{"id":620,"data":2081,"type":218,"tunes":2083},{"text":2082},"Two systems using the same model family can have different governance risk if one runs locally and another sends data to an external provider. Provider governance covers contractual terms, processing location, retention, logging, sub-processors, availability, deprecation and exit strategy.",{},{"id":625,"data":2085,"type":218,"tunes":2087},{"text":2086},"Provider abstraction can reduce technical lock-in, but it does not remove governance work. Swapping providers can change data flows, model behavior, security assumptions, cost and compliance obligations.",{},{"id":630,"data":2089,"type":218,"tunes":2091},{"text":2090},"An approved provider list should therefore not be interpreted as “every model and every data class from this provider is automatically approved.” Approval needs scope.",{},{"id":635,"data":2093,"type":42,"tunes":2095},{"text":2094,"level":247},"Data governance remains the Source-of-Truth layer",{},{"id":640,"data":2097,"type":218,"tunes":2099},{"text":2098},"AI governance does not make the model the authority for organizational facts. Data governance still determines ownership, classification, retention, quality and permitted use of source data.",{},{"id":645,"data":2101,"type":218,"tunes":2103},{"text":2102},"For RAG and agents, governance should identify which sources are authoritative, which are advisory, how provenance is preserved, which data may enter model context and which tenant\u002Fuser boundaries must be enforced.",{},{"id":650,"data":2105,"type":218,"tunes":2107},{"text":2106},"Generated outputs create new data-governance questions as well: whether prompts and responses are retained, who may access traces, whether generated summaries become records and how derived embeddings or indexes are deleted when source data is removed.",{},{"id":655,"data":2109,"type":42,"tunes":2111},{"text":2110,"level":247},"Permissions are governance decisions with runtime enforcement",{},{"id":660,"data":2113,"type":218,"tunes":2115},{"text":2114},"Agentic AI makes permissions a first-class governance object. The organization needs to decide which tools, files, APIs, databases and side effects each agent or user may access.",{},{"id":665,"data":2117,"type":218,"tunes":2119},{"text":2118},"Governance defines the policy and approval logic; the trusted runtime enforces it. Natural-language instructions such as “do not delete files” are not a substitute for filesystem, API or service authorization.",{},{"id":670,"data":2121,"type":218,"tunes":2123},{"text":2122},"The same principle applies to tenant isolation: a role can authorize an operation while tenant scope constrains which customer's resources that operation may reach.",{},{"id":675,"data":2125,"type":42,"tunes":2127},{"text":2126,"level":247},"Risk classification should change the control set",{},{"id":680,"data":2129,"type":218,"tunes":2131},{"text":2130},"Not every AI system needs the same review depth. Governance becomes scalable when risk classification changes the evidence, approval and monitoring requirements.",{},{"id":685,"data":2133,"type":377,"tunes":2171},{"content":2134,"stretched":43,"withHeadings":14},[2135,2139,2143,2147,2151,2155,2159,2163,2167],[2136,2137,2138],"Risk driver","Lower-control example","Higher-control example",[2140,2141,2142],"Business consequence","Draft internal text","Approve financial settlement",[2144,2145,2146],"Human impact","Optional writing aid","Employment or eligibility decision support",[2148,2149,2150],"Data sensitivity","Public documentation","Health, HR, financial or confidential data",[2152,2153,2154],"Autonomy","Read-only recommendation","Agent with write\u002Fpayment\u002Fdeployment tools",[2156,2157,2158],"Reversibility","Easily regenerated summary","Irreversible external transaction",[2160,2161,2162],"Exposure","Small internal pilot","Public\u002Fcustomer-facing system at scale",[2164,2165,2166],"Source authority","Advisory content","System relied on for regulated or contractual fact",[2168,2169,2170],"Failure detectability","Obvious formatting defect","Plausible but materially wrong recommendation",{},{"id":726,"data":2173,"type":218,"tunes":2175},{"text":2174},"The classification method can be simple or sophisticated, but it should map to concrete consequences: more testing, narrower permissions, required human oversight, security review, executive risk acceptance or deployment prohibition.",{},{"id":731,"data":2177,"type":42,"tunes":2179},{"text":2178,"level":247},"Governance must preserve use-case context",{},{"id":736,"data":2181,"type":218,"tunes":2183},{"text":2182},"NIST's MAP function emphasizes intended purpose, users, deployment context, assumptions, impacts and applicable laws or norms. This matters because the same model can be low risk in one use case and high consequence in another.",{},{"id":741,"data":2185,"type":218,"tunes":2187},{"text":2186},"Governance records should therefore classify the application, not only the model. “We use model X” is not enough to determine risk.",{},{"id":746,"data":2189,"type":218,"tunes":2191},{"text":2190},"The relevant governance object is the system\u002Fuse case: model + data + context + tools + users + deployment environment + business process.",{},{"id":751,"data":2193,"type":42,"tunes":2195},{"text":2194,"level":247},"Evaluation is governance evidence",{},{"id":756,"data":2197,"type":218,"tunes":2199},{"text":2198},"An AI governance process should not approve deployment based only on vendor benchmarks or a successful demo. The system needs evidence tied to its actual intended use.",{},{"id":761,"data":2201,"type":218,"tunes":2203},{"text":2202},"Useful evidence can include task-success evaluation, retrieval quality, factual grounding, security tests, permission tests, adversarial scenarios, human-review studies, latency\u002Fcost, robustness and regression comparisons.",{},{"id":766,"data":2205,"type":218,"tunes":2207},{"text":2206},"NIST's MEASURE function makes this explicit: organizations should identify and apply appropriate methods and metrics for risks identified during mapping, while documenting risks that cannot or will not be measured.",{},{"id":771,"data":2209,"type":226,"tunes":2212},{"body":2210,"title":2211,"variant":775},"“The team thinks the model is good enough” is a weak approval artifact. “The system met defined acceptance criteria on representative tests, with these known limitations and residual risks” is governable.","A governance gate should ask for evidence, not confidence",{},{"id":778,"data":2214,"type":42,"tunes":2216},{"text":2215,"level":247},"Governance gates should exist across the lifecycle",{},{"id":783,"data":2218,"type":320,"tunes":2245},{"steps":2219,"title":2244,"orientation":319},[2220,2223,2226,2229,2232,2235,2238,2241],{"label":2221,"description":2222},"Idea \u002F discovery gate","Confirm business purpose, owner and whether AI is an appropriate solution.",{"label":2224,"description":2225},"Architecture gate","Review model\u002Fprovider, data flow, identity, permissions, isolation and operational design.",{"label":2227,"description":2228},"Risk\u002Fcompliance gate","Classify risk and applicable obligations; define required controls.",{"label":2230,"description":2231},"Validation gate","Require evidence that functional, safety, security and quality criteria are met.",{"label":2233,"description":2234},"Deployment gate","Approve concrete configuration, version, environment and operational owner.",{"label":2236,"description":2237},"Change gate","Re-evaluate model\u002Fprovider\u002Ftool\u002Fdata changes according to materiality.",{"label":2239,"description":2240},"Incident gate","Pause, restrict or roll back when defined risk triggers occur.",{"label":2242,"description":2243},"Retirement gate","Remove access, data derivatives, credentials and obsolete dependencies cleanly.","Example lifecycle gates",{},{"id":813,"data":2247,"type":42,"tunes":2249},{"text":2248,"level":247},"Change management is central to AI governance",{},{"id":818,"data":2251,"type":218,"tunes":2253},{"text":2252},"AI systems change even when application code does not. Providers update models, safety filters, context limits, pricing, policies and infrastructure. Retrieval corpora change. Agent tools gain permissions. Regulations and contracts evolve.",{},{"id":823,"data":2255,"type":218,"tunes":2257},{"text":2256},"Governance should therefore define material-change triggers. A minor prompt wording adjustment may need ordinary regression tests; replacing the model, enabling write tools or introducing sensitive data may require a new approval gate.",{},{"id":828,"data":2259,"type":218,"tunes":2261},{"text":2260},"The governance record should preserve which version was approved and what conditions made the approval valid.",{},{"id":833,"data":2263,"type":42,"tunes":2265},{"text":2264,"level":247},"Exceptions need owners, expiry and compensating controls",{},{"id":838,"data":2267,"type":218,"tunes":2269},{"text":2268},"Real organizations need exceptions. A team may need an unapproved model for a time-bounded experiment, or a legacy system may not yet meet a new logging requirement.",{},{"id":843,"data":2271,"type":218,"tunes":2273},{"text":2272},"The dangerous pattern is a permanent undocumented exception. Governable exceptions specify owner, rationale, scope, residual risk, compensating control, expiration date and review condition.",{},{"id":848,"data":2275,"type":218,"tunes":2277},{"text":2276},"Exception handling should be part of the normal governance system rather than an informal side channel.",{},{"id":853,"data":2279,"type":42,"tunes":2281},{"text":2280,"level":247},"Auditability is the ability to reconstruct the decision and execution",{},{"id":858,"data":2283,"type":218,"tunes":2285},{"text":2284},"AI auditability is not merely storing model prompts. It means being able to reconstruct which system version was used, which data and permissions applied, who approved the configuration, what evaluations supported deployment and what happened during relevant execution.",{},{"id":863,"data":2287,"type":218,"tunes":2289},{"text":2288},"For an agent, this may require principal identity, tool calls, approvals, target resources, state changes and outcomes. For RAG, it may require corpus\u002Findex version, retrieval query, selected evidence and provenance. For a model change, it may require the previous and new evaluation results.",{},{"id":868,"data":2291,"type":218,"tunes":2293},{"text":2292},"Audit evidence should be proportionate. Logging every possible token can create privacy and security risk of its own. Governance should define which evidence is necessary, how long it is retained and who may access it.",{},{"id":873,"data":2295,"type":377,"tunes":2321},{"content":2296,"stretched":43,"withHeadings":14},[2297,2300,2303,2306,2309,2312,2315,2318],[2298,2299],"Audit object","Useful evidence",[2301,2302],"Governance decision","Owner, date, decision, conditions, evidence, exceptions",[2304,2305],"Model release","Model\u002Fprovider\u002Fversion, configuration, regression results",[2307,2308],"Data access","Principal, tenant\u002Fscope, source class, policy decision",[2310,2311],"Agent action","Tool, arguments\u002Ftarget, approval, result, state change",[2313,2314],"RAG answer","Corpus\u002Findex version, retrieval set, selected evidence, citations",[2316,2317],"Incident","Trigger, affected systems, containment, decision owner, remediation",[2319,2320],"Retirement","Disabled endpoints, revoked credentials, deleted derived data, archive decision",{},{"id":902,"data":2323,"type":42,"tunes":2325},{"text":2324,"level":247},"Monitoring closes the governance loop",{},{"id":907,"data":2327,"type":218,"tunes":2329},{"text":2328},"Approval is a snapshot. Production monitoring tells governance whether the assumptions behind approval still hold.",{},{"id":912,"data":2331,"type":218,"tunes":2333},{"text":2332},"Useful signals depend on the use case: quality regression, unsafe outputs, tool failures, policy denials, unusual cost, latency, user complaints, drift, retrieval freshness, provider incidents, security alerts or new regulatory classifications.",{},{"id":917,"data":2335,"type":218,"tunes":2337},{"text":2336},"Governance should define thresholds that cause action: investigate, restrict, require human review, roll back, switch provider, suspend or retire.",{},{"id":922,"data":2339,"type":42,"tunes":2341},{"text":2340,"level":247},"AI incidents need a defined operational path",{},{"id":927,"data":2343,"type":218,"tunes":2345},{"text":2344},"AI-specific incidents may involve harmful content, data leakage, unauthorized actions, persistent factual failure, model\u002Fprovider outage, prompt injection, cross-tenant retrieval or unexpected behavior after a model update.",{},{"id":932,"data":2347,"type":218,"tunes":2349},{"text":2348},"The incident process should connect technical response with governance ownership. Someone must be authorized to disable a model, remove a tool, revoke credentials, restrict users, notify affected functions and decide whether the system may return to service.",{},{"id":937,"data":2351,"type":218,"tunes":2353},{"text":2352},"The lessons from incidents should update policies, tests, risk classification and reusable platform controls rather than remain isolated in one team.",{},{"id":942,"data":2355,"type":42,"tunes":2357},{"text":2356,"level":247},"Procurement is part of AI governance",{},{"id":947,"data":2359,"type":218,"tunes":2361},{"text":2360},"Organizations can acquire substantial AI capability through ordinary SaaS procurement. Governance should therefore cover purchased AI features as well as internally engineered systems.",{},{"id":952,"data":2363,"type":218,"tunes":2365},{"text":2364},"Vendor review can include data use, retention, model training policy, sub-processors, security, incident notification, export\u002Fdeletion, geographic processing, version change, service continuity and contractual exit.",{},{"id":957,"data":2367,"type":218,"tunes":2369},{"text":2368},"A technical architecture review and procurement review should share the same system inventory so commercial approval does not drift away from the actual deployed data flow.",{},{"id":962,"data":2371,"type":42,"tunes":2373},{"text":2372,"level":247},"Human oversight should be designed, not merely declared",{},{"id":967,"data":2375,"type":218,"tunes":2377},{"text":2376},"“Human in the loop” is meaningful only if the human has authority, time, information and a usable intervention mechanism.",{},{"id":972,"data":2379,"type":218,"tunes":2381},{"text":2380},"A reviewer who sees only the AI recommendation but not its evidence, uncertainty or source state may simply rubber-stamp the output. Governance should specify what the reviewer can inspect and what actions are available: approve, reject, edit, escalate or stop.",{},{"id":977,"data":2383,"type":218,"tunes":2385},{"text":2384},"Human oversight should also be risk-based. Low-consequence systems may use sampling or post-hoc review, while high-consequence side effects may require approval before execution.",{},{"id":982,"data":2387,"type":42,"tunes":2389},{"text":2388,"level":247},"Platform governance and use-case governance are different",{},{"id":987,"data":2391,"type":385,"tunes":2411},{"rows":2392,"title":2405,"layout":377,"columns":2406},[2393,2396,2399,2402],{"id":991,"label":2394,"values":2395},"Primary concern",[355,355],{"id":995,"label":2397,"values":2398},"Typical approval",[355,355],{"id":999,"label":2400,"values":2401},"Evidence",[355,355],{"id":1003,"label":2403,"values":2404},"Governance failure",[355,355],"Two governance levels",[2407,2409],{"id":1009,"label":2408},"Shared AI platform",{"id":1012,"label":2410},"Individual AI use case",{},{"id":1016,"data":2413,"type":218,"tunes":2415},{"text":2414},"Platform approval should therefore reduce repeated work, not eliminate use-case accountability. “The model is approved” is different from “this application of the model is approved.”",{},{"id":1021,"data":2417,"type":42,"tunes":2419},{"text":2418,"level":247},"AI governance and Enterprise AI Architecture",{},{"id":1026,"data":2421,"type":218,"tunes":2423},{"text":2422},"Enterprise AI Architecture describes how AI systems, platforms, data, identities, providers, operations and organizational systems fit together. AI governance describes the decision and control system that determines how those architectures may be created and changed.",{},{"id":1031,"data":2425,"type":218,"tunes":2427},{"text":2426},"The two are tightly coupled. Governance without architecture can become abstract policy. Architecture without governance can produce technically elegant systems with unclear ownership, uncontrolled provider adoption or unreviewed risk.",{},{"id":1036,"data":2429,"type":218,"tunes":2431},{"text":2430},"The strongest design is bidirectional: governance requirements become architecture controls, while architecture exposes the real decisions that governance must own.",{},{"id":1041,"data":2433,"type":42,"tunes":2435},{"text":2434,"level":247},"Original project evidence",{},{"id":1046,"data":2437,"type":42,"tunes":2439},{"text":2438,"level":246},"Enterprise Aaasaasa 0.1: governance as delivery structure",{},{"id":1051,"data":2441,"type":226,"tunes":2444},{"body":2442,"title":2443,"variant":240},"Enterprise Aaasaasa 0.1 is project and training\u002FPoC evidence, not evidence of commercial enterprise adoption. It is useful here because its delivery structure explicitly connects architecture, milestones, risks, stakeholders, validation and project decisions.","Project \u002F PoC evidence",{},{"id":1057,"data":2446,"type":218,"tunes":2448},{"text":2447},"Enterprise Aaasaasa 0.1 uses defined milestones for requirements, architecture, prototype, validation and project closure. That structure illustrates a core governance principle: lifecycle transitions should have explicit outputs and decision points instead of an informal “build first, review later” process.",{},{"id":1062,"data":2450,"type":218,"tunes":2452},{"text":2451},"The project also tracks risks such as scope creep, architecture delay and AI\u002FGDPR concerns and identifies stakeholder groups including sponsorship, steering, architecture, security, marketing, external APIs and hosting.",{},{"id":1067,"data":2454,"type":218,"tunes":2456},{"text":2455},"This does not constitute an ISO\u002FIEC 42001 management system. It is narrower project evidence showing how ownership, risk, milestones and validation can be integrated into technical delivery.",{},{"id":1072,"data":2458,"type":42,"tunes":2460},{"text":2459,"level":246},"SenseFlow: requirements and decision traceability",{},{"id":1077,"data":2462,"type":218,"tunes":2464},{"text":2463},"SenseFlow uses a structured path from product goal and user need through epics, user stories, acceptance criteria, architecture, implementation and validation. Decision records preserve the decision, rationale, alternatives, trade-offs, status and date\u002Fversion.",{},{"id":1082,"data":2466,"type":218,"tunes":2468},{"text":2467},"That traceability pattern is directly relevant to governance because an AI control should connect to the requirement or risk that justified it. A governance system becomes stronger when the chain from business need to architecture decision to validation evidence can be reconstructed.",{},{"id":1087,"data":2470,"type":42,"tunes":2472},{"text":2471,"level":246},"Aaasaasa AI Client: permissions and runtime as governed configuration",{},{"id":1092,"data":2474,"type":218,"tunes":2476},{"text":2475},"Aaasaasa AI Client separates provider, model, runtime location and permissions rather than treating them as one “AI setting.” Central workspace permission profiles govern tool access, Direct Chat has no filesystem\u002Fshell tools, and agent-capable runtimes operate under explicit permission profiles.",{},{"id":1097,"data":2478,"type":218,"tunes":2480},{"text":2479},"That separation demonstrates an important governance pattern: model choice and action authority should be independent configuration objects. A stronger model does not automatically receive broader filesystem, shell or business permissions.",{},{"id":1102,"data":2482,"type":218,"tunes":2484},{"text":2483},"The implementation evidence is architectural, not a claim that the application constitutes a certified organizational AI governance system.",{},{"id":1107,"data":2486,"type":377,"tunes":2512},{"content":2487,"stretched":43,"withHeadings":14},[2488,2491,2494,2497,2500,2503,2506,2509],[2489,2490],"Observed project pattern","Governance lesson",[2492,2493],"Milestone gates","Lifecycle transitions can require explicit evidence",[2495,2496],"Risk register","Known uncertainties become managed objects rather than informal concerns",[2498,2499],"Stakeholder mapping","Decision responsibility can be distributed deliberately",[2501,2502],"Acceptance criteria + validation","Deployment decisions can depend on evidence",[2504,2505],"Decision records","Architecture trade-offs remain traceable",[2507,2508],"Separate model\u002Fprovider\u002Fruntime\u002Fpermissions","Capability and authority can be governed independently",[2510,2511],"Explicit project maturity labels","PoC evidence is not misrepresented as production or market proof",{},{"id":1136,"data":2514,"type":42,"tunes":2516},{"text":2515,"level":247},"Common AI governance failure modes",{},{"id":1141,"data":2518,"type":377,"tunes":2562},{"content":2519,"stretched":43,"withHeadings":14},[2520,2523,2526,2529,2532,2535,2538,2541,2544,2547,2550,2553,2556,2559],[2521,2522],"Failure mode","What goes wrong",[2524,2525],"Governance is only a policy PDF","Teams cannot translate policy into runtime controls or deployment decisions",[2527,2528],"No AI inventory","The organization cannot identify where models, agents or embedded AI are used",[2530,2531],"Model approval is treated as use-case approval","An approved model is used for a materially different risk context",[2533,2534],"No named business owner","Technical teams inherit business-risk decisions by default",[2536,2537],"Risk classification has no control consequence","Every system receives the same review regardless of consequence",[2539,2540],"Permissions live only in prompts","Model instructions become a substitute for real authorization",[2542,2543],"Provider change is invisible","Behavior\u002Fdata\u002Fcompliance assumptions change without re-evaluation",[2545,2546],"Demo success is approval evidence","Production risk is inferred from a small happy-path test",[2548,2549],"Human oversight is ceremonial","Reviewer cannot inspect evidence or stop the action",[2551,2552],"Exception has no expiry","Temporary workaround becomes permanent governance debt",[2554,2555],"Logs exist but cannot reconstruct decisions","Auditability is confused with raw data retention",[2557,2558],"Compliance owns governance alone","Product, engineering, security and operations disengage from accountability",[2560,2561],"Every decision goes to a central board","Governance becomes a bottleneck instead of a scalable control system",{},{"id":1188,"data":2564,"type":42,"tunes":2566},{"text":2565,"level":247},"Central governance does not mean centralizing every decision",{},{"id":1193,"data":2568,"type":218,"tunes":2570},{"text":2569},"A mature organization can centralize policy, control patterns and escalation while delegating low-risk decisions to product or platform teams.",{},{"id":1198,"data":2572,"type":218,"tunes":2574},{"text":2573},"This federated model scales better than requiring a central committee to approve every prompt change. The central function defines risk tiers, mandatory controls, provider policy, exception authority and audit requirements; teams operate autonomously inside those boundaries.",{},{"id":1203,"data":2576,"type":218,"tunes":2578},{"text":2577},"The design objective is consistent accountability, not maximum centralization.",{},{"id":1208,"data":2580,"type":42,"tunes":2582},{"text":2581,"level":247},"Govern the governance system itself",{},{"id":1213,"data":2584,"type":218,"tunes":2586},{"text":2585},"Governance needs feedback. Otherwise controls can become expensive rituals that do not reduce risk.",{},{"id":1218,"data":2588,"type":377,"tunes":2620},{"content":2589,"stretched":43,"withHeadings":14},[2590,2593,2596,2599,2602,2605,2608,2611,2614,2617],[2591,2592],"Metric \u002F signal","What it can reveal",[2594,2595],"Inventory coverage","Whether AI adoption is visible to governance",[2597,2598],"Time to decision","Whether governance blocks delivery unnecessarily",[2600,2601],"Exception count and age","Whether policies are realistic or routinely bypassed",[2603,2604],"Evaluation failure rate","Whether pre-deployment controls catch defects",[2606,2607],"Post-deployment incident rate","Whether approval evidence predicts production behavior",[2609,2610],"Unauthorized-tool denial rate","Whether permission boundaries are actively exercised",[2612,2613],"Model\u002Fprovider change frequency","How often approved assumptions may become stale",[2615,2616],"Retired-but-active systems","Lifecycle cleanup\u002Fcontrol failure",[2618,2619],"Repeated incident patterns","Whether lessons are becoming reusable platform controls",{},{"id":1253,"data":2622,"type":218,"tunes":2624},{"text":2623},"Governance metrics should not reward paperwork volume. The useful measure is whether decision quality, traceability, risk detection and safe delivery improve.",{},{"id":1258,"data":2626,"type":42,"tunes":2628},{"text":2627,"level":247},"A practical AI governance implementation sequence",{},{"id":1263,"data":2630,"type":320,"tunes":2669},{"steps":2631,"title":2668,"orientation":319},[2632,2635,2638,2641,2644,2647,2650,2653,2656,2659,2662,2665],{"label":2633,"description":2634},"1. Define governance scope","Decide which internally built, purchased, embedded and experimental AI systems are covered.",{"label":2636,"description":2637},"2. Create the AI inventory","Capture owners, use cases, models\u002Fproviders, data, tools, users, lifecycle state and risk class.",{"label":2639,"description":2640},"3. Define decision rights","Name who can approve providers, data use, risk acceptance, exceptions, deployment and retirement.",{"label":2642,"description":2643},"4. Establish risk tiers","Map consequence and exposure to different control requirements.",{"label":2645,"description":2646},"5. Define reusable minimum controls","Set baseline requirements for identity, permissions, data, security, evaluation, logging and human oversight.",{"label":2648,"description":2649},"6. Connect governance to architecture","Turn policy into platform\u002Fruntime controls that teams cannot accidentally bypass.",{"label":2651,"description":2652},"7. Build evidence-based gates","Require relevant evaluation, security, privacy, architecture and compliance evidence before lifecycle transitions.",{"label":2654,"description":2655},"8. Govern model\u002Fprovider change","Track versions, deprecations and material changes with regression evidence.",{"label":2657,"description":2658},"9. Add monitoring and incident triggers","Define which production signals force investigation, restriction or suspension.",{"label":2660,"description":2661},"10. Formalize exceptions","Require scope, owner, residual risk, compensating controls and expiry.",{"label":2663,"description":2664},"11. Audit decisions and execution","Retain proportionate evidence that links owners, configuration, permissions, evaluations and significant actions.",{"label":2666,"description":2667},"12. Improve the governance system","Use incidents, delays and repeated exceptions to revise controls and platform patterns.","Build governance from visibility to control",{},{"id":1305,"data":2671,"type":42,"tunes":2673},{"text":2672,"level":247},"AI governance checklist",{},{"id":1310,"data":2675,"type":377,"tunes":2725},{"content":2676,"stretched":43,"withHeadings":14},[2677,2680,2683,2686,2689,2692,2695,2698,2701,2704,2707,2710,2713,2716,2719,2722],[2678,2679],"Question","Expected governance evidence",[2681,2682],"Why does this AI system exist?","Purpose, business owner and intended outcome",[2684,2685],"Who owns technical operation?","Named technical\u002Fplatform owner",[2687,2688],"Which model\u002Fprovider\u002Fversion is used?","Registered and versioned dependency",[2690,2691],"Which data may enter the system?","Classification, authority and permitted-use decision",[2693,2694],"Which identities may use it?","Authentication and authorization model",[2696,2697],"Which actions may it perform?","Tool\u002Fpermission matrix and autonomy boundary",[2699,2700],"What is the risk tier?","Documented classification with rationale",[2702,2703],"Which controls are mandatory?","Risk-tier control baseline",[2705,2706],"How was it evaluated?","Representative tests and acceptance criteria",[2708,2709],"Who accepted residual risk?","Named accountable authority",[2711,2712],"What requires human review?","Explicit oversight\u002Fapproval rules",[2714,2715],"What gets logged?","Audit\u002Fobservability policy proportional to consequence",[2717,2718],"What triggers re-review?","Model\u002Fprovider\u002Fdata\u002Ftool\u002Fregulatory\u002Fmaterial-change events",[2720,2721],"How can it be suspended?","Operational kill\u002Frestriction path and owner",[2723,2724],"How is it retired?","Credential, data, derivative, endpoint and record cleanup",{},{"id":1363,"data":2727,"type":42,"tunes":2729},{"text":2728,"level":247},"Common misconceptions",{},{"id":1368,"data":2731,"type":377,"tunes":2766},{"content":2732,"stretched":43,"withHeadings":14},[2733,2736,2739,2742,2745,2748,2751,2754,2757,2760,2763],[2734,2735],"Misconception","Correction",[2737,2738],"“AI governance is compliance.”","Compliance is one governance input; governance also covers ownership, architecture, permissions, quality, risk and lifecycle decisions.",[2740,2741],"“Governance means a review committee.”","Committees can approve exceptions or high-risk systems, but many controls should be embedded in normal delivery and platform architecture.",[2743,2744],"“An approved model is safe for every use.”","Risk belongs to the use case and system context, not only the model.",[2746,2747],"“A vendor handles governance for us.”","A provider controls part of the stack; the organization still owns its use case, data, permissions and business consequences.",[2749,2750],"“Human-in-the-loop automatically solves risk.”","Oversight only works when reviewers have authority, context and intervention capability.",[2752,2753],"“Logging everything gives auditability.”","Auditability requires reconstructable relevant evidence with controlled retention and access.",[2755,2756],"“Governance blocks innovation.”","Poor governance can block delivery; well-designed governance creates reusable safe paths and clearer decision ownership.",[2758,2759],"“Low-risk pilots need no governance.”","They can use lightweight governance, but inventory, ownership and data\u002Ftool boundaries still matter.",[2761,2762],"“Local AI needs less governance.”","Local hosting can change privacy\u002Fprovider risk, but model quality, permissions, security and lifecycle governance remain.",[2764,2765],"“Once approved, the system stays approved.”","Model, provider, data, regulation and use can change; governance decisions need review triggers.",{},{"id":1406,"data":2768,"type":42,"tunes":2770},{"text":2769,"level":247},"Edge cases and limitations",{},{"id":1411,"data":2772,"type":218,"tunes":2774},{"text":2773},"Very small organizations may not need a dedicated AI governance function. The same principles can be implemented through lightweight architecture decisions, risk registers, owner mappings and release gates.",{},{"id":1416,"data":2776,"type":218,"tunes":2778},{"text":2777},"Highly regulated organizations may need much more formal governance, independent assurance, documented conformity processes and legal interpretation than this architecture-level article describes.",{},{"id":1421,"data":2780,"type":218,"tunes":2782},{"text":2781},"Open-source and self-hosted models reduce some provider dependencies but create others: patching, model provenance, evaluation, infrastructure security, licensing and operational ownership.",{},{"id":1426,"data":2784,"type":218,"tunes":2786},{"text":2785},"General-purpose AI models can be used across many contexts. Governance should avoid assuming that provider-level model controls fully determine downstream application risk.",{},{"id":1431,"data":2788,"type":218,"tunes":2790},{"text":2789},"No governance framework guarantees that an AI system is safe or correct. Governance improves accountability and decision quality; technical validation, monitoring and human judgment remain necessary.",{},{"id":1436,"data":2792,"type":42,"tunes":2794},{"text":2793,"level":247},"What would change this answer?",{},{"id":1441,"data":2796,"type":218,"tunes":2798},{"text":2797},"The exact control set changes with law, industry, organization size, data sensitivity, autonomy, deployment model and business consequence.",{},{"id":1446,"data":2800,"type":218,"tunes":2802},{"text":2801},"NIST is currently revising AI RMF 1.0, so future NIST terminology or recommended practices may change. ISO standards can also be revised, and EU AI Act guidance and transition details continue to evolve.",{},{"id":1451,"data":2804,"type":218,"tunes":2806},{"text":2805},"The stable architectural principle is that AI decisions need explicit owners, evidence, permissions, risk treatment and lifecycle review rather than being hidden inside model or application configuration.",{},{"id":1456,"data":2808,"type":42,"tunes":2810},{"text":2809,"level":247},"Related canonical knowledge",{},{"id":1461,"data":2812,"type":218,"tunes":2814},{"text":2813},"AI governance depends on concepts already separated elsewhere in this knowledge graph: Source of Truth determines authority, RBAC and tenant isolation constrain access, context engineering controls model-visible information, and agentic architecture defines how tools and actions enter an execution loop.",{},{"id":1466,"data":2816,"type":218,"tunes":2818},{"text":2817},"Enterprise AI Architecture is the parent organizational architecture concept. Governance is the operating control layer that determines how those enterprise AI components may be introduced, changed and retired.",{},{"id":1471,"data":2820,"type":218,"tunes":2822},{"text":2821},"Agentic systems increase governance requirements because model decisions can become real side effects. Permission, approval and audit controls must therefore exist outside the model itself.",{},{"id":1476,"data":2824,"type":1482,"tunes":2829},{"url":2825,"title":2826,"excerpt":2827,"ctaLabel":2828},"https:\u002F\u002Fstajic.de\u002Fblog\u002Fai-agent-reliability-why-the-final-answer-is-not-enough","AI Agent Reliability: Why the Final Answer Is Not Enough","Agent governance requires evidence about execution trajectories, tool use, state changes and recoverability — not only final output quality.","Read the agent reliability article",{},{"id":1485,"data":2831,"type":1482,"tunes":2836},{"url":2832,"title":2833,"excerpt":2834,"ctaLabel":2835},"https:\u002F\u002Fstajic.de\u002Fblog\u002Fai-agent-memory-is-not-rag-how-to-separate-memory-retrieval-state-and-context","AI Agent Memory Is Not RAG: How to Separate Memory, Retrieval, State and Context","Governance needs different policies for durable memory, authoritative state, retrieved information and temporary model context.","Read the memory architecture article",{},{"id":1493,"data":2838,"type":1482,"tunes":2843},{"url":2839,"title":2840,"excerpt":2841,"ctaLabel":2842},"https:\u002F\u002Fstajic.de\u002Fblog\u002Fthe-answer-validity-boundary-the-missing-layer-between-relevance-and-reliable-ai-answers","The Answer Validity Boundary: The Missing Layer Between Relevance and Reliable AI Answers","Governance decisions should preserve the conditions under which evidence and approval remain valid, including version, scope, source and time.","Read the Answer Validity Boundary",{},{"id":1501,"data":2845,"type":42,"tunes":2847},{"text":2846,"level":247},"Frequently asked questions",{},{"id":1506,"data":2849,"type":1506,"tunes":2879},{"items":2850,"title":2878},[2851,2854,2857,2860,2863,2866,2869,2872,2875],{"id":1510,"answer":2852,"question":2853},"AI governance is the system of ownership, decision rights, controls and evidence used to manage how AI systems are developed, acquired, deployed, operated, changed and retired.","What is AI governance?",{"id":1514,"answer":2855,"question":2856},"No. Risk management identifies, assesses and treats risk. Governance defines who must do that work, which decisions require it and what evidence or authority is required.","Is AI governance the same as AI risk management?",{"id":1518,"answer":2858,"question":2859},"No. Compliance concerns applicable legal, regulatory, contractual or internal obligations. Governance integrates compliance with architecture, security, data, quality, permissions and business ownership.","Is AI governance the same as compliance?",{"id":1522,"answer":2861,"question":2862},"Enterprise AI Architecture defines how AI capabilities and systems fit into the organization. AI governance defines the decision and control system governing how those components may be introduced, operated and changed.","What is the difference between AI governance and Enterprise AI Architecture?",{"id":1526,"answer":2864,"question":2865},"Yes, but not necessarily a dedicated department. Lightweight inventory, ownership, permissions, evaluation and change controls can implement the same principles.","Do small companies need AI governance?",{"id":1530,"answer":2867,"question":2868},"At minimum: use case, owners, model\u002Fprovider\u002Fversion, data classes, users, tools\u002Factions, permissions, risk classification, evaluation status, lifecycle state and review triggers.","What should an AI inventory contain?",{"id":1534,"answer":2870,"question":2871},"No. Risk depends on the application context: data, users, tools, autonomy, consequences and business process.","Does using an approved model mean a use case is approved?",{"id":1538,"answer":2873,"question":2874},"The organization can reconstruct relevant ownership, approved configuration, model\u002Fprovider\u002Fversion, data\u002Fpermission context, evaluation evidence, significant actions and lifecycle decisions.","What makes an AI system auditable?",{"id":1542,"answer":2876,"question":2877},"Use risk-based review intervals plus event triggers such as model\u002Fprovider changes, new data, new tools, incidents, material performance change or regulatory updates.","How often should AI governance decisions be reviewed?","AI governance FAQ",{},{"id":1548,"data":2881,"type":42,"tunes":2883},{"text":2882,"level":247},"Glossary",{},{"id":1553,"data":2885,"type":1553,"tunes":2922},{"title":2886,"entries":2887},"Key AI governance terms",[2888,2890,2893,2896,2899,2901,2904,2907,2910,2913,2916,2919],{"term":1875,"anchor":1558,"definition":2889},"Organizational system of ownership, decision rights, controls and evidence governing the AI lifecycle.",{"term":2891,"anchor":1562,"definition":2892},"AI management system","Interrelated organizational policies, objectives and processes for responsible development, provision or use of AI; ISO\u002FIEC 42001 specifies requirements for such a system.",{"term":2894,"anchor":1566,"definition":2895},"AI inventory","Registry of AI systems, models, providers, use cases, owners, data, risk classifications and lifecycle state.",{"term":2897,"anchor":1570,"definition":2898},"Risk owner","Named authority accountable for deciding how a defined risk is treated or whether residual risk is accepted.",{"term":1573,"anchor":1574,"definition":2900},"Technical, organizational or procedural measure intended to prevent, detect, reduce or respond to risk.",{"term":2902,"anchor":1578,"definition":2903},"Governance gate","Lifecycle decision point at which defined evidence and authority are required before proceeding.",{"term":2905,"anchor":1582,"definition":2906},"Residual risk","Risk that remains after controls or mitigation have been applied.",{"term":2908,"anchor":1586,"definition":2909},"Exception","Explicit, scoped and usually time-bounded authorization to deviate from a normal governance requirement.",{"term":2911,"anchor":1590,"definition":2912},"Auditability","Ability to reconstruct relevant decisions, configurations, evidence, identities and execution events.",{"term":2914,"anchor":1594,"definition":2915},"Model governance","Controls and decisions covering model selection, versioning, evaluation, permitted use, change and retirement.",{"term":2917,"anchor":1598,"definition":2918},"Provider governance","Controls covering external or internal AI provider dependencies, data handling, security, contracts, lifecycle and exit.",{"term":2920,"anchor":1602,"definition":2921},"Human oversight","Designed human review or intervention capability for AI decisions or actions at defined points.",{},{"id":1606,"data":2924,"type":42,"tunes":2926},{"text":2925,"level":247},"Conclusion",{},{"id":1611,"data":2928,"type":218,"tunes":2930},{"text":2929},"AI governance is the organizational control plane around AI. It gives names and evidence to decisions that otherwise remain hidden inside code, provider settings, prompts or informal team judgment.",{},{"id":1616,"data":2932,"type":218,"tunes":2934},{"text":2933},"Strong governance connects the complete system: business purpose, models, providers, data authority, identity, permissions, evaluation, risk, compliance, monitoring, incidents, change and retirement.",{},{"id":1621,"data":2936,"type":218,"tunes":2938},{"text":2937},"The practical goal is not maximum process. It is the minimum governance structure that makes important AI decisions owned, evidence-based, enforceable, reviewable and auditable throughout the lifecycle.",{},{"id":1626,"data":2940,"type":42,"tunes":2942},{"text":2941,"level":247},"Primary sources and current references",{},{"id":1631,"data":2944,"type":218,"tunes":2946},{"text":2945},"The sources below provide current external grounding for AI management, risk and regulation. Project sections are original implementation\u002Fproject evidence and are explicitly distinguished from formal standards or certified governance systems.",{},{"id":1636,"data":2948,"type":1643,"tunes":2953},{"link":1638,"meta":2949},{"image":2950,"title":2951,"description":2952},{"url":355},"NIST — AI Risk Management Framework","Current NIST hub for AI RMF 1.0, the ongoing revision, the GenAI Profile and related risk-management resources.",{},{"id":1646,"data":2955,"type":1643,"tunes":2960},{"link":1648,"meta":2956},{"image":2957,"title":2958,"description":2959},{"url":355},"NIST AIRC — AI RMF Core","Official AI RMF Core describing GOVERN, MAP, MEASURE and MANAGE, with GOVERN as a cross-cutting lifecycle function.",{},{"id":1655,"data":2962,"type":1643,"tunes":2967},{"link":1657,"meta":2963},{"image":2964,"title":2965,"description":2966},{"url":355},"NIST — AI RMF Playbook","Suggested actions for operationalizing trustworthiness and risk management across the AI lifecycle.",{},{"id":1664,"data":2969,"type":1643,"tunes":2974},{"link":1666,"meta":2970},{"image":2971,"title":2972,"description":2973},{"url":355},"NIST AI 600-1 — Generative AI Profile","NIST companion profile applying AI RMF concepts to generative-AI risks and lifecycle management.",{},{"id":1673,"data":2976,"type":1643,"tunes":2981},{"link":1675,"meta":2977},{"image":2978,"title":2979,"description":2980},{"url":355},"ISO\u002FIEC 42001:2023 — AI management systems","International standard specifying requirements for establishing, implementing, maintaining and continually improving an AI management system.",{},{"id":1682,"data":2983,"type":1643,"tunes":2988},{"link":1684,"meta":2984},{"image":2985,"title":2986,"description":2987},{"url":355},"ISO\u002FIEC 23894:2023 — AI risk management","International guidance for integrating AI-specific risk management into organizational activities and functions.",{},{"id":1691,"data":2990,"type":1643,"tunes":2995},{"link":1693,"meta":2991},{"image":2992,"title":2993,"description":2994},{"url":355},"European Commission — AI Act","Current Commission overview of the EU AI Act, application timeline and implementation framework.",{},{"id":1700,"data":2997,"type":1643,"tunes":3002},{"link":1702,"meta":2998},{"image":2999,"title":3000,"description":3001},{"url":355},"European Commission — Navigating the AI Act","Current FAQ covering governance, enforcement, implementation and the evolving application timeline.",{},{"id":1709,"data":3004,"type":1643,"tunes":3009},{"link":1711,"meta":3005},{"image":3006,"title":3007,"description":3008},{"url":355},"European Commission — General-purpose AI obligations","Current overview of documentation, copyright, training-content and systemic-risk obligations for GPAI providers.",{},"2.31.6","AI governance defines who can approve, operate, change and audit AI systems across models, providers, data, permissions, risk, evaluation and the full lifecycle.",{"lang":7,"title":208,"content":210,"contentJson":3013,"excerpt":1718},{"time":212,"blocks":3014,"version":1717},[3015,3018,3021,3024,3027,3030,3033,3036,3039,3042,3045,3048,3051,3054,3066,3069,3072,3075,3078,3081,3100,3103,3106,3109,3112,3115,3125,3128,3131,3134,3137,3140,3143,3146,3149,3152,3170,3173,3176,3179,3182,3185,3199,3202,3205,3208,3211,3214,3217,3220,3223,3226,3229,3232,3235,3238,3241,3244,3247,3250,3253,3266,3269,3272,3275,3278,3281,3284,3287,3290,3293,3296,3299,3311,3314,3317,3320,3323,3326,3329,3332,3335,3338,3341,3344,3347,3359,3362,3365,3368,3371,3374,3377,3380,3383,3386,3389,3392,3395,3398,3401,3404,3407,3410,3425,3428,3431,3434,3437,3440,3443,3446,3449,3452,3455,3458,3461,3464,3467,3470,3473,3476,3479,3491,3494,3512,3515,3518,3521,3524,3527,3530,3544,3547,3550,3566,3569,3589,3592,3607,3610,3613,3616,3619,3622,3625,3628,3631,3634,3637,3640,3643,3646,3649,3652,3655,3658,3661,3674,3677,3693,3696,3699,3702,3705,3708,3711,3716,3721,3726,3731,3736,3741,3746,3751],{"id":215,"data":3016,"type":218,"tunes":3017},{"text":217},{},{"id":221,"data":3019,"type":226,"tunes":3020},{"body":223,"title":224,"variant":225},{},{"id":229,"data":3022,"type":226,"tunes":3023},{"body":231,"title":232,"variant":233},{},{"id":236,"data":3025,"type":226,"tunes":3026},{"body":238,"title":239,"variant":240},{},{"id":243,"data":3028,"type":248,"tunes":3029},{"title":245,"maxLevel":246,"minLevel":247},{},{"id":251,"data":3031,"type":42,"tunes":3032},{"text":253,"level":247},{},{"id":256,"data":3034,"type":218,"tunes":3035},{"text":258},{},{"id":261,"data":3037,"type":218,"tunes":3038},{"text":263},{},{"id":266,"data":3040,"type":218,"tunes":3041},{"text":268},{},{"id":271,"data":3043,"type":42,"tunes":3044},{"text":273,"level":247},{},{"id":276,"data":3046,"type":218,"tunes":3047},{"text":278},{},{"id":281,"data":3049,"type":218,"tunes":3050},{"text":283},{},{"id":286,"data":3052,"type":218,"tunes":3053},{"text":288},{},{"id":291,"data":3055,"type":320,"tunes":3065},{"steps":3056,"title":318,"orientation":319},[3057,3058,3059,3060,3061,3062,3063,3064],{"label":295,"description":296},{"label":298,"description":299},{"label":301,"description":302},{"label":304,"description":305},{"label":307,"description":308},{"label":310,"description":311},{"label":313,"description":314},{"label":316,"description":317},{},{"id":323,"data":3067,"type":42,"tunes":3068},{"text":325,"level":247},{},{"id":328,"data":3070,"type":218,"tunes":3071},{"text":330},{},{"id":333,"data":3073,"type":218,"tunes":3074},{"text":335},{},{"id":338,"data":3076,"type":218,"tunes":3077},{"text":340},{},{"id":343,"data":3079,"type":42,"tunes":3080},{"text":345,"level":247},{},{"id":348,"data":3082,"type":385,"tunes":3099},{"rows":3083,"title":376,"layout":377,"columns":3096},[3084,3086,3088,3090,3092,3094],{"id":352,"label":353,"values":3085},[355,355],{"id":357,"label":358,"values":3087},[355,355],{"id":361,"label":362,"values":3089},[355,355],{"id":365,"label":366,"values":3091},[355,355],{"id":369,"label":370,"values":3093},[355,355],{"id":373,"label":374,"values":3095},[355,355],[3097,3098],{"id":380,"label":381},{"id":383,"label":384},{},{"id":388,"data":3101,"type":42,"tunes":3102},{"text":390,"level":247},{},{"id":393,"data":3104,"type":218,"tunes":3105},{"text":395},{},{"id":398,"data":3107,"type":218,"tunes":3108},{"text":400},{},{"id":403,"data":3110,"type":218,"tunes":3111},{"text":405},{},{"id":408,"data":3113,"type":42,"tunes":3114},{"text":410,"level":247},{},{"id":413,"data":3116,"type":377,"tunes":3124},{"content":3117,"stretched":43,"withHeadings":14},[3118,3119,3120,3121,3122,3123],[417,418,419],[421,422,423],[425,426,427],[429,430,431],[433,434,435],[437,438,439],{},{"id":442,"data":3126,"type":218,"tunes":3127},{"text":444},{},{"id":447,"data":3129,"type":42,"tunes":3130},{"text":449,"level":247},{},{"id":452,"data":3132,"type":218,"tunes":3133},{"text":454},{},{"id":457,"data":3135,"type":218,"tunes":3136},{"text":459},{},{"id":462,"data":3138,"type":226,"tunes":3139},{"body":464,"title":465,"variant":233},{},{"id":468,"data":3141,"type":42,"tunes":3142},{"text":470,"level":247},{},{"id":473,"data":3144,"type":218,"tunes":3145},{"text":475},{},{"id":478,"data":3147,"type":218,"tunes":3148},{"text":480},{},{"id":483,"data":3150,"type":218,"tunes":3151},{"text":485},{},{"id":488,"data":3153,"type":377,"tunes":3169},{"content":3154,"stretched":43,"withHeadings":14},[3155,3156,3157,3158,3159,3160,3161,3162,3163,3164,3165,3166,3167,3168],[492,493],[495,496],[498,499],[501,502],[504,505],[507,508],[510,511],[513,514],[516,517],[519,520],[522,523],[525,526],[528,529],[531,532],{},{"id":535,"data":3171,"type":42,"tunes":3172},{"text":537,"level":247},{},{"id":540,"data":3174,"type":218,"tunes":3175},{"text":542},{},{"id":545,"data":3177,"type":218,"tunes":3178},{"text":547},{},{"id":550,"data":3180,"type":218,"tunes":3181},{"text":552},{},{"id":555,"data":3183,"type":42,"tunes":3184},{"text":557,"level":247},{},{"id":560,"data":3186,"type":377,"tunes":3198},{"content":3187,"stretched":43,"withHeadings":14},[3188,3189,3190,3191,3192,3193,3194,3195,3196,3197],[564,565],[567,568],[570,571],[573,574],[576,577],[579,580],[582,583],[585,586],[588,589],[591,592],{},{"id":595,"data":3200,"type":42,"tunes":3201},{"text":597,"level":247},{},{"id":600,"data":3203,"type":218,"tunes":3204},{"text":602},{},{"id":605,"data":3206,"type":218,"tunes":3207},{"text":607},{},{"id":610,"data":3209,"type":218,"tunes":3210},{"text":612},{},{"id":615,"data":3212,"type":42,"tunes":3213},{"text":617,"level":247},{},{"id":620,"data":3215,"type":218,"tunes":3216},{"text":622},{},{"id":625,"data":3218,"type":218,"tunes":3219},{"text":627},{},{"id":630,"data":3221,"type":218,"tunes":3222},{"text":632},{},{"id":635,"data":3224,"type":42,"tunes":3225},{"text":637,"level":247},{},{"id":640,"data":3227,"type":218,"tunes":3228},{"text":642},{},{"id":645,"data":3230,"type":218,"tunes":3231},{"text":647},{},{"id":650,"data":3233,"type":218,"tunes":3234},{"text":652},{},{"id":655,"data":3236,"type":42,"tunes":3237},{"text":657,"level":247},{},{"id":660,"data":3239,"type":218,"tunes":3240},{"text":662},{},{"id":665,"data":3242,"type":218,"tunes":3243},{"text":667},{},{"id":670,"data":3245,"type":218,"tunes":3246},{"text":672},{},{"id":675,"data":3248,"type":42,"tunes":3249},{"text":677,"level":247},{},{"id":680,"data":3251,"type":218,"tunes":3252},{"text":682},{},{"id":685,"data":3254,"type":377,"tunes":3265},{"content":3255,"stretched":43,"withHeadings":14},[3256,3257,3258,3259,3260,3261,3262,3263,3264],[689,690,691],[693,694,695],[697,698,699],[701,702,703],[705,706,707],[709,710,711],[713,714,715],[717,718,719],[721,722,723],{},{"id":726,"data":3267,"type":218,"tunes":3268},{"text":728},{},{"id":731,"data":3270,"type":42,"tunes":3271},{"text":733,"level":247},{},{"id":736,"data":3273,"type":218,"tunes":3274},{"text":738},{},{"id":741,"data":3276,"type":218,"tunes":3277},{"text":743},{},{"id":746,"data":3279,"type":218,"tunes":3280},{"text":748},{},{"id":751,"data":3282,"type":42,"tunes":3283},{"text":753,"level":247},{},{"id":756,"data":3285,"type":218,"tunes":3286},{"text":758},{},{"id":761,"data":3288,"type":218,"tunes":3289},{"text":763},{},{"id":766,"data":3291,"type":218,"tunes":3292},{"text":768},{},{"id":771,"data":3294,"type":226,"tunes":3295},{"body":773,"title":774,"variant":775},{},{"id":778,"data":3297,"type":42,"tunes":3298},{"text":780,"level":247},{},{"id":783,"data":3300,"type":320,"tunes":3310},{"steps":3301,"title":810,"orientation":319},[3302,3303,3304,3305,3306,3307,3308,3309],{"label":787,"description":788},{"label":790,"description":791},{"label":793,"description":794},{"label":796,"description":797},{"label":799,"description":800},{"label":802,"description":803},{"label":805,"description":806},{"label":808,"description":809},{},{"id":813,"data":3312,"type":42,"tunes":3313},{"text":815,"level":247},{},{"id":818,"data":3315,"type":218,"tunes":3316},{"text":820},{},{"id":823,"data":3318,"type":218,"tunes":3319},{"text":825},{},{"id":828,"data":3321,"type":218,"tunes":3322},{"text":830},{},{"id":833,"data":3324,"type":42,"tunes":3325},{"text":835,"level":247},{},{"id":838,"data":3327,"type":218,"tunes":3328},{"text":840},{},{"id":843,"data":3330,"type":218,"tunes":3331},{"text":845},{},{"id":848,"data":3333,"type":218,"tunes":3334},{"text":850},{},{"id":853,"data":3336,"type":42,"tunes":3337},{"text":855,"level":247},{},{"id":858,"data":3339,"type":218,"tunes":3340},{"text":860},{},{"id":863,"data":3342,"type":218,"tunes":3343},{"text":865},{},{"id":868,"data":3345,"type":218,"tunes":3346},{"text":870},{},{"id":873,"data":3348,"type":377,"tunes":3358},{"content":3349,"stretched":43,"withHeadings":14},[3350,3351,3352,3353,3354,3355,3356,3357],[877,878],[880,881],[883,884],[886,887],[889,890],[892,893],[895,896],[898,899],{},{"id":902,"data":3360,"type":42,"tunes":3361},{"text":904,"level":247},{},{"id":907,"data":3363,"type":218,"tunes":3364},{"text":909},{},{"id":912,"data":3366,"type":218,"tunes":3367},{"text":914},{},{"id":917,"data":3369,"type":218,"tunes":3370},{"text":919},{},{"id":922,"data":3372,"type":42,"tunes":3373},{"text":924,"level":247},{},{"id":927,"data":3375,"type":218,"tunes":3376},{"text":929},{},{"id":932,"data":3378,"type":218,"tunes":3379},{"text":934},{},{"id":937,"data":3381,"type":218,"tunes":3382},{"text":939},{},{"id":942,"data":3384,"type":42,"tunes":3385},{"text":944,"level":247},{},{"id":947,"data":3387,"type":218,"tunes":3388},{"text":949},{},{"id":952,"data":3390,"type":218,"tunes":3391},{"text":954},{},{"id":957,"data":3393,"type":218,"tunes":3394},{"text":959},{},{"id":962,"data":3396,"type":42,"tunes":3397},{"text":964,"level":247},{},{"id":967,"data":3399,"type":218,"tunes":3400},{"text":969},{},{"id":972,"data":3402,"type":218,"tunes":3403},{"text":974},{},{"id":977,"data":3405,"type":218,"tunes":3406},{"text":979},{},{"id":982,"data":3408,"type":42,"tunes":3409},{"text":984,"level":247},{},{"id":987,"data":3411,"type":385,"tunes":3424},{"rows":3412,"title":1006,"layout":377,"columns":3421},[3413,3415,3417,3419],{"id":991,"label":992,"values":3414},[355,355],{"id":995,"label":996,"values":3416},[355,355],{"id":999,"label":1000,"values":3418},[355,355],{"id":1003,"label":1004,"values":3420},[355,355],[3422,3423],{"id":1009,"label":1010},{"id":1012,"label":1013},{},{"id":1016,"data":3426,"type":218,"tunes":3427},{"text":1018},{},{"id":1021,"data":3429,"type":42,"tunes":3430},{"text":1023,"level":247},{},{"id":1026,"data":3432,"type":218,"tunes":3433},{"text":1028},{},{"id":1031,"data":3435,"type":218,"tunes":3436},{"text":1033},{},{"id":1036,"data":3438,"type":218,"tunes":3439},{"text":1038},{},{"id":1041,"data":3441,"type":42,"tunes":3442},{"text":1043,"level":247},{},{"id":1046,"data":3444,"type":42,"tunes":3445},{"text":1048,"level":246},{},{"id":1051,"data":3447,"type":226,"tunes":3448},{"body":1053,"title":1054,"variant":240},{},{"id":1057,"data":3450,"type":218,"tunes":3451},{"text":1059},{},{"id":1062,"data":3453,"type":218,"tunes":3454},{"text":1064},{},{"id":1067,"data":3456,"type":218,"tunes":3457},{"text":1069},{},{"id":1072,"data":3459,"type":42,"tunes":3460},{"text":1074,"level":246},{},{"id":1077,"data":3462,"type":218,"tunes":3463},{"text":1079},{},{"id":1082,"data":3465,"type":218,"tunes":3466},{"text":1084},{},{"id":1087,"data":3468,"type":42,"tunes":3469},{"text":1089,"level":246},{},{"id":1092,"data":3471,"type":218,"tunes":3472},{"text":1094},{},{"id":1097,"data":3474,"type":218,"tunes":3475},{"text":1099},{},{"id":1102,"data":3477,"type":218,"tunes":3478},{"text":1104},{},{"id":1107,"data":3480,"type":377,"tunes":3490},{"content":3481,"stretched":43,"withHeadings":14},[3482,3483,3484,3485,3486,3487,3488,3489],[1111,1112],[1114,1115],[1117,1118],[1120,1121],[1123,1124],[1126,1127],[1129,1130],[1132,1133],{},{"id":1136,"data":3492,"type":42,"tunes":3493},{"text":1138,"level":247},{},{"id":1141,"data":3495,"type":377,"tunes":3511},{"content":3496,"stretched":43,"withHeadings":14},[3497,3498,3499,3500,3501,3502,3503,3504,3505,3506,3507,3508,3509,3510],[1145,1146],[1148,1149],[1151,1152],[1154,1155],[1157,1158],[1160,1161],[1163,1164],[1166,1167],[1169,1170],[1172,1173],[1175,1176],[1178,1179],[1181,1182],[1184,1185],{},{"id":1188,"data":3513,"type":42,"tunes":3514},{"text":1190,"level":247},{},{"id":1193,"data":3516,"type":218,"tunes":3517},{"text":1195},{},{"id":1198,"data":3519,"type":218,"tunes":3520},{"text":1200},{},{"id":1203,"data":3522,"type":218,"tunes":3523},{"text":1205},{},{"id":1208,"data":3525,"type":42,"tunes":3526},{"text":1210,"level":247},{},{"id":1213,"data":3528,"type":218,"tunes":3529},{"text":1215},{},{"id":1218,"data":3531,"type":377,"tunes":3543},{"content":3532,"stretched":43,"withHeadings":14},[3533,3534,3535,3536,3537,3538,3539,3540,3541,3542],[1222,1223],[1225,1226],[1228,1229],[1231,1232],[1234,1235],[1237,1238],[1240,1241],[1243,1244],[1246,1247],[1249,1250],{},{"id":1253,"data":3545,"type":218,"tunes":3546},{"text":1255},{},{"id":1258,"data":3548,"type":42,"tunes":3549},{"text":1260,"level":247},{},{"id":1263,"data":3551,"type":320,"tunes":3565},{"steps":3552,"title":1302,"orientation":319},[3553,3554,3555,3556,3557,3558,3559,3560,3561,3562,3563,3564],{"label":1267,"description":1268},{"label":1270,"description":1271},{"label":1273,"description":1274},{"label":1276,"description":1277},{"label":1279,"description":1280},{"label":1282,"description":1283},{"label":1285,"description":1286},{"label":1288,"description":1289},{"label":1291,"description":1292},{"label":1294,"description":1295},{"label":1297,"description":1298},{"label":1300,"description":1301},{},{"id":1305,"data":3567,"type":42,"tunes":3568},{"text":1307,"level":247},{},{"id":1310,"data":3570,"type":377,"tunes":3588},{"content":3571,"stretched":43,"withHeadings":14},[3572,3573,3574,3575,3576,3577,3578,3579,3580,3581,3582,3583,3584,3585,3586,3587],[1314,1315],[1317,1318],[1320,1321],[1323,1324],[1326,1327],[1329,1330],[1332,1333],[1335,1336],[1338,1339],[1341,1342],[1344,1345],[1347,1348],[1350,1351],[1353,1354],[1356,1357],[1359,1360],{},{"id":1363,"data":3590,"type":42,"tunes":3591},{"text":1365,"level":247},{},{"id":1368,"data":3593,"type":377,"tunes":3606},{"content":3594,"stretched":43,"withHeadings":14},[3595,3596,3597,3598,3599,3600,3601,3602,3603,3604,3605],[1372,1373],[1375,1376],[1378,1379],[1381,1382],[1384,1385],[1387,1388],[1390,1391],[1393,1394],[1396,1397],[1399,1400],[1402,1403],{},{"id":1406,"data":3608,"type":42,"tunes":3609},{"text":1408,"level":247},{},{"id":1411,"data":3611,"type":218,"tunes":3612},{"text":1413},{},{"id":1416,"data":3614,"type":218,"tunes":3615},{"text":1418},{},{"id":1421,"data":3617,"type":218,"tunes":3618},{"text":1423},{},{"id":1426,"data":3620,"type":218,"tunes":3621},{"text":1428},{},{"id":1431,"data":3623,"type":218,"tunes":3624},{"text":1433},{},{"id":1436,"data":3626,"type":42,"tunes":3627},{"text":1438,"level":247},{},{"id":1441,"data":3629,"type":218,"tunes":3630},{"text":1443},{},{"id":1446,"data":3632,"type":218,"tunes":3633},{"text":1448},{},{"id":1451,"data":3635,"type":218,"tunes":3636},{"text":1453},{},{"id":1456,"data":3638,"type":42,"tunes":3639},{"text":1458,"level":247},{},{"id":1461,"data":3641,"type":218,"tunes":3642},{"text":1463},{},{"id":1466,"data":3644,"type":218,"tunes":3645},{"text":1468},{},{"id":1471,"data":3647,"type":218,"tunes":3648},{"text":1473},{},{"id":1476,"data":3650,"type":1482,"tunes":3651},{"url":1478,"title":1479,"excerpt":1480,"ctaLabel":1481},{},{"id":1485,"data":3653,"type":1482,"tunes":3654},{"url":1487,"title":1488,"excerpt":1489,"ctaLabel":1490},{},{"id":1493,"data":3656,"type":1482,"tunes":3657},{"url":1495,"title":1496,"excerpt":1497,"ctaLabel":1498},{},{"id":1501,"data":3659,"type":42,"tunes":3660},{"text":1503,"level":247},{},{"id":1506,"data":3662,"type":1506,"tunes":3673},{"items":3663,"title":1545},[3664,3665,3666,3667,3668,3669,3670,3671,3672],{"id":1510,"answer":1511,"question":1512},{"id":1514,"answer":1515,"question":1516},{"id":1518,"answer":1519,"question":1520},{"id":1522,"answer":1523,"question":1524},{"id":1526,"answer":1527,"question":1528},{"id":1530,"answer":1531,"question":1532},{"id":1534,"answer":1535,"question":1536},{"id":1538,"answer":1539,"question":1540},{"id":1542,"answer":1543,"question":1544},{},{"id":1548,"data":3675,"type":42,"tunes":3676},{"text":1550,"level":247},{},{"id":1553,"data":3678,"type":1553,"tunes":3692},{"title":1555,"entries":3679},[3680,3681,3682,3683,3684,3685,3686,3687,3688,3689,3690,3691],{"term":381,"anchor":1558,"definition":1559},{"term":1561,"anchor":1562,"definition":1563},{"term":1565,"anchor":1566,"definition":1567},{"term":1569,"anchor":1570,"definition":1571},{"term":1573,"anchor":1574,"definition":1575},{"term":1577,"anchor":1578,"definition":1579},{"term":1581,"anchor":1582,"definition":1583},{"term":1585,"anchor":1586,"definition":1587},{"term":1589,"anchor":1590,"definition":1591},{"term":1593,"anchor":1594,"definition":1595},{"term":1597,"anchor":1598,"definition":1599},{"term":1601,"anchor":1602,"definition":1603},{},{"id":1606,"data":3694,"type":42,"tunes":3695},{"text":1608,"level":247},{},{"id":1611,"data":3697,"type":218,"tunes":3698},{"text":1613},{},{"id":1616,"data":3700,"type":218,"tunes":3701},{"text":1618},{},{"id":1621,"data":3703,"type":218,"tunes":3704},{"text":1623},{},{"id":1626,"data":3706,"type":42,"tunes":3707},{"text":1628,"level":247},{},{"id":1631,"data":3709,"type":218,"tunes":3710},{"text":1633},{},{"id":1636,"data":3712,"type":1643,"tunes":3715},{"link":1638,"meta":3713},{"image":3714,"title":1641,"description":1642},{"url":355},{},{"id":1646,"data":3717,"type":1643,"tunes":3720},{"link":1648,"meta":3718},{"image":3719,"title":1651,"description":1652},{"url":355},{},{"id":1655,"data":3722,"type":1643,"tunes":3725},{"link":1657,"meta":3723},{"image":3724,"title":1660,"description":1661},{"url":355},{},{"id":1664,"data":3727,"type":1643,"tunes":3730},{"link":1666,"meta":3728},{"image":3729,"title":1669,"description":1670},{"url":355},{},{"id":1673,"data":3732,"type":1643,"tunes":3735},{"link":1675,"meta":3733},{"image":3734,"title":1678,"description":1679},{"url":355},{},{"id":1682,"data":3737,"type":1643,"tunes":3740},{"link":1684,"meta":3738},{"image":3739,"title":1687,"description":1688},{"url":355},{},{"id":1691,"data":3742,"type":1643,"tunes":3745},{"link":1693,"meta":3743},{"image":3744,"title":1696,"description":1697},{"url":355},{},{"id":1700,"data":3747,"type":1643,"tunes":3750},{"link":1702,"meta":3748},{"image":3749,"title":1705,"description":1706},{"url":355},{},{"id":1709,"data":3752,"type":1643,"tunes":3755},{"link":1711,"meta":3753},{"image":3754,"title":1714,"description":1715},{"url":355},{},"Post erfolgreich abgerufen",{"items":3758,"source":3843,"manualIds":3844,"manualMatchedIds":3845},[3759,3766,3773,3780,3787,3794,3801,3808,3815,3822,3829,3836],{"id":3760,"slug":3761,"title":3762,"excerpt":3763,"featuredImage":3764,"publishedAt":3765},"10","portal-development-a-scalable-platform-for-performance-multilingual-support-and-extensibility","Desarrollo de Portales: Una Plataforma Escalable para Rendimiento, Soporte Multilingüe y Extensibilidad","Se construye un portal web moderno, escalable y de alto rendimiento, con soporte multilingüe y","\u002Fuploads\u002F2026\u002F01\u002Fportal-development-a-scalable-platform-for-performance-multilingual-support-and-extensibility-1769006690165-vklvij.webp","2026-01-21T10:32:00.000Z",{"id":3767,"slug":3768,"title":3769,"excerpt":3770,"featuredImage":3771,"publishedAt":3772},"460","ai-agent-reliability-why-the-final-answer-is-not-enough","Fiabilidad de los Agentes de IA: Por Qué la Respuesta Final No es Suficiente","Una salida correcta no demuestra un razonamiento correcto, una ejecución segura ni un sistema confiable.","\u002Fuploads\u002F2026\u002F09\u002Fai-agent-reliability-why-the-final-answer-is-not-enough-1788955466306-pl0qhz.webp","2026-09-09T04:01:00.000Z",{"id":3774,"slug":3775,"title":3776,"excerpt":3777,"featuredImage":3778,"publishedAt":3779},"443","linux","Tendencias emergentes de Linux en 2026: Moldeando el futuro de la infraestructura de servidores","Explora las tendencias clave de Linux de 2026, desde el dominio de Kubernetes y las distribuciones inmutables hasta la integración de IA y la seguridad eBPF.","\u002Fuploads\u002F2026\u002F03\u002Flinux-1773696098750-knp03t.webp","2026-03-01T13:52:00.000Z",{"id":3781,"slug":3782,"title":3783,"excerpt":3784,"featuredImage":3785,"publishedAt":3786},"484","what-is-an-ai-platform-architect-models-data-runtime-security-and-operations","¿Qué es un arquitecto de plataforma de IA? Modelos, datos, entorno de ejecución, seguridad y operaciones","Un Arquitecto de Plataformas de IA diseña fundamentos de IA reutilizables a través de modelos, proveedores, recuperación, agentes, identidad, seguridad, evaluación, observabilidad y operaciones.","\u002Fuploads\u002F2026\u002F10\u002Fwhat-is-an-ai-platform-architect-models-data-runtime-security-and-operations-1791477229171-ou3zcc.webp","2026-10-08T12:32:00.000Z",{"id":3788,"slug":3789,"title":3790,"excerpt":3791,"featuredImage":3792,"publishedAt":3793},"464","falsification-for-ai-reasoning-from-answers-to-tested-hypotheses","Falsación para el razonamiento de IA: De respuestas a hipótesis comprobadas","Los modelos de IA pueden generar evidencia convincente para casi cualquier hipótesis plausible. Una metodología más fiable plantea la pregunta opuesta: ¿qué evidencia debilitaría, contradiría o nos obligaría a abandonar la conclusión? Este artículo desarrolla un razonamiento orientado a la falsación para los LLM utilizando hipótesis rivales, pruebas discriminantes, contraevidencia y criterios de rechazo explícitos.","\u002Fuploads\u002F2026\u002F09\u002Ffalsification-for-ai-reasoning-from-answers-to-tested-hypotheses-1789811137616-3hce1b.webp","2026-09-19T01:11:00.000Z",{"id":3795,"slug":3796,"title":3797,"excerpt":3798,"featuredImage":3799,"publishedAt":3800},"382","a-practical-monorepo-architecture-next-js-platform-admin-fastify-api-prisma-and-nginx","Una Arquitectura Monorepo Práctica con Next.js, Fastify, Prisma y NGINX","Explora una arquitectura monorepo práctica utilizando Next.js, Fastify, Prisma y NGINX, destacando la integración y el flujo de trabajo en el mundo real.","\u002Fuploads\u002F2026\u002F01\u002Fa-practical-monorepo-architecture-next-js-platform-admin-fastify-api-prisma-and-nginx-1769885526116-q1100n.webp","2026-01-31T08:18:00.000Z",{"id":3802,"slug":3803,"title":3804,"excerpt":3805,"featuredImage":3806,"publishedAt":3807},"385","comfyui-on-fedora-43-two-virtual-environments-one-click-start-march-2026","ComfyUI en Fedora 43: Dos entornos virtuales + Inicio con un solo clic (marzo de 2026)","Objetivo: Mantener dos venvs de Python (p. ej., 3.12 + 3.14) por compatibilidad, pero iniciar ComfyUI automáticamente con una configuración limpia y ligera.","\u002Fuploads\u002F2026\u002F03\u002Fcomfyui-on-fedora-43-two-virtual-environments-one-click-start-march-2026-1772356102271-qqqlsm.webp","2026-03-01T04:57:00.000Z",{"id":3809,"slug":3810,"title":3811,"excerpt":3812,"featuredImage":3813,"publishedAt":3814},"381","enterprise-grade-multi-tenant-architecture-for-an-international-platform","Arquitectura Multi-Inquilino de Grado Empresarial para una Plataforma Internacional","Loving Rocks es una plataforma de bodas de nivel empresarial diseñada con una verdadera arquitectura multiinquilino, bases de datos aisladas por inquilino e internacionalización integrada para escalabilidad global, seguridad y estabilidad operativa a largo plazo.","\u002Fuploads\u002F2026\u002F01\u002Fenterprise-grade-multi-tenant-architecture-for-an-international-platform-1769789121298-b6v7ak.webp","2026-01-30T12:04:00.000Z",{"id":3816,"slug":3817,"title":3818,"excerpt":3819,"featuredImage":3820,"publishedAt":3821},"383","canonical-architecture-url-design-resolver-logic-api-scalability-specification","Arquitectura Canónica, Diseño de URL, Lógica del Resolvedor, Especificación de API y Escalabilidad","Arquitectura de descubrimiento geobasada para portales multi-inquilino. Define URL canónicas, lógica de resolución, estrategia de caché y un modelo de lectura geográfico sin acoplamiento con CMS ni refactorización de base de datos. Diseñada para la estabilidad SEO, la escalabilidad y futuras extensiones como reservas y mapas.","\u002Fuploads\u002F2026\u002F01\u002Fcanonical-architecture-url-design-resolver-logic-api-scalability-specification-1769890763607-7rghbp.webp","2026-01-31T06:12:00.000Z",{"id":3823,"slug":3824,"title":3825,"excerpt":3826,"featuredImage":3827,"publishedAt":3828},"487","vector-databases-embeddings-and-reranking-three-different-parts-of-retrieval","Bases de datos vectoriales, embeddings y reranking: tres partes diferentes de la recuperación","Las incrustaciones representan el significado, las bases de datos vectoriales recuperan candidatos y los rerankers refinan los resultados. Aprende en qué se diferencian y cómo trabajan juntas estas tres capas de recuperación en RAG.","\u002Fuploads\u002F2026\u002F10\u002Fvector-databases-embeddings-and-reranking-three-different-parts-of-retrieval-1791480129884-9dtasz.webp","2026-10-08T11:21:00.000Z",{"id":3830,"slug":3831,"title":3832,"excerpt":3833,"featuredImage":3834,"publishedAt":3835},"489","agentic-ai-explained-when-an-ai-system-can-plan-use-tools-and-act","IA agéntica explicada: cuando un sistema de IA puede planificar, usar herramientas y actuar","La IA agéntica utiliza modelos dentro de bucles de ejecución de varios pasos, donde pueden elegir herramientas, observar resultados, actualizar el estado y adaptar su siguiente acción dentro de límites explícitos de tiempo de ejecución y permisos.","\u002Fuploads\u002F2026\u002F10\u002Fagentic-ai-explained-when-an-ai-system-can-plan-use-tools-and-act-1791481499084-wnji2a.webp","2026-10-08T11:43:00.000Z",{"id":3837,"slug":3838,"title":3839,"excerpt":3840,"featuredImage":3841,"publishedAt":3842},"492","mcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits","MCP explicado: qué conecta, qué no hace y dónde encaja","El Protocolo de Contexto de Modelo conecta aplicaciones de IA con herramientas, recursos y prompts externos a través de un límite estándar cliente-servidor. Aprende qué hace MCP, qué no hace y dónde encaja en la arquitectura de agentes.","\u002Fuploads\u002F2026\u002F10\u002Fmcp-explained-what-it-connects-what-it-does-not-do-and-where-it-fits-1791486640275-7ub1cq.webp","2026-10-08T15:09:00.000Z","fallback",[],[]]