[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"portal-settings:stajic:sr":3,"public-menus:all":38,"post:ai-governance-models-data-permissions-risk-and-auditability:sr":205,"related:post:ai-governance-models-data-permissions-risk-and-auditability:sr:1":3757},{"statusCode":4,"data":5,"message":37},200,{"tenantId":6,"lang":7,"defaultLang":8,"siteUrl":9,"contactEmail":10,"brandName":11,"logoUrl":12,"siteName":11,"siteDescription":13,"ogImage":10,"robotsIndex":14,"socialLinks":10,"reservedSlugs":10,"seoPolicy":15},"stajic","sr","de","https:\u002F\u002Fstajic.de",null,"Stajic Platform","\u002FLogo_Planet.svg","Stajic Portal",true,{"branding":16,"relatedContent":17,"crossDomainLinks":18},{"logoUrl":12},{"enabled":14},[19,22,25,28,31,34],{"url":20,"label":21,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Ffigure.rocks","figure.rocks",{"url":23,"label":24,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Floving.rocks","loving.rocks",{"url":26,"label":27,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.com","bazify.com",{"url":29,"label":30,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.de","bazify.de",{"url":32,"label":33,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.at","bazify.at",{"url":35,"label":36,"isActive":14,"showInFooter":14,"includeInSameAs":14},"https:\u002F\u002Fbazify.ba","bazify.ba","Portal settings resolved",[39,45],{"id":40,"name":41,"location":42,"isActive":14,"isDefault":43,"items":44},1,"main-navigation","header",false,[],{"id":46,"name":47,"location":48,"isActive":14,"isDefault":14,"items":49},4,"main-menu","sidebar",[50,66,79,93,103,118,133],{"id":51,"title":52,"url":60,"target":61,"icon":62,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":64,"portfolioId":10,"children":65},"item-18",{"de":53,"en":54,"es":55,"fr":56,"it":54,"ru":57,"sr":58,"zh":59},"Startseite","Home","Inicio","Accueil","Главная","Почетна","首页","\u002Ffull-stack-web-developer-munich-performance-seo-and-maintainable-builds","_self","i-lucide-home","page",111,[],{"id":67,"title":68,"url":75,"target":61,"icon":76,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":77,"portfolioId":10,"children":78},"item-22",{"de":69,"en":69,"es":70,"fr":69,"it":71,"ru":72,"sr":73,"zh":74},"Vision","Visión","Visione","Видение","Визија","想象","\u002Fueber-uns-webdesign-muenchen-webaplikation","i-lucide-eye",113,[],{"id":80,"title":81,"url":89,"target":61,"icon":90,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":91,"portfolioId":10,"children":92},"item-19",{"de":82,"en":83,"es":84,"fr":83,"it":85,"ru":86,"sr":87,"zh":88},"Leistungen","Services","Servicios","Servizi","Услуги","Услуге","服务","\u002Fservices-dienstleistungen-muenchen","i-lucide-wrench",116,[],{"id":94,"title":95,"url":99,"target":61,"icon":100,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":101,"portfolioId":10,"children":102},"item-23",{"de":96,"en":96,"es":96,"fr":96,"it":96,"ru":97,"sr":97,"zh":98},"Blog","Блог","博客","\u002Fblog","i-lucide-book-open",112,[],{"id":104,"title":105,"url":114,"target":61,"icon":115,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":116,"portfolioId":10,"children":117},"item-32",{"de":106,"en":107,"es":108,"fr":109,"it":110,"ru":111,"sr":112,"zh":113},"Neue Technologien","New Technologies","Nuevas tecnologías","Nouvelles technologies","Nuove tecnologie","Новые технологии","Нове технологије","新技术！","\u002Fneue-webtechnologien","i-lucide-sparkles",122,[],{"id":119,"title":120,"url":129,"target":61,"icon":130,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":131,"portfolioId":10,"children":132},"item-20",{"de":121,"en":122,"es":123,"fr":124,"it":125,"ru":126,"sr":127,"zh":128},"Kontakt","Contact us!","Contacto","Contact","Contatto","Контакт","Контактирајте нас","联系我们！","\u002Fcontact","i-lucide-mail",115,[],{"id":134,"title":135,"url":144,"target":61,"icon":145,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":146,"portfolioId":10,"children":147},"item-21",{"de":136,"en":137,"es":138,"fr":139,"it":140,"ru":141,"sr":142,"zh":143},"Unsere Arbeit","Our Work","Nuestro trabajo","Nos réalisations","I nostri lavori","Наши работы","Наши радови","文件夹","\u002Fportfolio","i-lucide-briefcase",114,[148,161,175,181,193],{"id":149,"title":150,"url":144,"target":61,"icon":159,"isActive":14,"type":63,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":146,"portfolioId":10,"children":160},"item-24",{"de":151,"en":152,"es":153,"fr":154,"it":155,"ru":156,"sr":157,"zh":158},"Alle Projekte","All Projects","Todos los proyectos","Tous les projets","Tutti i progetti","Все проекты","Сви пројекти","所有项目","i-lucide-grid-3x3",[],{"id":162,"title":163,"url":171,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":174},"item-29",{"de":164,"en":165,"es":166,"fr":167,"it":168,"ru":169,"sr":170,"zh":143},"Local Roots, Global Reach","Local Roots - Global Reach","Empresa local ","Entreprise locale","Azienda locale","Местная компания","Локално предузеће глобално тржиште","\u002Fportfolio\u002Flocal-roots-global-reach-communication-media-systems-for-modern-business","i-lucide-folder","custom",[],{"id":176,"title":177,"url":179,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":180},"item-28",{"de":178,"en":178,"es":178,"fr":178,"it":178,"ru":178,"sr":178,"zh":178},"Solr Suggester","\u002Fportfolio\u002Fsolr-fuzzy-suggester-und-solr-infix-suggester-abfrage-ueber-ajax-und-filterung",[],{"id":182,"title":183,"url":191,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":192},"item-27",{"de":184,"en":185,"es":186,"fr":187,"it":188,"ru":189,"sr":190,"zh":185},"Firmenwebseite SEO","Company Website SEO","Sitio web corporativo SEO","Site web d’entreprise SEO","Sito web aziendale SEO","Корпоративный сайт SEO","Пословна веб-страница SEO","\u002Fportfolio\u002Fseo-sem-branding-mobile-webseite-muenchen",[],{"id":194,"title":195,"url":203,"target":61,"icon":172,"isActive":14,"type":173,"productId":10,"categoryId":10,"shopCategoryId":10,"articleId":10,"pageId":10,"portfolioId":10,"children":204},"item-31",{"de":196,"en":197,"es":198,"fr":199,"it":200,"ru":201,"sr":202,"zh":197},"Digitalisierungsportal","Digitalization Portal","Portal de digitalización","Portail de numérisation","Portale di digitalizzazione","Портал цифровизации","Портал за дигитализацију","\u002Fportfolio\u002Fdigitalisierungsportal-archiv-museum-bibliothek-ead-lido-mets-mods",[],{"statusCode":4,"data":206,"message":3756},{"id":207,"title":208,"slug":209,"content":210,"contentJson":211,"excerpt":1719,"featuredImage":1720,"featuredImageAlt":1721,"featuredImageCaption":10,"featuredImageTitle":10,"featuredImageCopyright":10,"featuredImageAuthor":10,"featuredImageSourceUrl":10,"featuredImageLicense":10,"featuredImageIsAiGenerated":43,"status":1722,"publishedAt":1723,"createdAt":1724,"updatedAt":1725,"seoLocalePaths":1726,"categories":1735,"author":1736,"translations":1741},"491","Upravljanje veštačkom inteligencijom: Modeli, podaci, dozvole, rizik i mogućnost revizije","ai-governance-models-data-permissions-risk-and-auditability","\u003Cp>Upravljanje veštačkom inteligencijom je sistem prava odlučivanja, odgovornosti, kontrola i dokaza koji se koriste za odlučivanje o tome kako organizacija može da razvija, nabavlja, uvodi, upravlja, menja i ukida AI sisteme. Ono je šire od dokumenta politike i uže od cele enterprise arhitekture. Efikasno upravljanje AI povezuje vlasništvo nad poslom, izbor modela i provajdera, nadležnost nad podacima, dozvole, klasifikaciju rizika, evaluaciju, monitoring, rukovanje incidentima, proverljivost i odluke o životnom ciklusu, tako da neko može da odgovori ne samo na pitanje „da li AI radi?“ već i na pitanje „ko ga je odobrio, pod kojim uslovima, uz koje dokaze i kada ta odluka mora ponovo da se razmotri?“\u003C\u002Fp>\n\u003Caside class=\"editorjs-callout editorjs-callout--info my-6 rounded-xl border p-5 border-blue-300 bg-blue-50 dark:border-blue-900 dark:bg-blue-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Direktan odgovor\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">\u003Cstrong>Upravljanje AI pretvara AI iz neformalne tehničke sposobnosti u odgovornu organizacionu sposobnost.\u003C\u002Fstrong>\u003Cbr>\u003Cbr>Arhitektura određuje kako se sistem gradi. Inženjering ga implementira. Upravljanje rizikom procenjuje neizvesnost i štetu. Usklađenost se bavi primenljivim obavezama. Upravljanje povezuje ove aktivnosti kroz vlasništvo, prava odlučivanja, potrebne kontrole, dokaze i kapije životnog ciklusa.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Caside class=\"editorjs-callout editorjs-callout--warning my-6 rounded-xl border p-5 border-amber-300 bg-amber-50 dark:border-amber-900 dark:bg-amber-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Upravljanje nije komitet i nije PDF\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">Odbor za upravljanje može biti jedan mehanizam, a politike mogu dokumentovati očekivanja, ali upravljanje postaje operativno tek kada odluke menjaju ono što sistemima sme da se dozvoli: koji modeli smeju da se koriste, koji podaci smeju da uđu u njih, koje alate agent sme da izvršava, koje evaluacije su obavezne, ko može da odobri izuzetke, šta mora da se beleži i šta pokreće suspenziju ili ukidanje.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Caside class=\"editorjs-callout editorjs-callout--note my-6 rounded-xl border p-5 border-gray-300 bg-gray-50 dark:border-gray-700 dark:bg-gray-900\u002F40\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Napomena o aktuelnim izvorima — 8. oktobar 2026.\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">NIST AI RMF 1.0 ostaje trenutno objavljeni okvir dok ga NIST revidira. Njegovo jezgro je organizovano oko \u003Cstrong>GOVERN, MAP, MEASURE i MANAGE\u003C\u002Fstrong>, pri čemu je GOVERN funkcija koja seče kroz sve ostale. ISO\u002FIEC 42001:2023 ostaje međunarodni standard za sistem upravljanja AI za uspostavljanje, rad i kontinuirano unapređenje sistema upravljanja AI. EU AI Act je sada opšte primenljiv od 2. avgusta 2026, dok su neke obaveze imale ranije datume primene, a neki zahtevi za visokorizične sisteme imaju kasnije datume prelaska. Regulatorni rokovi uvek treba ponovo da se provere pre donošenja konkretne odluke o usklađenosti.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Cnav class=\"editorjs-toc\" data-editorjs-toc=\"true\" aria-label=\"Sadržaj\">\u003Cstrong class=\"editorjs-toc__title\">Sadržaj\u003C\u002Fstrong>\u003Col class=\"editorjs-toc__list editorjs-toc__list--depth-0\">\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-6\" class=\"editorjs-toc__link\">Šta upravljanje AI zaista znači\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-10\" class=\"editorjs-toc__link\">Najjednostavniji primer\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-15\" class=\"editorjs-toc__link\">Gde se jednostavan primer zaustavlja\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-19\" class=\"editorjs-toc__link\">Šta upravljanje veštačkom inteligencijom jeste — a šta nije\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-21\" class=\"editorjs-toc__link\">Upravljanje je šire od usklađenosti\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-25\" class=\"editorjs-toc__link\">NIST AI RMF i ISO\u002FIEC 42001 rešavaju različite potrebe upravljanja\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-28\" class=\"editorjs-toc__link\">Trenutni vremenski okvir EU AI Act je važan\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-32\" class=\"editorjs-toc__link\">Upravljanje veštačkom inteligencijom počinje popisom\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-37\" class=\"editorjs-toc__link\">Upravljanje zahteva imenovano vlasništvo\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-41\" class=\"editorjs-toc__link\">Prava odlucivanja treba da budu eksplicitna\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-43\" class=\"editorjs-toc__link\">Upravljanje modelom je vise od izbora modela\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-47\" class=\"editorjs-toc__link\">Upravljanje provajderom je odvojen sloj zavisnosti\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-51\" class=\"editorjs-toc__link\">Upravljanje podacima ostaje sloj izvora istine\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-55\" class=\"editorjs-toc__link\">Dozvole su upravljačke odluke sa primenom u vreme izvršavanja\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-59\" class=\"editorjs-toc__link\">Klasifikacija rizika treba da menja skup kontrola\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-63\" class=\"editorjs-toc__link\">Upravljanje mora da očuva kontekst slučaja upotrebe\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-67\" class=\"editorjs-toc__link\">Evaluacija je dokaz za upravljanje\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-72\" class=\"editorjs-toc__link\">Kapije upravljanja treba da postoje tokom celog životnog ciklusa\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-74\" class=\"editorjs-toc__link\">Upravljanje promenama je centralno za AI upravljanje\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-78\" class=\"editorjs-toc__link\">Izuzeci zahtevaju vlasnike, rok trajanja i kompenzujuće kontrole\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-82\" class=\"editorjs-toc__link\">Revizibilnost je sposobnost rekonstrukcije odluke i izvršenja\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-87\" class=\"editorjs-toc__link\">Nadzor zatvara petlju upravljanja\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-91\" class=\"editorjs-toc__link\">AI incidenti zahtevaju definisan operativni put\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-95\" class=\"editorjs-toc__link\">Nabavka je deo AI upravljanja\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-99\" class=\"editorjs-toc__link\">Ljudski nadzor treba da bude dizajniran, a ne samo deklarisan\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-103\" class=\"editorjs-toc__link\">Upravljanje platformom i upravljanje slučajevima upotrebe su različiti\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-106\" class=\"editorjs-toc__link\">AI upravljanje i Enterprise AI arhitektura\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-110\" class=\"editorjs-toc__link\">Dokazi iz originalnog projekta\u003C\u002Fa>\u003Col class=\"editorjs-toc__list editorjs-toc__list--depth-1\">\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-111\" class=\"editorjs-toc__link\">Enterprise Aaasaasa 0.1: upravljanje kao struktura isporuke\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-116\" class=\"editorjs-toc__link\">SenseFlow: sledljivost zahteva i odluka\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-119\" class=\"editorjs-toc__link\">Aaasaasa AI Client: dozvole i vreme izvršavanja kao upravljana konfiguracija\u003C\u002Fa>\u003C\u002Fli>\u003C\u002Fol>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-124\" class=\"editorjs-toc__link\">Uobičajeni načini neuspeha upravljanja AI-jem\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-126\" class=\"editorjs-toc__link\">Centralno upravljanje ne znači centralizaciju svake odluke\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-130\" class=\"editorjs-toc__link\">Upravljajte samim sistemom upravljanja\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-134\" class=\"editorjs-toc__link\">Praktičan redosled implementacije AI upravljanja\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-136\" class=\"editorjs-toc__link\">Kontrolna lista za AI upravljanje\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-138\" class=\"editorjs-toc__link\">Uobičajene zablude\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-140\" class=\"editorjs-toc__link\">Granični slučajevi i ograničenja\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-146\" class=\"editorjs-toc__link\">Šta bi promenilo ovaj odgovor?\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-150\" class=\"editorjs-toc__link\">Povezano kanonsko znanje\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-157\" class=\"editorjs-toc__link\">Često postavljana pitanja\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-159\" class=\"editorjs-toc__link\">Pojmovnik\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-161\" class=\"editorjs-toc__link\">Zaključak\u003C\u002Fa>\u003C\u002Fli>\u003Cli class=\"editorjs-toc__item\">\u003Ca href=\"#section-165\" class=\"editorjs-toc__link\">Primarni izvori i aktuelne reference\u003C\u002Fa>\u003C\u002Fli>\u003C\u002Fol>\u003C\u002Fnav>\n\u003Ch2 id=\"section-6\">Šta upravljanje AI zaista znači\u003C\u002Fh2>\n\u003Cp>Upravljanje AI odgovara na organizaciona pitanja na koja model, SDK ili dijagram arhitekture ne mogu sami da odgovore. Ko je vlasnik poslovnog ishoda? Ko može da odobri novog provajdera? Koje klase podataka je zabranjeno obrađivati eksterno? Koji dokazi su potrebni pre uvođenja? Koje dozvole agent može da dobije? Ko može da prihvati preostali rizik? Šta se dešava kada model promeni ponašanje nakon nadogradnje?\u003C\u002Fp>\n\u003Cp>Cilj nije da se spreči promena. Dobro upravljanje čini promenu čitljivom: odluke imaju vlasnike, dokaze, uslove, izuzetke, datume revizije i puteve vraćanja ili eskalacije.\u003C\u002Fp>\n\u003Cp>Zato NIST postavlja GOVERN kroz ceo životni ciklus upravljanja rizikom AI, umesto da upravljanje tretira kao jedan završni korak odobravanja. Upravljanje uspostavlja kulturu, politike, odgovornost i organizacione strukture koje omogućavaju mapiranje, merenje i upravljanje rizikom AI.\u003C\u002Fp>\n\u003Ch2 id=\"section-10\">Najjednostavniji primer\u003C\u002Fh2>\n\u003Cp>Produktni tim želi da doda eksternog provajdera generativne AI za sumiranje internih tiketa korisničke podrške. Tehnički, integracija može da zahteva samo API poziv.\u003C\u002Fp>\n\u003Cp>Upravljanje postavlja drugi skup pitanja: Da li je sadržaj tiketa dozvoljeno izneti iz okruženja organizacije? Koji provajder i verzija modela su odobreni? Da li je zadržavanje onemogućeno? Koji korisnici mogu da pozovu tu funkciju? Kako se evaluira izlaz? Da li je potrebna ljudska provera? Šta se beleži? Ko je vlasnik incidenata? Šta se dešava ako provajder promeni uslove ili ponašanje modela?\u003C\u002Fp>\n\u003Cp>Rezultat upravljanja i dalje može biti „uvesti to“. Razlika je u tome što je uvođenje sada odluka koja se može pratiti, sa izričitim uslovima, umesto nezabeleženog inženjerskog izbora.\u003C\u002Fp>\n\u003Csection class=\"editorjs-process my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Osnovna upravljana AI odluka\u003C\u002Fh3>\u003Cdiv class=\"grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4\">\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">1\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">1. Registrujte slučaj upotrebe\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Zabeležite svrhu, vlasnika, korisnike, podatke, model\u002Fprovajdera i željeni ishod.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">2\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">2. Klasifikujte rizik i obaveze\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Utvrdite poslovne posledice, osetljivost podataka, autonomiju, regulatornu izloženost i potencijal zloupotrebe.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">3\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">3. Definišite potrebne kontrole\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Navedite dozvole, rukovanje podacima, evaluacije, ljudski nadzor, bezbednost, evidentiranje i ograničenja provajdera.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">4\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">4. Prikupite dokaze\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Sprovedite testove, bezbednosnu\u002Fproveru privatnosti, pregled arhitekture i relevantne pravne\u002Fprovere usklađenosti.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">5\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">5. Donesite odluku\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Odobrite, odobrite uz uslove, zatražite izmene, zadržite ili odbijte.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">6\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">6. Uvedite pod kontrolisanom konfiguracijom\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Fiksirajte odobreni model\u002Fprovajdera\u002Fruntime i sprovedite potrebne granice.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">7\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">7. Nadzirite i ponovo procenjujte\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Pratite incidente, kvalitet, drift, promene provajdera, nove rizike i promenjene propise.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">8\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">8. Izmenite, suspendujte ili ukinite\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Koristite dokaze i pravila vlasništva da odlučite o sledećem stanju životnog ciklusa.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-15\">Gde se jednostavan primer zaustavlja\u003C\u002Fh2>\n\u003Cp>Velike organizacije retko upravljaju jednim AI sistemom izolovano. Isti model može da podrži desetine proizvoda; jedan provajder može da obrađuje nekoliko klasa podataka; agentska platforma može da izloži deljene alate mnogim timovima.\u003C\u002Fp>\n\u003Cp>Zato su upravljanju potrebne strukture na nivou portfolija, kao i kontrole na nivou sistema: inventar AI, odobreni provajderi, katalozi modela, zajedničke osnove evaluacije, bezbednosni obrasci, pragovi rizika, registri izuzetaka i mapiranja vlasništva.\u003C\u002Fp>\n\u003Cp>Upravljanje takođe ne može biti identično za svaku upotrebu AI. Sumarizator javnog sadržaja, interni asistent za kodiranje, sistem za podršku zapošljavanju i agent koji može da inicira plaćanja imaju bitno različite profile posledica i kontrola.\u003C\u002Fp>\n\u003Ch2 id=\"section-19\">Šta upravljanje veštačkom inteligencijom jeste — a šta nije\u003C\u002Fh2>\n\u003Csection class=\"editorjs-comparison my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Upravljanje veštačkom inteligencijom u poređenju sa srodnim disciplinama\u003C\u002Fh3>\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left dark:border-gray-700 dark:bg-gray-900\">\u003C\u002Fth>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left font-semibold dark:border-gray-700 dark:bg-gray-900\">Upravljanje veštačkom inteligencijom\u003C\u002Fth>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left font-semibold dark:border-gray-700 dark:bg-gray-900\">Srodna disciplina\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Enterprise \u002F solution arhitektura\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Upravljanje rizikom veštačke inteligencije\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Usklađenost\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Bezbednost\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">MLOps \u002F LLMOps\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Principi etike veštačke inteligencije\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-21\">Upravljanje je šire od usklađenosti\u003C\u002Fh2>\n\u003Cp>Usklađenost je jedan od inputa za upravljanje, a ne ceo sistem upravljanja. Slučaj upotrebe veštačke inteligencije može biti pravno dozvoljen, a da i dalje krši apetit za rizik kompanije, bezbednosnu politiku, ugovorne obaveze ili zahteve kvaliteta proizvoda.\u003C\u002Fp>\n\u003Cp>I obrnuto je važno: interno odobrenje ne nadjačava zakon. Upravljanje treba da učini primenljive pravne obaveze vidljivim unutar istog puta odlučivanja koji se koristi za arhitekturu, bezbednost i poslovni rizik.\u003C\u002Fp>\n\u003Cp>ISO\u002FIEC 42001 eksplicitno definiše sistem upravljanja veštačkom inteligencijom kao strukturisan način za uspostavljanje politika, ciljeva i procesa za odgovornu veštačku inteligenciju. ISO takođe navodi da standard ne zamenjuje zakone ili propise; on pruža okvir upravljanja koji može da podrži usklađenost.\u003C\u002Fp>\n\u003Ch2 id=\"section-25\">NIST AI RMF i ISO\u002FIEC 42001 rešavaju različite potrebe upravljanja\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Okvir \u002F standard\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Primarna uloga\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Korisna vrednost za upravljanje\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">NIST AI RMF 1.0\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Dobrovoljni okvir za upravljanje rizikom veštačke inteligencije\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Organizuje ishode oko GOVERN, MAP, MEASURE i MANAGE kroz životni ciklus\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">NIST AI 600-1\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Profil za generativnu veštačku inteligenciju za AI RMF\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Dodaje razmatranja i radnje specifične za rizik GenAI\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">ISO\u002FIEC 42001:2023\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Zahtevi za sistem upravljanja veštačkom inteligencijom\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Stvara organizacioni sistem upravljanja sa politikom, ulogama, procesima i stalnim poboljšanjem\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">ISO\u002FIEC 23894:2023\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Smernice za upravljanje rizikom veštačke inteligencije\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Usmerava integraciju upravljanja rizikom specifičnim za veštačku inteligenciju u organizacione aktivnosti\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">EU AI Act\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Obavezujuća regulativa u EU\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Stvara pravne obaveze u zavisnosti od aktera, kategorije veštačke inteligencije i slučaja upotrebe\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>Ovi izvori ne treba da se spoje u jednu kontrolnu listu. NIST AI RMF su smernice za upravljanje rizikom. ISO\u002FIEC 42001 je standard za sistem upravljanja. EU AI Act je zakon. Organizacija može da ih koristi zajedno, ali njihov autoritet, obim i svrha implementacije su različiti.\u003C\u002Fp>\n\u003Ch2 id=\"section-28\">Trenutni vremenski okvir EU AI Act je važan\u003C\u002Fh2>\n\u003Cp>Od 8. oktobra 2026, Evropska komisija navodi da je AI Act postao opšte primenljiv 2. avgusta 2026. Odredbe o zabranjenim praksama i AI pismenosti primenjivale su se od 2. februara 2025, dok su se pravila upravljanja i obaveze za modele veštačke inteligencije opšte namene primenjivale od 2. avgusta 2025.\u003C\u002Fp>\n\u003Cp>Trenutne smernice Komisije takođe odražavaju kasnije datume primene za određene zahteve visokog rizika. Tačni datumi i pravila tranzicije su promenljiv input za usklađenost i treba ih proveriti u odnosu na aktuelne materijale Komisije pre odluke o uvođenju.\u003C\u002Fp>\n\u003Caside class=\"editorjs-callout editorjs-callout--warning my-6 rounded-xl border p-5 border-amber-300 bg-amber-50 dark:border-amber-900 dark:bg-amber-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Članak o arhitekturi, ne pravni savet\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">Regulatorni primeri ovde objašnjavaju zašto su upravljanju potrebni verzionisani pravni\u002Fkomplijans inputi. Oni ne određuju da li je određeni proizvod pravno klasifikovan kao zabranjen, visokog rizika, GPAI, korisnik, pružalac ili drugi regulisani akter.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Ch2 id=\"section-32\">Upravljanje veštačkom inteligencijom počinje popisom\u003C\u002Fh2>\n\u003Cp>Organizacija ne može da upravlja sistemima veštačke inteligencije koje ne može da identifikuje. Popis treba da obuhvati više od prilagođeno obučenih modela. Može da uključi eksterne API-je modela, ugrađene kopilote, lokalne modele, AI funkcije u SaaS-u, runtime agenata, sisteme za pretragu i komponente automatizovanog odlučivanja.\u003C\u002Fp>\n\u003Cp>Koristan popis povezuje AI sposobnost sa njenim poslovnim vlasnikom, tehničkim vlasnikom, slučajem upotrebe, korisnicima, klasama podataka, modelom\u002Fpružaocem, okruženjem za uvođenje, dozvolama, klasifikacijom rizika, statusom evaluacije, primenljivim obavezama i stanjem životnog ciklusa.\u003C\u002Fp>\n\u003Cp>Popis nije samo tabela za revizore. To je indeks koji omogućava organizaciji da zna šta mora da se pregleda kada se pružalac promeni, pojavi ranjivost, regulativa postane primenljiva ili model bude povučen.\u003C\u002Fp>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Polje popisa\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Zašto je upravljanju potrebno\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Slučaj upotrebe \u002F svrha\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Definiše zašto veštačka inteligencija postoji i šta znači uspeh\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Poslovni vlasnik\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Vlasnik ishoda i poslovnog rizika\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Tehnički vlasnik\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Vlasnik arhitekture, implementacije i rada\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Model + verzija\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Identifikuje zavisnost koja proizvodi ponašanje\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Pružalac \u002F runtime\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Identifikuje ugovornu, hosting i operativnu zavisnost\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Klase podataka\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Određuje privatnost, poverljivost i ograničenja izvora istine\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Korisnici \u002F pogođene strane\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Određuje izloženost i kontekst uticaja na ljude\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Alati \u002F radnje\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Određuje autonomiju i rizik od neželjenih efekata\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Dozvole \u002F identitet\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Definiše ko ili šta može da pozove sposobnost\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Klasifikacija rizika\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Određuje potrebne kontrole i put odobravanja\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Dokazi o evaluaciji\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Pokazuje da li je predviđeno ponašanje testirano\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Stanje životnog ciklusa\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Nacrt, pregled, odobreno, ograničeno, obustavljeno ili povučeno\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Datum pregleda \u002F okidači\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Definiše kada odluka o upravljanju mora ponovo da se razmotri\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-37\">Upravljanje zahteva imenovano vlasništvo\u003C\u002Fh2>\n\u003Cp>Neuspesi AI cesto prelaze organizacione granice. Problem kvaliteta modela moze postati neuspeh proizvoda, bezbednosni problem, incident privatnosti ili ugovorni prekrsaj. Upravljanje zahteva imenovane vlasnike pre nego sto se incident dogodi.\u003C\u002Fp>\n\u003Cp>Vlasnistvo ne znaci da je jedna osoba odgovorna za sve. Snazan model razdvaja prava odlucivanja: poslovni vlasnik, vlasnik proizvoda, tehnicki vlasnik, vlasnik podataka, strucnjaci za bezbednost\u002Fprivatnost, pravni\u002Fuskladenost akteri i operativna podrska.\u003C\u002Fp>\n\u003Cp>Kriticno svojstvo je da svaka potrebna odluka ima vlasnika i da svaki vlasnik zna koje dokaze treba da pregleda.\u003C\u002Fp>\n\u003Ch2 id=\"section-41\">Prava odlucivanja treba da budu eksplicitna\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Odluka\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Tipicna odgovorna funkcija\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Moze li ovaj AI slucaj upotrebe postojati?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Poslovni\u002Fvlasnik proizvoda uz input upravljanja\u002Frizika\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Moze li se ova klasa podataka obradjivati?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Vlasnik podataka + privatnost\u002Fbezbednost prema politici\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Moze li se ovaj provajder\u002Fmodel koristiti?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Arhitektura\u002Fplatforma + bezbednost\u002Fnabavka + upravljanje\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Moze li ovaj agent izvrsiti ovu radnju?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Vlasnik aplikacije + vlasnik autorizacije\u002Fposlovne politike\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Da li je kvalitet dovoljan za implementaciju?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Vlasnik proizvoda\u002Ftehnicki vlasnik prema definisanim kriterijumima prihvatanja\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Moze li se preostali rizik prihvatiti?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Imenovani vlasnik rizika na odgovarajucem nivou ovlascenja\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Moze li se odobriti izuzetak?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Eksplicitno ovlascenje za izuzetak, vremenski ograniceno i dokumentovano\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Treba li sistem suspendovati?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Operativni\u002Fposlovni vlasnik pod incidentom ili okidacima rizika\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Moze li nadogradnja modela biti pustena u rad?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Vlasnik promene nakon dokaza o regresiji\u002Fevaluaciji\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-43\">Upravljanje modelom je vise od izbora modela\u003C\u002Fh2>\n\u003Cp>Upravljanje modelom prati koji se model koristi, u koju svrhu, pod kojom konfiguracijom i dokazima. Ovo se primenjuje na eksterne API-je, lokalno hostovane modele, fino podesene modele i modele ugradjene u softver trecih strana.\u003C\u002Fp>\n\u003Cp>Odluka o modelu treba da uzme u obzir sposobnost, rezultate evaluacije, trosak, latenciju, rukovanje podacima, uslove provajdera, podrsku zivotnog ciklusa, geografska\u002F hosting ogranicenja, bezbednost, ponasanje pri fallback-u i posledice promene verzije.\u003C\u002Fp>\n\u003Cp>Aliasi modela kao sto je „latest“ mogu biti operativno zgodni ali slabe reproduktivnost ako se ponasanje menja bez upravljanog procesa izdanja. Sistemi sa posledicama imaju koristi od eksplicitnog pracenja verzija i evaluacije regresije.\u003C\u002Fp>\n\u003Ch2 id=\"section-47\">Upravljanje provajderom je odvojen sloj zavisnosti\u003C\u002Fh2>\n\u003Cp>Dva sistema koja koriste istu familiju modela mogu imati razlicit rizik upravljanja ako jedan radi lokalno a drugi salje podatke eksternom provajderu. Upravljanje provajderom pokriva ugovorne uslove, lokaciju obrade, zadrzavanje, logovanje, podprocesore, dostupnost, ukidanje i strategiju izlaska.\u003C\u002Fp>\n\u003Cp>Apstrakcija provajdera moze smanjiti tehnicko zakljucavanje, ali ne uklanja posao upravljanja. Zamena provajdera moze promeniti tokove podataka, ponasanje modela, bezbednosne pretpostavke, trosak i obaveze uskladenosti.\u003C\u002Fp>\n\u003Cp>Lista odobrenih provajdera se stoga ne sme tumaciti kao „svaki model i svaka klasa podataka od ovog provajdera je automatski odobrena.“ Odobrenje zahteva obim.\u003C\u002Fp>\n\u003Ch2 id=\"section-51\">Upravljanje podacima ostaje sloj izvora istine\u003C\u002Fh2>\n\u003Cp>AI upravljanje ne cini model autoritetom za organizacione cinjenice. Upravljanje podacima i dalje odredjuje vlasnistvo, klasifikaciju, zadrzavanje, kvalitet i dozvoljenu upotrebu izvornih podataka.\u003C\u002Fp>\n\u003Cp>Za RAG i agente, upravljanje treba da identifikuje koji izvori su autoritativni, koji su savetodavni, kako se cuva provenijencija, koji podaci mogu uci u kontekst modela i koje granice zakupca\u002Fkorisnika moraju biti primenjene.\u003C\u002Fp>\n\u003Cp>Generisani izlazi takodje stvaraju nova pitanja upravljanja podacima: da li se promptovi i odgovori zadrzavaju, ko moze pristupiti tragovima, da li generisani rezimei postaju zapisi i kako se izvedeni embedding-ovi ili indeksi brisu kada se izvorni podaci uklone.\u003C\u002Fp>\n\u003Ch2 id=\"section-55\">Dozvole su upravljačke odluke sa primenom u vreme izvršavanja\u003C\u002Fh2>\n\u003Cp>Agentna AI čini dozvole upravljačkim objektom prvog reda. Organizacija treba da odluči kojim alatima, datotekama, API-jima, bazama podataka i sporednim efektima svaki agent ili korisnik može da pristupi.\u003C\u002Fp>\n\u003Cp>Upravljanje definiše politiku i logiku odobravanja; pouzdano izvršno okruženje ih sprovodi. Uputstva na prirodnom jeziku kao što je „ne briši datoteke“ nisu zamena za autorizaciju na nivou datotečnog sistema, API-ja ili servisa.\u003C\u002Fp>\n\u003Cp>Isti princip važi i za izolaciju zakupaca: uloga može da autorizuje operaciju, dok opseg zakupca ograničava čijim resursima kupaca ta operacija može da pristupi.\u003C\u002Fp>\n\u003Ch2 id=\"section-59\">Klasifikacija rizika treba da menja skup kontrola\u003C\u002Fh2>\n\u003Cp>Nije svakom AI sistemu potrebna ista dubina pregleda. Upravljanje postaje skalabilno kada klasifikacija rizika menja zahteve za dokazima, odobravanjem i nadzorom.\u003C\u002Fp>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Pokretač rizika\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Primer sa nižom kontrolom\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Primer sa višom kontrolom\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Poslovna posledica\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Izrada nacrta internog teksta\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Odobravanje finansijskog poravnanja\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Uticaj na ljude\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Opciona pomoć pri pisanju\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Podrška odlučivanju o zaposlenju ili podobnosti\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Osetljivost podataka\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Javna dokumentacija\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Zdravstveni, HR, finansijski ili poverljivi podaci\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Autonomija\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Preporuka samo za čitanje\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Agent sa alatima za pisanje\u002Fplaćanje\u002Fobjavljivanje\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Reverzibilnost\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Lako regenerisan rezime\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Nepovratna eksterna transakcija\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Izloženost\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Mali interni pilot\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Javni sistem ili sistem okrenut kupcima u velikom obimu\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Autoritet izvora\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sadržaj savetodavne prirode\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sistem na koji se oslanja za regulisane ili ugovorne činjenice\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Uočljivost greške\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Očigledan nedostatak u formatiranju\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Uverljiva, ali suštinski pogrešna preporuka\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>Metod klasifikacije može biti jednostavan ili sofisticiran, ali treba da se preslika u konkretne posledice: više testiranja, uža ovlašćenja, obavezan ljudski nadzor, bezbednosni pregled, prihvatanje rizika od strane rukovodstva ili zabranu uvođenja.\u003C\u002Fp>\n\u003Ch2 id=\"section-63\">Upravljanje mora da očuva kontekst slučaja upotrebe\u003C\u002Fh2>\n\u003Cp>NIST-ova funkcija MAP naglašava predviđenu svrhu, korisnike, kontekst uvođenja, pretpostavke, uticaje i primenljive zakone ili norme. To je važno jer isti model može biti niskog rizika u jednom slučaju upotrebe, a sa visokim posledicama u drugom.\u003C\u002Fp>\n\u003Cp>Zapisi o upravljanju bi stoga trebalo da klasifikuju aplikaciju, a ne samo model. „Koristimo model X“ nije dovoljno da se odredi rizik.\u003C\u002Fp>\n\u003Cp>Relevantni upravljački objekat je sistem\u002Fslučaj upotrebe: model + podaci + kontekst + alati + korisnici + okruženje za uvođenje + poslovni proces.\u003C\u002Fp>\n\u003Ch2 id=\"section-67\">Evaluacija je dokaz za upravljanje\u003C\u002Fh2>\n\u003Cp>Proces upravljanja AI-jem ne bi trebalo da odobri uvođenje samo na osnovu prodavčevih referentnih vrednosti ili uspešne demonstracije. Sistemu su potrebni dokazi povezani sa njegovom stvarnom predviđenom upotrebom.\u003C\u002Fp>\n\u003Cp>Korisni dokazi mogu uključivati evaluaciju uspešnosti zadatka, kvalitet pronalaženja, činjeničnu utemeljenost, bezbednosne testove, testove dozvola, adversarne scenarije, studije ljudskog pregleda, latenciju\u002Ftroškove, robusnost i poređenja regresija.\u003C\u002Fp>\n\u003Cp>NIST-ova funkcija MEASURE to eksplicitno naglašava: organizacije treba da identifikuju i primene odgovarajuće metode i metrike za rizike identifikovane tokom mapiranja, uz dokumentovanje rizika koji ne mogu ili neće biti mereni.\u003C\u002Fp>\n\u003Caside class=\"editorjs-callout editorjs-callout--success my-6 rounded-xl border p-5 border-emerald-300 bg-emerald-50 dark:border-emerald-900 dark:bg-emerald-950\u002F20\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Kapija upravljanja treba da traži dokaze, a ne samopouzdanje\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">„Tim smatra da je model dovoljno dobar“ je slab artefakt odobrenja. „Sistem je ispunio definisane kriterijume prihvatanja na reprezentativnim testovima, uz ova poznata ograničenja i preostale rizike“ može se upravljati.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Ch2 id=\"section-72\">Kapije upravljanja treba da postoje tokom celog životnog ciklusa\u003C\u002Fh2>\n\u003Csection class=\"editorjs-process my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Primeri kapija životnog ciklusa\u003C\u002Fh3>\u003Cdiv class=\"grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4\">\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">1\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Kapija ideje \u002F otkrivanja\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Potvrdite poslovnu svrhu, vlasnika i da li je AI odgovarajuće rešenje.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">2\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Arhitektonska kapija\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Pregledajte model\u002Fprovajdera, tok podataka, identitet, dozvole, izolaciju i operativni dizajn.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">3\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Kapija rizika\u002Fusaglašenosti\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Klasifikujte rizik i primenljive obaveze; definišite potrebne kontrole.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">4\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Kapija validacije\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Zahtevajte dokaz da su funkcionalni, bezbednosni, sigurnosni i kriterijumi kvaliteta ispunjeni.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">5\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Kapija implementacije\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Odobrite konkretnu konfiguraciju, verziju, okruženje i operativnog vlasnika.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">6\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Kapija promene\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Ponovo procenite promene modela\u002Fprovajdera\u002Falata\u002Fpodataka u skladu sa materijalnošću.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">7\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Kapija incidenta\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Pauzirajte, ograničite ili vratite unazad kada se pojave definisani okidači rizika.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">8\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">Kapija ukidanja\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Uklonite pristup, izvedene podatke, akreditive i zastarele zavisnosti na čist način.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-74\">Upravljanje promenama je centralno za AI upravljanje\u003C\u002Fh2>\n\u003Cp>AI sistemi se menjaju čak i kada se kod aplikacije ne menja. Provajderi ažuriraju modele, sigurnosne filtere, ograničenja konteksta, cene, politike i infrastrukturu. Korpusi za pretragu se menjaju. Alati agenata dobijaju dozvole. Propisi i ugovori se razvijaju.\u003C\u002Fp>\n\u003Cp>Upravljanje bi stoga trebalo da definiše okidače materijalnih promena. Manje prilagođavanje formulacije upita može zahtevati obične regresione testove; zamena modela, omogućavanje alata za pisanje ili uvođenje osetljivih podataka može zahtevati novu kapiju odobrenja.\u003C\u002Fp>\n\u003Cp>Zapis o upravljanju treba da sačuva koja je verzija odobrena i koji uslovi su učinili odobrenje važećim.\u003C\u002Fp>\n\u003Ch2 id=\"section-78\">Izuzeci zahtevaju vlasnike, rok trajanja i kompenzujuće kontrole\u003C\u002Fh2>\n\u003Cp>Stvarne organizacije zahtevaju izuzetke. Timu može biti potreban neodobreni model za vremenski ograničen eksperiment, ili nasleđeni sistem možda još ne ispunjava novi zahtev za evidentiranje.\u003C\u002Fp>\n\u003Cp>Opasan obrazac je trajni nedokumentovani izuzetak. Izuzeci kojima se može upravljati preciziraju vlasnika, obrazloženje, obim, preostali rizik, kompenzujuću kontrolu, datum isteka i uslov pregleda.\u003C\u002Fp>\n\u003Cp>Rukovanje izuzecima treba da bude deo normalnog sistema upravljanja, a ne neformalni sporedni kanal.\u003C\u002Fp>\n\u003Ch2 id=\"section-82\">Revizibilnost je sposobnost rekonstrukcije odluke i izvršenja\u003C\u002Fh2>\n\u003Cp>AI revizibilnost nije samo čuvanje upita modela. To znači biti u mogućnosti da se rekonstruiše koja je verzija sistema korišćena, koji podaci i dozvole su primenjeni, ko je odobrio konfiguraciju, koje evaluacije su podržale implementaciju i šta se dogodilo tokom relevantnog izvršenja.\u003C\u002Fp>\n\u003Cp>Za agenta, to može zahtevati identitet principala, pozive alata, odobrenja, ciljne resurse, promene stanja i ishode. Za RAG, to može zahtevati verziju korpusa\u002Findeksa, upit za pretragu, izabrane dokaze i poreklo. Za promenu modela, to može zahtevati prethodne i nove rezultate evaluacije.\u003C\u002Fp>\n\u003Cp>Revizijski dokazi treba da budu proporcionalni. Evidentiranje svakog mogućeg tokena može stvoriti sopstveni rizik za privatnost i bezbednost. Upravljanje treba da definiše koji dokazi su neophodni, koliko dugo se čuvaju i ko može da im pristupi.\u003C\u002Fp>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Revizijski objekat\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Korisni dokazi\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Odluka o upravljanju\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Vlasnik, datum, odluka, uslovi, dokazi, izuzeci\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Izdanje modela\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Model\u002Fprovajder\u002Fverzija, konfiguracija, rezultati regresije\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Pristup podacima\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Principal, zakupac\u002Fobim, klasa izvora, odluka o politici\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Akcija agenta\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Alat, argumenti\u002Fcilj, odobrenje, rezultat, promena stanja\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">RAG odgovor\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Verzija korpusa\u002Findeksa, skup pretrage, izabrani dokazi, citati\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Incident\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Okidač, pogođeni sistemi, obuzdavanje, vlasnik odluke, sanacija\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ukidanje\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Onemogućeni endpointi, opozvane akreditive, izbrisani izvedeni podaci, odluka o arhiviranju\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-87\">Nadzor zatvara petlju upravljanja\u003C\u002Fh2>\n\u003Cp>Odobrenje je snimak stanja. Nadzor u produkciji govori upravljanju da li pretpostavke iza odobrenja još uvek važe.\u003C\u002Fp>\n\u003Cp>Korisni signali zavise od slučaja upotrebe: regresija kvaliteta, nesigurni izlazi, kvarovi alata, odbijanja politike, neuobičajeni troškovi, latencija, pritužbe korisnika, drift, svežina pretrage, incidenti provajdera, bezbednosna upozorenja ili nove regulatorne klasifikacije.\u003C\u002Fp>\n\u003Cp>Upravljanje treba da definiše pragove koji izazivaju akciju: istražiti, ograničiti, zahtevati ljudski pregled, vratiti unazad, promeniti provajdera, suspendovati ili ukinuti.\u003C\u002Fp>\n\u003Ch2 id=\"section-91\">AI incidenti zahtevaju definisan operativni put\u003C\u002Fh2>\n\u003Cp>AI-specifični incidenti mogu uključivati štetni sadržaj, curenje podataka, neovlašćene radnje, trajni činjenični neuspeh, prekid rada modela\u002Fpružaoca usluga, prompt injection, cross-tenant pretragu ili neočekivano ponašanje nakon ažuriranja modela.\u003C\u002Fp>\n\u003Cp>Proces za incidente treba da poveže tehnički odgovor sa upravljačkim vlasništvom. Neko mora biti ovlašćen da onemogući model, ukloni alat, opozove akreditive, ograniči korisnike, obavesti pogođene funkcije i odluči da li sistem može da se vrati u upotrebu.\u003C\u002Fp>\n\u003Cp>Naučene lekcije iz incidenata treba da ažuriraju politike, testove, klasifikaciju rizika i kontrole platforme koje se mogu ponovo koristiti, umesto da ostanu izolovane u jednom timu.\u003C\u002Fp>\n\u003Ch2 id=\"section-95\">Nabavka je deo AI upravljanja\u003C\u002Fh2>\n\u003Cp>Organizacije mogu steći značajne AI sposobnosti kroz običnu SaaS nabavku. Upravljanje stoga treba da pokriva i kupljene AI funkcije i interne inženjerske sisteme.\u003C\u002Fp>\n\u003Cp>Procena dobavljača može uključivati korišćenje podataka, zadržavanje, politiku obuke modela, podprocesore, bezbednost, obaveštavanje o incidentima, izvoz\u002Fbrisanje, geografsku obradu, promenu verzije, kontinuitet usluge i ugovorni izlaz.\u003C\u002Fp>\n\u003Cp>Pregled tehničke arhitekture i pregled nabavke treba da dele isti inventar sistema kako komercijalno odobrenje ne bi odstupilo od stvarnog toka podataka u upotrebi.\u003C\u002Fp>\n\u003Ch2 id=\"section-99\">Ljudski nadzor treba da bude dizajniran, a ne samo deklarisan\u003C\u002Fh2>\n\u003Cp>„Čovek u petlji“ ima smisla samo ako čovek ima ovlašćenje, vreme, informacije i upotrebljiv mehanizam intervencije.\u003C\u002Fp>\n\u003Cp>Recenzent koji vidi samo AI preporuku, ali ne i njene dokaze, neizvesnost ili stanje izvora, može jednostavno automatski odobriti izlaz. Upravljanje treba da precizira šta recenzent može da pregleda i koje su radnje dostupne: odobri, odbije, izmeni, eskalira ili zaustavi.\u003C\u002Fp>\n\u003Cp>Ljudski nadzor takođe treba da se zasniva na riziku. Sistemi sa malim posledicama mogu koristiti uzorkovanje ili naknadni pregled, dok efekti sa velikim posledicama mogu zahtevati odobrenje pre izvršenja.\u003C\u002Fp>\n\u003Ch2 id=\"section-103\">Upravljanje platformom i upravljanje slučajevima upotrebe su različiti\u003C\u002Fh2>\n\u003Csection class=\"editorjs-comparison my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Dva nivoa upravljanja\u003C\u002Fh3>\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left dark:border-gray-700 dark:bg-gray-900\">\u003C\u002Fth>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left font-semibold dark:border-gray-700 dark:bg-gray-900\">Deljena AI platforma\u003C\u002Fth>\u003Cth class=\"border border-gray-300 bg-gray-50 px-4 py-3 text-left font-semibold dark:border-gray-700 dark:bg-gray-900\">Pojedinačni slučaj upotrebe AI\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Primarna briga\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Tipično odobrenje\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Dokazi\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-3 text-left font-semibold dark:border-gray-700\">Neuspeh upravljanja\u003C\u002Fth>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-3 dark:border-gray-700\">\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Cp>Odobrenje platforme stoga treba da smanji ponavljanje posla, a ne da eliminiše odgovornost za slučaj upotrebe. „Model je odobren“ je različito od „ova primena modela je odobrena.“\u003C\u002Fp>\n\u003Ch2 id=\"section-106\">AI upravljanje i Enterprise AI arhitektura\u003C\u002Fh2>\n\u003Cp>Enterprise AI arhitektura opisuje kako se AI sistemi, platforme, podaci, identiteti, pružaoci usluga, operacije i organizacioni sistemi uklapaju zajedno. AI upravljanje opisuje sistem odlučivanja i kontrole koji određuje kako se te arhitekture mogu kreirati i menjati.\u003C\u002Fp>\n\u003Cp>Njih dvoje su tesno povezani. Upravljanje bez arhitekture može postati apstraktna politika. Arhitektura bez upravljanja može proizvesti tehnički elegantne sisteme sa nejasnim vlasništvom, nekontrolisanim usvajanjem pružalaca usluga ili nepregledanim rizikom.\u003C\u002Fp>\n\u003Cp>Najjači dizajn je dvosmeran: zahtevi upravljanja postaju arhitektonske kontrole, dok arhitektura otkriva stvarne odluke koje upravljanje mora da preuzme.\u003C\u002Fp>\n\u003Ch2 id=\"section-110\">Dokazi iz originalnog projekta\u003C\u002Fh2>\n\u003Ch3 id=\"section-111\">Enterprise Aaasaasa 0.1: upravljanje kao struktura isporuke\u003C\u002Fh3>\n\u003Caside class=\"editorjs-callout editorjs-callout--note my-6 rounded-xl border p-5 border-gray-300 bg-gray-50 dark:border-gray-700 dark:bg-gray-900\u002F40\" role=\"note\">\u003Cstrong class=\"block mb-2 text-gray-900 dark:text-gray-100\">Dokazi projekta \u002F PoC-a\u003C\u002Fstrong>\u003Cdiv class=\"text-gray-700 dark:text-gray-200\">Enterprise Aaasaasa 0.1 predstavlja dokaze projekta i obuke\u002FPoC-a, a ne dokaz komercijalnog usvajanja u preduzeću. Ovde je koristan jer njegova struktura isporuke eksplicitno povezuje arhitekturu, prekretnice, rizike, zainteresovane strane, validaciju i projektne odluke.\u003C\u002Fdiv>\u003C\u002Faside>\n\u003Cp>Enterprise Aaasaasa 0.1 koristi definisane prekretnice za zahteve, arhitekturu, prototip, validaciju i zatvaranje projekta. Ta struktura ilustruje osnovni princip upravljanja: tranzicije životnog ciklusa treba da imaju eksplicitne izlaze i tačke odlučivanja umesto neformalnog procesa „prvo izgradi, pa pregledaj kasnije“.\u003C\u002Fp>\n\u003Cp>Projekat takođe prati rizike kao što su širenje obima, kašnjenje arhitekture i zabrinutosti vezane za AI\u002FGDPR i identifikuje grupe zainteresovanih strana uključujući sponzorstvo, upravni odbor, arhitekturu, bezbednost, marketing, eksterne API-je i hosting.\u003C\u002Fp>\n\u003Cp>Ovo ne predstavlja ISO\u002FIEC 42001 sistem upravljanja. To su uži projektni dokazi koji pokazuju kako se vlasništvo, rizik, prekretnice i validacija mogu integrisati u tehničku isporuku.\u003C\u002Fp>\n\u003Ch3 id=\"section-116\">SenseFlow: sledljivost zahteva i odluka\u003C\u002Fh3>\n\u003Cp>SenseFlow koristi strukturisan put od cilja proizvoda i korisničke potrebe kroz epove, korisničke priče, kriterijume prihvatanja, arhitekturu, implementaciju i validaciju. Zapisi o odlukama čuvaju odluku, obrazloženje, alternative, kompromise, status i datum\u002Fverziju.\u003C\u002Fp>\n\u003Cp>Taj obrazac sledljivosti je direktno relevantan za upravljanje jer AI kontrola treba da se poveže sa zahtevom ili rizikom koji ju je opravdao. Sistem upravljanja postaje jači kada se lanac od poslovne potrebe do arhitektonske odluke do dokaza validacije može rekonstruisati.\u003C\u002Fp>\n\u003Ch3 id=\"section-119\">Aaasaasa AI Client: dozvole i vreme izvršavanja kao upravljana konfiguracija\u003C\u002Fh3>\n\u003Cp>Aaasaasa AI Client razdvaja provajdera, model, lokaciju izvršavanja i dozvole umesto da ih tretira kao jedno „AI podešavanje“. Centralni profili dozvola radnog prostora upravljaju pristupom alatima, Direct Chat nema alate za fajl sistem\u002Fšel, a okruženja sposobna za agente rade pod eksplicitnim profilima dozvola.\u003C\u002Fp>\n\u003Cp>To razdvajanje pokazuje važan obrazac upravljanja: izbor modela i autoritet za delovanje treba da budu nezavisni konfiguracijski objekti. Jači model automatski ne dobija šire dozvole za fajl sistem, šel ili poslovanje.\u003C\u002Fp>\n\u003Cp>Dokazi implementacije su arhitektonski, a ne tvrdnja da aplikacija predstavlja sertifikovani organizacioni sistem upravljanja AI-jem.\u003C\u002Fp>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Uočeni obrazac projekta\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Lekcija upravljanja\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Kapije prekretnica\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Tranzicije životnog ciklusa mogu zahtevati eksplicitne dokaze\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Registar rizika\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Poznate neizvesnosti postaju upravljani objekti umesto neformalnih briga\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Mapiranje zainteresovanih strana\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Odgovornost za odlučivanje može se namerno rasporediti\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Kriterijumi prihvatanja + validacija\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Odluke o uvođenju mogu zavisiti od dokaza\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Zapisi o odlukama\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Arhitektonski kompromisi ostaju sledljivi\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Odvojeni model\u002Fprovajder\u002Fvreme izvršavanja\u002Fdozvole\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sposobnost i autoritet mogu se upravljati nezavisno\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Eksplicitne oznake zrelosti projekta\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">PoC dokazi se ne predstavljaju pogrešno kao produkcijski ili tržišni dokaz\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-124\">Uobičajeni načini neuspeha upravljanja AI-jem\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Način neuspeha\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Šta ide naopako\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Upravljanje je samo PDF sa politikom\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Timovi ne mogu da prevedu politiku u kontrole u vreme izvršavanja ili odluke o uvođenju\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Nema inventara AI-ja\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Organizacija ne može da identifikuje gde se koriste modeli, agenti ili ugrađeni AI\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Odobrenje modela se tretira kao odobrenje slučaja upotrebe\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Odobreni model se koristi za suštinski drugačiji kontekst rizika\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Nema imenovanog poslovnog vlasnika\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Tehnički timovi po defaultu nasleđuju odluke o poslovnom riziku\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Klasifikacija rizika nema posledicu na kontrolu\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Svaki sistem dobija isti pregled bez obzira na posledice\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Dozvole žive samo u promptovima\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Instrukcije modela postaju zamena za stvarnu autorizaciju\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Promena provajdera je nevidljiva\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Pretpostavke o ponašanju\u002Fpodacima\u002Fusaglašenosti se menjaju bez ponovne evaluacije\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Uspeh demo-a je dokaz za odobrenje\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Produkcijski rizik se zaključuje iz malog testa srećnog puta\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ljudski nadzor je ceremonijalan\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Recenzent ne može da pregleda dokaze ili zaustavi radnju\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Izuzetak nema rok isteka\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Privremeno zaobilazno rešenje postaje trajni dug upravljanja\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Logovi postoje ali ne mogu da rekonstruišu odluke\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Revizibilnost se meša sa čuvanjem sirovih podataka\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Usaglašenost sama poseduje upravljanje\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Proizvod, inženjering, bezbednost i operacije se isključuju iz odgovornosti\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Svaka odluka ide centralnom odboru\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Upravljanje postaje usko grlo umesto skalabilnog sistema kontrole\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-126\">Centralno upravljanje ne znači centralizaciju svake odluke\u003C\u002Fh2>\n\u003Cp>Zrela organizacija može centralizovati politiku, kontrolne obrasce i eskalaciju, dok istovremeno delegira odluke niskog rizika produktnim ili platformskim timovima.\u003C\u002Fp>\n\u003Cp>Ovaj federativni model skalira se bolje od zahteva da centralni komitet odobrava svaku izmenu prompta. Centralna funkcija definiše nivoe rizika, obavezne kontrole, politiku provajdera, ovlašćenja za izuzetke i zahteve za reviziju; timovi deluju autonomno unutar tih granica.\u003C\u002Fp>\n\u003Cp>Cilj dizajna je dosledna odgovornost, a ne maksimalna centralizacija.\u003C\u002Fp>\n\u003Ch2 id=\"section-130\">Upravljajte samim sistemom upravljanja\u003C\u002Fh2>\n\u003Cp>Upravljanje zahteva povratne informacije. U suprotnom, kontrole mogu postati skupi rituali koji ne smanjuju rizik.\u003C\u002Fp>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Metrika \u002F signal\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Šta može otkriti\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Pokrivenost inventara\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Da li je usvajanje AI vidljivo upravljanju\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Vreme do odluke\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Da li upravljanje nepotrebno blokira isporuku\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Broj i starost izuzetaka\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Da li su politike realistične ili se rutinski zaobilaze\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Stopa neuspeha evaluacije\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Da li kontrole pre implementacije otkrivaju defekte\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Stopa incidenata nakon implementacije\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Da li dokazi o odobrenju predviđaju ponašanje u produkciji\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Stopa odbijanja neovlašćenih alata\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Da li se granice dozvola aktivno sprovode\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Učestalost promena modela\u002Fprovajdera\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Koliko često odobrene pretpostavke mogu postati zastarele\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Sistemi u penziji ali aktivni\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Neuspeh čišćenja\u002Fkontrole životnog ciklusa\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ponavljajući obrasci incidenata\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Da li lekcije postaju ponovo upotrebljive platformske kontrole\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>Metrike upravljanja ne bi trebalo da nagrađuju obim papirologije. Korisna mera je da li se kvalitet odlučivanja, sledljivost, detekcija rizika i bezbedna isporuka poboljšavaju.\u003C\u002Fp>\n\u003Ch2 id=\"section-134\">Praktičan redosled implementacije AI upravljanja\u003C\u002Fh2>\n\u003Csection class=\"editorjs-process my-6\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Izgradite upravljanje od vidljivosti do kontrole\u003C\u002Fh3>\u003Cdiv class=\"grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4\">\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">1\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">1. Definišite obim upravljanja\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Odlučite koji su interno izgrađeni, kupljeni, ugrađeni i eksperimentalni AI sistemi obuhvaćeni.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">2\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">2. Kreirajte AI inventar\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Zabeležite vlasnike, slučajeve upotrebe, modele\u002Fprovajdere, podatke, alate, korisnike, stanje životnog ciklusa i klasu rizika.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">3\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">3. Definišite prava odlučivanja\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Odredite ko može da odobrava provajdere, upotrebu podataka, prihvatanje rizika, izuzetke, implementaciju i stavljanje van upotrebe.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">4\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">4. Uspostavite nivoe rizika\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Mapirajte posledice i izloženost na različite zahteve kontrola.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">5\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">5. Definišite ponovo upotrebljive minimalne kontrole\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Postavite osnovne zahteve za identitet, dozvole, podatke, bezbednost, evaluaciju, evidentiranje i ljudski nadzor.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">6\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">6. Povežite upravljanje sa arhitekturom\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Pretvorite politiku u platformske\u002Fruntime kontrole koje timovi ne mogu slučajno da zaobiđu.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">7\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">7. Izgradite kapije zasnovane na dokazima\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Zahtevajte relevantne dokaze o evaluaciji, bezbednosti, privatnosti, arhitekturi i usklađenosti pre prelaza u životnom ciklusu.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">8\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">8. Upravljajte promenama modela\u002Fprovajdera\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Pratite verzije, zastarevanje i materijalne promene uz dokaze o regresiji.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">9\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">9. Dodajte nadzor i okidače incidenata\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Definišite koji produkcijski signali prisiljavaju na istragu, ograničenje ili suspenziju.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">10\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">10. Formalizujte izuzetke\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Zahtevajte obim, vlasnika, preostali rizik, kompenzujuće kontrole i rok isteka.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">11\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">11. Revidirajte odluke i izvršenje\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Čuvajte proporcionalne dokaze koji povezuju vlasnike, konfiguraciju, dozvole, evaluacije i značajne radnje.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv class=\"editorjs-process__step min-w-0  rounded-xl border border-gray-200 dark:border-gray-700 p-4\">\u003Cdiv class=\"text-xs font-semibold text-gray-500 dark:text-gray-400\">12\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 font-semibold text-gray-900 dark:text-gray-100\">12. Poboljšajte sistem upravljanja\u003C\u002Fdiv>\u003Cdiv class=\"mt-1 text-sm text-gray-600 dark:text-gray-300\">Koristite incidente, kašnjenja i ponavljajuće izuzetke za reviziju kontrola i platformskih obrazaca.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-136\">Kontrolna lista za AI upravljanje\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Pitanje\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Očekivani dokaz upravljanja\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Zašto ovaj AI sistem postoji?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Svrha, poslovni vlasnik i nameravani ishod\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ko upravlja tehničkim radom?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Imenovani tehnički\u002Fplatformski vlasnik\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Koji model\u002Fprovajder\u002Fverzija se koristi?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Registrovana i verzionisana zavisnost\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Koji podaci mogu ući u sistem?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Klasifikacija, ovlašćenje i odluka o dozvoljenoj upotrebi\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Koji identiteti ga mogu koristiti?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Model autentifikacije i autorizacije\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Koje radnje može izvršiti?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Matrica alata\u002Fdozvola i granica autonomije\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Koji je nivo rizika?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Dokumentovana klasifikacija sa obrazloženjem\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Koje kontrole su obavezne?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Osnovne kontrole za nivo rizika\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Kako je evaluiran?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Reprezentativni testovi i kriterijumi prihvatanja\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Ko je prihvatio preostali rizik?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Imenovani odgovorni organ\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Šta zahteva ljudski pregled?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Eksplicitna pravila nadzora\u002Fodobravanja\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Šta se evidentira?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Politika revizije\u002Fopservabilnosti proporcionalna posledicama\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Šta pokreće ponovni pregled?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Događaji promene modela\u002Fprovajdera\u002Fpodataka\u002Falata\u002Fregulative\u002Fmaterijalnih promena\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Kako se može suspendovati?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Operativni put za prekid\u002Fograničenje i vlasnik\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Kako se stavlja van upotrebe?\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Čišćenje akreditiva, podataka, izvedenih vrednosti, endpointa i zapisa\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-138\">Uobičajene zablude\u003C\u002Fh2>\n\u003Cdiv class=\"overflow-x-auto\">\u003Ctable class=\"w-full border-collapse\">\u003Cthead>\u003Ctr>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Zabluda\u003C\u002Fth>\u003Cth class=\"border border-gray-300 px-4 py-2 text-left font-semibold\">Ispravka\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">„AI upravljanje je usklađenost.“\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Usklađenost je jedan input upravljanja; upravljanje takođe pokriva vlasništvo, arhitekturu, dozvole, kvalitet, rizik i odluke o životnom ciklusu.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">„Upravljanje znači revizorski komitet.“\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Komiteti mogu odobravati izuzetke ili sisteme visokog rizika, ali mnoge kontrole treba ugraditi u normalnu isporuku i platformsku arhitekturu.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">„Odobreni model je bezbedan za svaku upotrebu.“\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Rizik pripada slučaju upotrebe i kontekstu sistema, ne samo modelu.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">„Dobavljač upravlja umesto nas.“\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Provajder kontroliše deo steka; organizacija i dalje poseduje svoj slučaj upotrebe, podatke, dozvole i poslovne posledice.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">„Čovek u petlji automatski rešava rizik.“\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Nadzor funkcioniše samo kada recenzenti imaju ovlašćenja, kontekst i sposobnost intervencije.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">„Evidentiranje svega daje revizibilnost.“\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Revizibilnost zahteva rekonstruktivne relevantne dokaze sa kontrolisanim čuvanjem i pristupom.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">„Upravljanje blokira inovacije.“\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Loše upravljanje može blokirati isporuku; dobro dizajnirano upravljanje stvara ponovo upotrebljive bezbedne puteve i jasnije vlasništvo nad odlukama.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">„Pilot projekti niskog rizika ne zahtevaju upravljanje.“\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Mogu koristiti lagano upravljanje, ali inventar, vlasništvo i granice podataka\u002Falata su i dalje važni.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">„Lokalni AI zahteva manje upravljanja.“\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Lokalni hosting može promeniti rizik privatnosti\u002Fprovajdera, ali kvalitet modela, dozvole, bezbednost i upravljanje životnim ciklusom ostaju.\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd class=\"border border-gray-300 px-4 py-2\">„Jednom odobren, sistem ostaje odobren.“\u003C\u002Ftd>\u003Ctd class=\"border border-gray-300 px-4 py-2\">Model, provajder, podaci, regulativa i upotreba se mogu promeniti; odluke upravljanja zahtevaju okidače za reviziju.\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Ch2 id=\"section-140\">Granični slučajevi i ograničenja\u003C\u002Fh2>\n\u003Cp>Vrlo male organizacije možda ne zahtevaju namensku funkciju AI upravljanja. Isti principi mogu se primeniti kroz lagane arhitekturne odluke, registre rizika, mapiranja vlasnika i kapije izdanja.\u003C\u002Fp>\n\u003Cp>Visoko regulisane organizacije mogu zahtevati mnogo formalnije upravljanje, nezavisno uveravanje, dokumentovane procese usklađenosti i pravno tumačenje nego što ovaj članak na arhitektonskom nivou opisuje.\u003C\u002Fp>\n\u003Cp>Open-source i samostalno hostovani modeli smanjuju neke zavisnosti od provajdera, ali stvaraju druge: zakrpe, poreklo modela, evaluaciju, bezbednost infrastrukture, licenciranje i operativno vlasništvo.\u003C\u002Fp>\n\u003Cp>AI modeli opšte namene mogu se koristiti u mnogim kontekstima. Upravljanje treba da izbegne pretpostavku da kontrole modela na nivou provajdera u potpunosti određuju rizik aplikacije nizvodno.\u003C\u002Fp>\n\u003Cp>Nijedan okvir upravljanja ne garantuje da je AI sistem bezbedan ili ispravan. Upravljanje poboljšava odgovornost i kvalitet odluka; tehnička validacija, praćenje i ljudska procena ostaju neophodni.\u003C\u002Fp>\n\u003Ch2 id=\"section-146\">Šta bi promenilo ovaj odgovor?\u003C\u002Fh2>\n\u003Cp>Tačan skup kontrola menja se u zavisnosti od zakona, industrije, veličine organizacije, osetljivosti podataka, autonomije, modela uvođenja i poslovnih posledica.\u003C\u002Fp>\n\u003Cp>NIST trenutno revidira AI RMF 1.0, tako da se buduća NIST terminologija ili preporučene prakse mogu promeniti. ISO standardi takođe mogu biti revidirani, a smernice i detalji tranzicije EU AI Act-a nastavljaju da se razvijaju.\u003C\u002Fp>\n\u003Cp>Stabilan arhitektonski princip je da AI odluke zahtevaju eksplicitne vlasnike, dokaze, dozvole, tretman rizika i pregled životnog ciklusa, umesto da budu skrivene unutar konfiguracije modela ili aplikacije.\u003C\u002Fp>\n\u003Ch2 id=\"section-150\">Povezano kanonsko znanje\u003C\u002Fh2>\n\u003Cp>AI upravljanje zavisi od koncepata koji su već razdvojeni na drugim mestima u ovom grafu znanja: Izvor istine određuje autoritet, RBAC i izolacija zakupaca ograničavaju pristup, inženjering konteksta kontroliše informacije vidljive modelu, a agentna arhitektura definiše kako alati i akcije ulaze u izvršnu petlju.\u003C\u002Fp>\n\u003Cp>Enterprise AI Architecture je nadređeni koncept organizacione arhitekture. Upravljanje je operativni kontrolni sloj koji određuje kako se ti enterprise AI komponenti mogu uvesti, menjati i ukinuti.\u003C\u002Fp>\n\u003Cp>Agentni sistemi povećavaju zahteve upravljanja jer odluke modela mogu postati stvarne posledice. Kontrole dozvola, odobrenja i revizije stoga moraju postojati izvan samog modela.\u003C\u002Fp>\n\u003Caside class=\"editorjs-referral my-6\">\u003Ca href=\"https:\u002F\u002Fstajic.de\u002Fsr\u002Fblog\u002Fai-agent-reliability-why-the-final-answer-is-not-enough\" class=\"flex flex-col sm:flex-row gap-4 rounded-xl border border-gray-200 dark:border-gray-700 p-4 transition hover:border-primary-500\">\u003Cdiv class=\"min-w-0 flex-1\">\u003Cstrong class=\"block text-lg text-gray-900 dark:text-gray-100\">Pouzdanost AI agenata: Zašto konačan odgovor nije dovoljan\u003C\u002Fstrong>\u003Cp class=\"mt-2 text-sm text-gray-600 dark:text-gray-300\">Upravljanje agentima zahteva dokaze o izvršnim putanjama, korišćenju alata, promenama stanja i mogućnosti oporavka — ne samo o kvalitetu konačnog izlaza.\u003C\u002Fp>\u003Cspan class=\"mt-3 inline-flex text-sm font-medium text-primary-600 dark:text-primary-400\">Pročitajte članak o pouzdanosti agenata →\u003C\u002Fspan>\u003C\u002Fdiv>\u003C\u002Fa>\u003C\u002Faside>\n\u003Caside class=\"editorjs-referral my-6\">\u003Ca href=\"https:\u002F\u002Fstajic.de\u002Fsr\u002Fblog\u002Fai-agent-memory-is-not-rag-how-to-separate-memory-retrieval-state-and-context\" class=\"flex flex-col sm:flex-row gap-4 rounded-xl border border-gray-200 dark:border-gray-700 p-4 transition hover:border-primary-500\">\u003Cdiv class=\"min-w-0 flex-1\">\u003Cstrong class=\"block text-lg text-gray-900 dark:text-gray-100\">Memorija AI agenata nije RAG: Kako razdvojiti memoriju, pretragu, stanje i kontekst\u003C\u002Fstrong>\u003Cp class=\"mt-2 text-sm text-gray-600 dark:text-gray-300\">Upravljanje zahteva različite politike za trajnu memoriju, autoritativno stanje, preuzete informacije i privremeni kontekst modela.\u003C\u002Fp>\u003Cspan class=\"mt-3 inline-flex text-sm font-medium text-primary-600 dark:text-primary-400\">Pročitajte članak o arhitekturi memorije →\u003C\u002Fspan>\u003C\u002Fdiv>\u003C\u002Fa>\u003C\u002Faside>\n\u003Caside class=\"editorjs-referral my-6\">\u003Ca href=\"https:\u002F\u002Fstajic.de\u002Fsr\u002Fblog\u002Fthe-answer-validity-boundary-the-missing-layer-between-relevance-and-reliable-ai-answers\" class=\"flex flex-col sm:flex-row gap-4 rounded-xl border border-gray-200 dark:border-gray-700 p-4 transition hover:border-primary-500\">\u003Cdiv class=\"min-w-0 flex-1\">\u003Cstrong class=\"block text-lg text-gray-900 dark:text-gray-100\">Granica valjanosti odgovora: Sloj koji nedostaje između relevantnosti i pouzdanih AI odgovora\u003C\u002Fstrong>\u003Cp class=\"mt-2 text-sm text-gray-600 dark:text-gray-300\">Odluke upravljanja treba da očuvaju uslove pod kojima dokazi i odobrenje ostaju valjani, uključujući verziju, obim, izvor i vreme.\u003C\u002Fp>\u003Cspan class=\"mt-3 inline-flex text-sm font-medium text-primary-600 dark:text-primary-400\">Pročitajte Granicu valjanosti odgovora →\u003C\u002Fspan>\u003C\u002Fdiv>\u003C\u002Fa>\u003C\u002Faside>\n\u003Ch2 id=\"section-157\">Često postavljana pitanja\u003C\u002Fh2>\n\u003Csection class=\"editorjs-faq my-6 rounded-xl border border-gray-200 p-5 dark:border-gray-700\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">AI upravljanje — često postavljana pitanja\u003C\u002Fh3>\u003Cdiv id=\"faq1\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">Šta je AI upravljanje?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">AI upravljanje je sistem vlasništva, prava odlučivanja, kontrola i dokaza koji se koristi za upravljanje načinom na koji se AI sistemi razvijaju, nabavljaju, uvode, koriste, menjaju i ukidaju.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq2\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">Da li je AI upravljanje isto što i upravljanje AI rizikom?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Ne. Upravljanje rizikom identifikuje, procenjuje i tretira rizik. Upravljanje definiše ko mora da obavi taj posao, koje odluke ga zahtevaju i koji dokazi ili autoritet su potrebni.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq3\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">Da li je AI upravljanje isto što i usklađenost?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Ne. Usklađenost se odnosi na primenljive zakonske, regulatorne, ugovorne ili interne obaveze. Upravljanje integriše usklađenost sa arhitekturom, bezbednošću, podacima, kvalitetom, dozvolama i poslovnim vlasništvom.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq4\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">Koja je razlika između AI upravljanja i Enterprise AI Architecture?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Enterprise AI Architecture definiše kako se AI sposobnosti i sistemi uklapaju u organizaciju. AI upravljanje definiše sistem odlučivanja i kontrole koji upravlja načinom na koji se ti komponenti mogu uvesti, koristiti i menjati.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq5\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">Da li su male kompanije potrebne AI upravljanje?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Da, ali ne nužno i namenski odsek. Lagani inventar, vlasništvo, dozvole, evaluacija i kontrole promena mogu primeniti iste principe.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq6\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">Šta treba da sadrži AI inventar?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Najmanje: slučaj upotrebe, vlasnike, model\u002Fprovajdera\u002Fverziju, klase podataka, korisnike, alate\u002Fakcije, dozvole, klasifikaciju rizika, status evaluacije, stanje životnog ciklusa i okidače pregleda.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq7\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">Da li korišćenje odobrenog modela znači da je slučaj upotrebe odobren?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Ne. Rizik zavisi od konteksta primene: podataka, korisnika, alata, autonomije, posledica i poslovnog procesa.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq8\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">Šta čini AI sistem revizibilnim?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Organizacija može da rekonstruiše relevantno vlasništvo, odobrenu konfiguraciju, model\u002Fprovajdera\u002Fverziju, kontekst podataka\u002Fdozvola, dokaze evaluacije, značajne akcije i odluke o životnom ciklusu.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003Cdiv id=\"faq9\" class=\"border-t border-gray-200 py-4 first:border-t-0 dark:border-gray-700\">\u003Ch4 class=\"font-semibold text-gray-900 dark:text-gray-100\">Koliko često treba pregledati odluke AI upravljanja?\u003C\u002Fh4>\u003Cdiv class=\"mt-2 text-gray-600 dark:text-gray-300\">Koristite intervale pregleda zasnovane na riziku plus okidače događaja kao što su promene modela\u002Fprovajdera, novi podaci, novi alati, incidenti, materijalna promena performansi ili regulatorna ažuriranja.\u003C\u002Fdiv>\u003C\u002Fdiv>\u003C\u002Fsection>\n\u003Ch2 id=\"section-159\">Pojmovnik\u003C\u002Fh2>\n\u003Csection class=\"editorjs-glossary my-6 rounded-xl border border-gray-200 dark:border-gray-700 p-5\">\u003Ch3 class=\"mb-3 text-lg font-semibold\">Ključni pojmovi AI upravljanja\u003C\u002Fh3>\u003Cdl>\u003Cdiv id=\"ai-governance\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">AI upravljanje\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Organizacioni sistem vlasništva, prava odlučivanja, kontrola i dokaza koji upravlja životnim ciklusom AI.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"ai-management-system\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">AI sistem upravljanja\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Međusobno povezane organizacione politike, ciljevi i procesi za odgovoran razvoj, pružanje ili korišćenje AI; ISO\u002FIEC 42001 specificira zahteve za takav sistem.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"ai-inventory\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">AI inventar\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Registar AI sistema, modela, provajdera, slučajeva upotrebe, vlasnika, podataka, klasifikacija rizika i stanja životnog ciklusa.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"risk-owner\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Vlasnik rizika\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Imenovani autoritet odgovoran za odlučivanje o tome kako se definisani rizik tretira ili da li se prihvata preostali rizik.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"control\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Kontrola\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Tehnička, organizaciona ili proceduralna mera namenjena sprečavanju, otkrivanju, smanjenju ili odgovoru na rizik.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"governance-gate\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Kapija upravljanja\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Tačka odlučivanja u životnom ciklusu u kojoj su definisani dokazi i autoritet potrebni pre nastavka.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"residual-risk\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Preostali rizik\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Rizik koji ostaje nakon primene kontrola ili ublažavanja.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"exception\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Izuzetak\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Eksplicitno, obimom ograničeno i obično vremenski ograničeno ovlašćenje za odstupanje od normalnog zahteva upravljanja.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"auditability\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Revizibilnost\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Sposobnost rekonstrukcije relevantnih odluka, konfiguracija, dokaza, identiteta i događaja izvršavanja.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"model-governance\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Upravljanje modelom\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Kontrole i odluke koje pokrivaju izbor modela, verzionisanje, evaluaciju, dozvoljenu upotrebu, promenu i ukidanje.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"provider-governance\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Upravljanje provajderom\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Kontrole koje pokrivaju zavisnosti od spoljnih ili internih AI provajdera, rukovanje podacima, bezbednost, ugovore, životni ciklus i izlaz.\u003C\u002Fdd>\u003C\u002Fdiv>\u003Cdiv id=\"human-oversight\" class=\"border-t border-gray-200 dark:border-gray-700 py-3 first:border-t-0\">\u003Cdt class=\"font-semibold text-gray-900 dark:text-gray-100\">Ljudski nadzor\u003C\u002Fdt>\u003Cdd class=\"mt-1 text-gray-600 dark:text-gray-300\">Projektovana sposobnost ljudskog pregleda ili intervencije za AI odluke ili akcije u definisanim tačkama.\u003C\u002Fdd>\u003C\u002Fdiv>\u003C\u002Fdl>\u003C\u002Fsection>\n\u003Ch2 id=\"section-161\">Zaključak\u003C\u002Fh2>\n\u003Cp>AI upravljanje je organizaciona kontrolna ravan oko AI. Ono daje imena i dokaze odlukama koje bi inače ostale skrivene unutar koda, podešavanja provajdera, upita ili neformalne procene tima.\u003C\u002Fp>\n\u003Cp>Snažno upravljanje povezuje kompletan sistem: poslovnu svrhu, modele, pružaoce usluga, autoritet nad podacima, identitet, dozvole, evaluaciju, rizik, usklađenost, nadzor, incidente, promene i ukidanje.\u003C\u002Fp>\n\u003Cp>Praktični cilj nije maksimalan proces. To je minimalna struktura upravljanja koja omogućava da važne AI odluke budu vlasnički definisane, zasnovane na dokazima, sprovodive, pregledne i revizorske tokom celog životnog ciklusa.\u003C\u002Fp>\n\u003Ch2 id=\"section-165\">Primarni izvori i aktuelne reference\u003C\u002Fh2>\n\u003Cp>Izvori navedeni u nastavku pružaju aktuelno eksterno utemeljenje za upravljanje AI, rizik i regulativu. Sekcije projekta predstavljaju originalne dokaze o implementaciji\u002Fprojektu i eksplicitno se razlikuju od formalnih standarda ili sertifikovanih sistema upravljanja.\u003C\u002Fp>\n\u003Ca href=\"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">NIST — Okvir za upravljanje rizicima AI\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Aktuelno NIST čvorište za AI RMF 1.0, reviziju u toku, GenAI profil i povezane resurse za upravljanje rizicima.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fairc.nist.gov\u002Fairmf-resources\u002Fairmf\u002F5-sec-core\u002F\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">NIST AIRC — AI RMF jezgro\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Zvanično AI RMF jezgro koje opisuje GOVERN, MAP, MEASURE i MANAGE, pri čemu je GOVERN funkcija koja se proteže kroz ceo životni ciklus.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework\u002Fnist-ai-rmf-playbook\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">NIST — AI RMF priručnik\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Predložene akcije za operacionalizaciju pouzdanosti i upravljanja rizicima tokom životnog ciklusa AI.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.nist.gov\u002Fpublications\u002Fartificial-intelligence-risk-management-framework-generative-artificial-intelligence\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">NIST AI 600-1 — Profil generativne AI\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">NIST prateći profil koji primenjuje koncepte AI RMF na rizike generativne AI i upravljanje životnim ciklusom.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F42001\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">ISO\u002FIEC 42001:2023 — Sistemi upravljanja AI\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Međunarodni standard koji specificira zahteve za uspostavljanje, implementaciju, održavanje i kontinuirano unapređenje sistema upravljanja AI.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F77304.html\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">ISO\u002FIEC 23894:2023 — Upravljanje rizicima AI\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Međunarodne smernice za integraciju upravljanja rizicima specifičnim za AI u organizacione aktivnosti i funkcije.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Fpolicies\u002Fregulatory-framework-ai\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">Evropska komisija — AI akt\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Aktuelni pregled Komisije o EU AI aktu, vremenskom okviru primene i okviru za implementaciju.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Ffaqs\u002Fnavigating-ai-act\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">Evropska komisija — Navigacija kroz AI akt\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Aktuelna često postavljana pitanja koja pokrivaju upravljanje, sprovođenje, implementaciju i vremenski okvir primene koji se razvija.\u003C\u002Fp>\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Ffactpages\u002Fgeneral-purpose-ai-obligations-under-ai-act\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"editorjs-link-tool block border border-gray-200 dark:border-gray-700 rounded-lg p-4 transition text-gray-900 dark:text-gray-100 hover:border-primary-500 hover:bg-primary-50 dark:hover:bg-gray-900 hover:text-gray-900 dark:hover:text-gray-100\">\u003Cstrong class=\"block font-semibold\">Evropska komisija — Obaveze za AI opšte namene\u003C\u002Fstrong>\u003Cp class=\"text-sm text-gray-600 dark:text-gray-400\">Aktuelni pregled obaveza u vezi sa dokumentacijom, autorskim pravima, sadržajem za obuku i sistemskim rizicima za pružaoce GPAI.\u003C\u002Fp>\u003C\u002Fa>",{"time":212,"blocks":213,"version":1718},1791486081883,[214,220,228,235,242,250,255,260,265,270,275,280,285,290,322,327,332,337,342,347,387,392,397,402,407,412,441,446,451,456,461,467,472,477,482,487,534,539,544,549,554,559,594,599,604,609,614,619,624,629,634,639,644,649,654,659,664,669,674,679,684,725,730,735,740,745,750,755,760,765,770,777,782,812,817,822,827,832,837,842,847,852,857,862,867,872,901,906,911,916,921,926,931,936,941,946,951,956,961,966,971,976,981,986,1015,1020,1025,1030,1035,1040,1045,1050,1056,1061,1066,1071,1076,1081,1086,1091,1096,1101,1106,1135,1140,1187,1192,1197,1202,1207,1212,1217,1252,1257,1262,1304,1309,1362,1367,1405,1410,1415,1420,1425,1430,1435,1440,1445,1450,1455,1460,1465,1470,1475,1484,1492,1500,1505,1547,1552,1606,1611,1616,1621,1626,1631,1636,1646,1655,1664,1673,1682,1691,1700,1709],{"id":215,"data":216,"type":218,"tunes":219},"intro",{"text":217},"Upravljanje veštačkom inteligencijom je sistem prava odlučivanja, odgovornosti, kontrola i dokaza koji se koriste za odlučivanje o tome kako organizacija može da razvija, nabavlja, uvodi, upravlja, menja i ukida AI sisteme. Ono je šire od dokumenta politike i uže od cele enterprise arhitekture. Efikasno upravljanje AI povezuje vlasništvo nad poslom, izbor modela i provajdera, nadležnost nad podacima, dozvole, klasifikaciju rizika, evaluaciju, monitoring, rukovanje incidentima, proverljivost i odluke o životnom ciklusu, tako da neko može da odgovori ne samo na pitanje „da li AI radi?“ već i na pitanje „ko ga je odobrio, pod kojim uslovima, uz koje dokaze i kada ta odluka mora ponovo da se razmotri?“","paragraph",{},{"id":221,"data":222,"type":226,"tunes":227},"direct",{"body":223,"title":224,"variant":225},"\u003Cstrong>Upravljanje AI pretvara AI iz neformalne tehničke sposobnosti u odgovornu organizacionu sposobnost.\u003C\u002Fstrong>\u003Cbr>\u003Cbr>Arhitektura određuje kako se sistem gradi. Inženjering ga implementira. Upravljanje rizikom procenjuje neizvesnost i štetu. Usklađenost se bavi primenljivim obavezama. Upravljanje povezuje ove aktivnosti kroz vlasništvo, prava odlučivanja, potrebne kontrole, dokaze i kapije životnog ciklusa.","Direktan odgovor","info","callout",{},{"id":229,"data":230,"type":226,"tunes":234},"boundary",{"body":231,"title":232,"variant":233},"Odbor za upravljanje može biti jedan mehanizam, a politike mogu dokumentovati očekivanja, ali upravljanje postaje operativno tek kada odluke menjaju ono što sistemima sme da se dozvoli: koji modeli smeju da se koriste, koji podaci smeju da uđu u njih, koje alate agent sme da izvršava, koje evaluacije su obavezne, ko može da odobri izuzetke, šta mora da se beleži i šta pokreće suspenziju ili ukidanje.","Upravljanje nije komitet i nije PDF","warning",{},{"id":236,"data":237,"type":226,"tunes":241},"current",{"body":238,"title":239,"variant":240},"NIST AI RMF 1.0 ostaje trenutno objavljeni okvir dok ga NIST revidira. Njegovo jezgro je organizovano oko \u003Cstrong>GOVERN, MAP, MEASURE i MANAGE\u003C\u002Fstrong>, pri čemu je GOVERN funkcija koja seče kroz sve ostale. ISO\u002FIEC 42001:2023 ostaje međunarodni standard za sistem upravljanja AI za uspostavljanje, rad i kontinuirano unapređenje sistema upravljanja AI. EU AI Act je sada opšte primenljiv od 2. avgusta 2026, dok su neke obaveze imale ranije datume primene, a neki zahtevi za visokorizične sisteme imaju kasnije datume prelaska. Regulatorni rokovi uvek treba ponovo da se provere pre donošenja konkretne odluke o usklađenosti.","Napomena o aktuelnim izvorima — 8. oktobar 2026.","note",{},{"id":243,"data":244,"type":248,"tunes":249},"toc",{"title":245,"maxLevel":246,"minLevel":247},"Sadržaj",3,2,"tableOfContents",{},{"id":251,"data":252,"type":42,"tunes":254},"h-meaning",{"text":253,"level":247},"Šta upravljanje AI zaista znači",{},{"id":256,"data":257,"type":218,"tunes":259},"p-meaning-1",{"text":258},"Upravljanje AI odgovara na organizaciona pitanja na koja model, SDK ili dijagram arhitekture ne mogu sami da odgovore. Ko je vlasnik poslovnog ishoda? Ko može da odobri novog provajdera? Koje klase podataka je zabranjeno obrađivati eksterno? Koji dokazi su potrebni pre uvođenja? Koje dozvole agent može da dobije? Ko može da prihvati preostali rizik? Šta se dešava kada model promeni ponašanje nakon nadogradnje?",{},{"id":261,"data":262,"type":218,"tunes":264},"p-meaning-2",{"text":263},"Cilj nije da se spreči promena. Dobro upravljanje čini promenu čitljivom: odluke imaju vlasnike, dokaze, uslove, izuzetke, datume revizije i puteve vraćanja ili eskalacije.",{},{"id":266,"data":267,"type":218,"tunes":269},"p-meaning-3",{"text":268},"Zato NIST postavlja GOVERN kroz ceo životni ciklus upravljanja rizikom AI, umesto da upravljanje tretira kao jedan završni korak odobravanja. Upravljanje uspostavlja kulturu, politike, odgovornost i organizacione strukture koje omogućavaju mapiranje, merenje i upravljanje rizikom AI.",{},{"id":271,"data":272,"type":42,"tunes":274},"h-simple",{"text":273,"level":247},"Najjednostavniji primer",{},{"id":276,"data":277,"type":218,"tunes":279},"p-simple-1",{"text":278},"Produktni tim želi da doda eksternog provajdera generativne AI za sumiranje internih tiketa korisničke podrške. Tehnički, integracija može da zahteva samo API poziv.",{},{"id":281,"data":282,"type":218,"tunes":284},"p-simple-2",{"text":283},"Upravljanje postavlja drugi skup pitanja: Da li je sadržaj tiketa dozvoljeno izneti iz okruženja organizacije? Koji provajder i verzija modela su odobreni? Da li je zadržavanje onemogućeno? Koji korisnici mogu da pozovu tu funkciju? Kako se evaluira izlaz? Da li je potrebna ljudska provera? Šta se beleži? Ko je vlasnik incidenata? Šta se dešava ako provajder promeni uslove ili ponašanje modela?",{},{"id":286,"data":287,"type":218,"tunes":289},"p-simple-3",{"text":288},"Rezultat upravljanja i dalje može biti „uvesti to“. Razlika je u tome što je uvođenje sada odluka koja se može pratiti, sa izričitim uslovima, umesto nezabeleženog inženjerskog izbora.",{},{"id":291,"data":292,"type":320,"tunes":321},"simple-flow",{"steps":293,"title":318,"orientation":319},[294,297,300,303,306,309,312,315],{"label":295,"description":296},"1. Registrujte slučaj upotrebe","Zabeležite svrhu, vlasnika, korisnike, podatke, model\u002Fprovajdera i željeni ishod.",{"label":298,"description":299},"2. Klasifikujte rizik i obaveze","Utvrdite poslovne posledice, osetljivost podataka, autonomiju, regulatornu izloženost i potencijal zloupotrebe.",{"label":301,"description":302},"3. Definišite potrebne kontrole","Navedite dozvole, rukovanje podacima, evaluacije, ljudski nadzor, bezbednost, evidentiranje i ograničenja provajdera.",{"label":304,"description":305},"4. Prikupite dokaze","Sprovedite testove, bezbednosnu\u002Fproveru privatnosti, pregled arhitekture i relevantne pravne\u002Fprovere usklađenosti.",{"label":307,"description":308},"5. Donesite odluku","Odobrite, odobrite uz uslove, zatražite izmene, zadržite ili odbijte.",{"label":310,"description":311},"6. Uvedite pod kontrolisanom konfiguracijom","Fiksirajte odobreni model\u002Fprovajdera\u002Fruntime i sprovedite potrebne granice.",{"label":313,"description":314},"7. Nadzirite i ponovo procenjujte","Pratite incidente, kvalitet, drift, promene provajdera, nove rizike i promenjene propise.",{"label":316,"description":317},"8. Izmenite, suspendujte ili ukinite","Koristite dokaze i pravila vlasništva da odlučite o sledećem stanju životnog ciklusa.","Osnovna upravljana AI odluka","auto","processFlow",{},{"id":323,"data":324,"type":42,"tunes":326},"h-stops",{"text":325,"level":247},"Gde se jednostavan primer zaustavlja",{},{"id":328,"data":329,"type":218,"tunes":331},"p-stops-1",{"text":330},"Velike organizacije retko upravljaju jednim AI sistemom izolovano. Isti model može da podrži desetine proizvoda; jedan provajder može da obrađuje nekoliko klasa podataka; agentska platforma može da izloži deljene alate mnogim timovima.",{},{"id":333,"data":334,"type":218,"tunes":336},"p-stops-2",{"text":335},"Zato su upravljanju potrebne strukture na nivou portfolija, kao i kontrole na nivou sistema: inventar AI, odobreni provajderi, katalozi modela, zajedničke osnove evaluacije, bezbednosni obrasci, pragovi rizika, registri izuzetaka i mapiranja vlasništva.",{},{"id":338,"data":339,"type":218,"tunes":341},"p-stops-3",{"text":340},"Upravljanje takođe ne može biti identično za svaku upotrebu AI. Sumarizator javnog sadržaja, interni asistent za kodiranje, sistem za podršku zapošljavanju i agent koji može da inicira plaćanja imaju bitno različite profile posledica i kontrola.",{},{"id":343,"data":344,"type":42,"tunes":346},"h-not",{"text":345,"level":247},"Šta upravljanje veštačkom inteligencijom jeste — a šta nije",{},{"id":348,"data":349,"type":385,"tunes":386},"not-comparison",{"rows":350,"title":376,"layout":377,"columns":378},[351,356,360,364,368,372],{"id":352,"label":353,"values":354},"architecture","Enterprise \u002F solution arhitektura",[355,355],"",{"id":357,"label":358,"values":359},"risk","Upravljanje rizikom veštačke inteligencije",[355,355],{"id":361,"label":362,"values":363},"compliance","Usklađenost",[355,355],{"id":365,"label":366,"values":367},"security","Bezbednost",[355,355],{"id":369,"label":370,"values":371},"mlops","MLOps \u002F LLMOps",[355,355],{"id":373,"label":374,"values":375},"ethics","Principi etike veštačke inteligencije",[355,355],"Upravljanje veštačkom inteligencijom u poređenju sa srodnim disciplinama","table",[379,382],{"id":380,"label":381},"governance","Upravljanje veštačkom inteligencijom",{"id":383,"label":384},"adjacent","Srodna disciplina","comparison",{},{"id":388,"data":389,"type":42,"tunes":391},"h-governance-compliance",{"text":390,"level":247},"Upravljanje je šire od usklađenosti",{},{"id":393,"data":394,"type":218,"tunes":396},"p-compliance-1",{"text":395},"Usklađenost je jedan od inputa za upravljanje, a ne ceo sistem upravljanja. Slučaj upotrebe veštačke inteligencije može biti pravno dozvoljen, a da i dalje krši apetit za rizik kompanije, bezbednosnu politiku, ugovorne obaveze ili zahteve kvaliteta proizvoda.",{},{"id":398,"data":399,"type":218,"tunes":401},"p-compliance-2",{"text":400},"I obrnuto je važno: interno odobrenje ne nadjačava zakon. Upravljanje treba da učini primenljive pravne obaveze vidljivim unutar istog puta odlučivanja koji se koristi za arhitekturu, bezbednost i poslovni rizik.",{},{"id":403,"data":404,"type":218,"tunes":406},"p-compliance-3",{"text":405},"ISO\u002FIEC 42001 eksplicitno definiše sistem upravljanja veštačkom inteligencijom kao strukturisan način za uspostavljanje politika, ciljeva i procesa za odgovornu veštačku inteligenciju. ISO takođe navodi da standard ne zamenjuje zakone ili propise; on pruža okvir upravljanja koji može da podrži usklađenost.",{},{"id":408,"data":409,"type":42,"tunes":411},"h-frameworks",{"text":410,"level":247},"NIST AI RMF i ISO\u002FIEC 42001 rešavaju različite potrebe upravljanja",{},{"id":413,"data":414,"type":377,"tunes":440},"framework-table",{"content":415,"stretched":43,"withHeadings":14},[416,420,424,428,432,436],[417,418,419],"Okvir \u002F standard","Primarna uloga","Korisna vrednost za upravljanje",[421,422,423],"NIST AI RMF 1.0","Dobrovoljni okvir za upravljanje rizikom veštačke inteligencije","Organizuje ishode oko GOVERN, MAP, MEASURE i MANAGE kroz životni ciklus",[425,426,427],"NIST AI 600-1","Profil za generativnu veštačku inteligenciju za AI RMF","Dodaje razmatranja i radnje specifične za rizik GenAI",[429,430,431],"ISO\u002FIEC 42001:2023","Zahtevi za sistem upravljanja veštačkom inteligencijom","Stvara organizacioni sistem upravljanja sa politikom, ulogama, procesima i stalnim poboljšanjem",[433,434,435],"ISO\u002FIEC 23894:2023","Smernice za upravljanje rizikom veštačke inteligencije","Usmerava integraciju upravljanja rizikom specifičnim za veštačku inteligenciju u organizacione aktivnosti",[437,438,439],"EU AI Act","Obavezujuća regulativa u EU","Stvara pravne obaveze u zavisnosti od aktera, kategorije veštačke inteligencije i slučaja upotrebe",{},{"id":442,"data":443,"type":218,"tunes":445},"p-framework-1",{"text":444},"Ovi izvori ne treba da se spoje u jednu kontrolnu listu. NIST AI RMF su smernice za upravljanje rizikom. ISO\u002FIEC 42001 je standard za sistem upravljanja. EU AI Act je zakon. Organizacija može da ih koristi zajedno, ali njihov autoritet, obim i svrha implementacije su različiti.",{},{"id":447,"data":448,"type":42,"tunes":450},"h-current-eu",{"text":449,"level":247},"Trenutni vremenski okvir EU AI Act je važan",{},{"id":452,"data":453,"type":218,"tunes":455},"p-eu-1",{"text":454},"Od 8. oktobra 2026, Evropska komisija navodi da je AI Act postao opšte primenljiv 2. avgusta 2026. Odredbe o zabranjenim praksama i AI pismenosti primenjivale su se od 2. februara 2025, dok su se pravila upravljanja i obaveze za modele veštačke inteligencije opšte namene primenjivale od 2. avgusta 2025.",{},{"id":457,"data":458,"type":218,"tunes":460},"p-eu-2",{"text":459},"Trenutne smernice Komisije takođe odražavaju kasnije datume primene za određene zahteve visokog rizika. Tačni datumi i pravila tranzicije su promenljiv input za usklađenost i treba ih proveriti u odnosu na aktuelne materijale Komisije pre odluke o uvođenju.",{},{"id":462,"data":463,"type":226,"tunes":466},"eu-boundary",{"body":464,"title":465,"variant":233},"Regulatorni primeri ovde objašnjavaju zašto su upravljanju potrebni verzionisani pravni\u002Fkomplijans inputi. Oni ne određuju da li je određeni proizvod pravno klasifikovan kao zabranjen, visokog rizika, GPAI, korisnik, pružalac ili drugi regulisani akter.","Članak o arhitekturi, ne pravni savet",{},{"id":468,"data":469,"type":42,"tunes":471},"h-inventory",{"text":470,"level":247},"Upravljanje veštačkom inteligencijom počinje popisom",{},{"id":473,"data":474,"type":218,"tunes":476},"p-inventory-1",{"text":475},"Organizacija ne može da upravlja sistemima veštačke inteligencije koje ne može da identifikuje. Popis treba da obuhvati više od prilagođeno obučenih modela. Može da uključi eksterne API-je modela, ugrađene kopilote, lokalne modele, AI funkcije u SaaS-u, runtime agenata, sisteme za pretragu i komponente automatizovanog odlučivanja.",{},{"id":478,"data":479,"type":218,"tunes":481},"p-inventory-2",{"text":480},"Koristan popis povezuje AI sposobnost sa njenim poslovnim vlasnikom, tehničkim vlasnikom, slučajem upotrebe, korisnicima, klasama podataka, modelom\u002Fpružaocem, okruženjem za uvođenje, dozvolama, klasifikacijom rizika, statusom evaluacije, primenljivim obavezama i stanjem životnog ciklusa.",{},{"id":483,"data":484,"type":218,"tunes":486},"p-inventory-3",{"text":485},"Popis nije samo tabela za revizore. To je indeks koji omogućava organizaciji da zna šta mora da se pregleda kada se pružalac promeni, pojavi ranjivost, regulativa postane primenljiva ili model bude povučen.",{},{"id":488,"data":489,"type":377,"tunes":533},"inventory-table",{"content":490,"stretched":43,"withHeadings":14},[491,494,497,500,503,506,509,512,515,518,521,524,527,530],[492,493],"Polje popisa","Zašto je upravljanju potrebno",[495,496],"Slučaj upotrebe \u002F svrha","Definiše zašto veštačka inteligencija postoji i šta znači uspeh",[498,499],"Poslovni vlasnik","Vlasnik ishoda i poslovnog rizika",[501,502],"Tehnički vlasnik","Vlasnik arhitekture, implementacije i rada",[504,505],"Model + verzija","Identifikuje zavisnost koja proizvodi ponašanje",[507,508],"Pružalac \u002F runtime","Identifikuje ugovornu, hosting i operativnu zavisnost",[510,511],"Klase podataka","Određuje privatnost, poverljivost i ograničenja izvora istine",[513,514],"Korisnici \u002F pogođene strane","Određuje izloženost i kontekst uticaja na ljude",[516,517],"Alati \u002F radnje","Određuje autonomiju i rizik od neželjenih efekata",[519,520],"Dozvole \u002F identitet","Definiše ko ili šta može da pozove sposobnost",[522,523],"Klasifikacija rizika","Određuje potrebne kontrole i put odobravanja",[525,526],"Dokazi o evaluaciji","Pokazuje da li je predviđeno ponašanje testirano",[528,529],"Stanje životnog ciklusa","Nacrt, pregled, odobreno, ograničeno, obustavljeno ili povučeno",[531,532],"Datum pregleda \u002F okidači","Definiše kada odluka o upravljanju mora ponovo da se razmotri",{},{"id":535,"data":536,"type":42,"tunes":538},"h-ownership",{"text":537,"level":247},"Upravljanje zahteva imenovano vlasništvo",{},{"id":540,"data":541,"type":218,"tunes":543},"p-own-1",{"text":542},"Neuspesi AI cesto prelaze organizacione granice. Problem kvaliteta modela moze postati neuspeh proizvoda, bezbednosni problem, incident privatnosti ili ugovorni prekrsaj. Upravljanje zahteva imenovane vlasnike pre nego sto se incident dogodi.",{},{"id":545,"data":546,"type":218,"tunes":548},"p-own-2",{"text":547},"Vlasnistvo ne znaci da je jedna osoba odgovorna za sve. Snazan model razdvaja prava odlucivanja: poslovni vlasnik, vlasnik proizvoda, tehnicki vlasnik, vlasnik podataka, strucnjaci za bezbednost\u002Fprivatnost, pravni\u002Fuskladenost akteri i operativna podrska.",{},{"id":550,"data":551,"type":218,"tunes":553},"p-own-3",{"text":552},"Kriticno svojstvo je da svaka potrebna odluka ima vlasnika i da svaki vlasnik zna koje dokaze treba da pregleda.",{},{"id":555,"data":556,"type":42,"tunes":558},"h-decision-rights",{"text":557,"level":247},"Prava odlucivanja treba da budu eksplicitna",{},{"id":560,"data":561,"type":377,"tunes":593},"decision-table",{"content":562,"stretched":43,"withHeadings":14},[563,566,569,572,575,578,581,584,587,590],[564,565],"Odluka","Tipicna odgovorna funkcija",[567,568],"Moze li ovaj AI slucaj upotrebe postojati?","Poslovni\u002Fvlasnik proizvoda uz input upravljanja\u002Frizika",[570,571],"Moze li se ova klasa podataka obradjivati?","Vlasnik podataka + privatnost\u002Fbezbednost prema politici",[573,574],"Moze li se ovaj provajder\u002Fmodel koristiti?","Arhitektura\u002Fplatforma + bezbednost\u002Fnabavka + upravljanje",[576,577],"Moze li ovaj agent izvrsiti ovu radnju?","Vlasnik aplikacije + vlasnik autorizacije\u002Fposlovne politike",[579,580],"Da li je kvalitet dovoljan za implementaciju?","Vlasnik proizvoda\u002Ftehnicki vlasnik prema definisanim kriterijumima prihvatanja",[582,583],"Moze li se preostali rizik prihvatiti?","Imenovani vlasnik rizika na odgovarajucem nivou ovlascenja",[585,586],"Moze li se odobriti izuzetak?","Eksplicitno ovlascenje za izuzetak, vremenski ograniceno i dokumentovano",[588,589],"Treba li sistem suspendovati?","Operativni\u002Fposlovni vlasnik pod incidentom ili okidacima rizika",[591,592],"Moze li nadogradnja modela biti pustena u rad?","Vlasnik promene nakon dokaza o regresiji\u002Fevaluaciji",{},{"id":595,"data":596,"type":42,"tunes":598},"h-model",{"text":597,"level":247},"Upravljanje modelom je vise od izbora modela",{},{"id":600,"data":601,"type":218,"tunes":603},"p-model-1",{"text":602},"Upravljanje modelom prati koji se model koristi, u koju svrhu, pod kojom konfiguracijom i dokazima. Ovo se primenjuje na eksterne API-je, lokalno hostovane modele, fino podesene modele i modele ugradjene u softver trecih strana.",{},{"id":605,"data":606,"type":218,"tunes":608},"p-model-2",{"text":607},"Odluka o modelu treba da uzme u obzir sposobnost, rezultate evaluacije, trosak, latenciju, rukovanje podacima, uslove provajdera, podrsku zivotnog ciklusa, geografska\u002F hosting ogranicenja, bezbednost, ponasanje pri fallback-u i posledice promene verzije.",{},{"id":610,"data":611,"type":218,"tunes":613},"p-model-3",{"text":612},"Aliasi modela kao sto je „latest“ mogu biti operativno zgodni ali slabe reproduktivnost ako se ponasanje menja bez upravljanog procesa izdanja. Sistemi sa posledicama imaju koristi od eksplicitnog pracenja verzija i evaluacije regresije.",{},{"id":615,"data":616,"type":42,"tunes":618},"h-provider",{"text":617,"level":247},"Upravljanje provajderom je odvojen sloj zavisnosti",{},{"id":620,"data":621,"type":218,"tunes":623},"p-provider-1",{"text":622},"Dva sistema koja koriste istu familiju modela mogu imati razlicit rizik upravljanja ako jedan radi lokalno a drugi salje podatke eksternom provajderu. Upravljanje provajderom pokriva ugovorne uslove, lokaciju obrade, zadrzavanje, logovanje, podprocesore, dostupnost, ukidanje i strategiju izlaska.",{},{"id":625,"data":626,"type":218,"tunes":628},"p-provider-2",{"text":627},"Apstrakcija provajdera moze smanjiti tehnicko zakljucavanje, ali ne uklanja posao upravljanja. Zamena provajdera moze promeniti tokove podataka, ponasanje modela, bezbednosne pretpostavke, trosak i obaveze uskladenosti.",{},{"id":630,"data":631,"type":218,"tunes":633},"p-provider-3",{"text":632},"Lista odobrenih provajdera se stoga ne sme tumaciti kao „svaki model i svaka klasa podataka od ovog provajdera je automatski odobrena.“ Odobrenje zahteva obim.",{},{"id":635,"data":636,"type":42,"tunes":638},"h-data",{"text":637,"level":247},"Upravljanje podacima ostaje sloj izvora istine",{},{"id":640,"data":641,"type":218,"tunes":643},"p-data-1",{"text":642},"AI upravljanje ne cini model autoritetom za organizacione cinjenice. Upravljanje podacima i dalje odredjuje vlasnistvo, klasifikaciju, zadrzavanje, kvalitet i dozvoljenu upotrebu izvornih podataka.",{},{"id":645,"data":646,"type":218,"tunes":648},"p-data-2",{"text":647},"Za RAG i agente, upravljanje treba da identifikuje koji izvori su autoritativni, koji su savetodavni, kako se cuva provenijencija, koji podaci mogu uci u kontekst modela i koje granice zakupca\u002Fkorisnika moraju biti primenjene.",{},{"id":650,"data":651,"type":218,"tunes":653},"p-data-3",{"text":652},"Generisani izlazi takodje stvaraju nova pitanja upravljanja podacima: da li se promptovi i odgovori zadrzavaju, ko moze pristupiti tragovima, da li generisani rezimei postaju zapisi i kako se izvedeni embedding-ovi ili indeksi brisu kada se izvorni podaci uklone.",{},{"id":655,"data":656,"type":42,"tunes":658},"h-permissions",{"text":657,"level":247},"Dozvole su upravljačke odluke sa primenom u vreme izvršavanja",{},{"id":660,"data":661,"type":218,"tunes":663},"p-perm-1",{"text":662},"Agentna AI čini dozvole upravljačkim objektom prvog reda. Organizacija treba da odluči kojim alatima, datotekama, API-jima, bazama podataka i sporednim efektima svaki agent ili korisnik može da pristupi.",{},{"id":665,"data":666,"type":218,"tunes":668},"p-perm-2",{"text":667},"Upravljanje definiše politiku i logiku odobravanja; pouzdano izvršno okruženje ih sprovodi. Uputstva na prirodnom jeziku kao što je „ne briši datoteke“ nisu zamena za autorizaciju na nivou datotečnog sistema, API-ja ili servisa.",{},{"id":670,"data":671,"type":218,"tunes":673},"p-perm-3",{"text":672},"Isti princip važi i za izolaciju zakupaca: uloga može da autorizuje operaciju, dok opseg zakupca ograničava čijim resursima kupaca ta operacija može da pristupi.",{},{"id":675,"data":676,"type":42,"tunes":678},"h-risk",{"text":677,"level":247},"Klasifikacija rizika treba da menja skup kontrola",{},{"id":680,"data":681,"type":218,"tunes":683},"p-risk-1",{"text":682},"Nije svakom AI sistemu potrebna ista dubina pregleda. Upravljanje postaje skalabilno kada klasifikacija rizika menja zahteve za dokazima, odobravanjem i nadzorom.",{},{"id":685,"data":686,"type":377,"tunes":724},"risk-table",{"content":687,"stretched":43,"withHeadings":14},[688,692,696,700,704,708,712,716,720],[689,690,691],"Pokretač rizika","Primer sa nižom kontrolom","Primer sa višom kontrolom",[693,694,695],"Poslovna posledica","Izrada nacrta internog teksta","Odobravanje finansijskog poravnanja",[697,698,699],"Uticaj na ljude","Opciona pomoć pri pisanju","Podrška odlučivanju o zaposlenju ili podobnosti",[701,702,703],"Osetljivost podataka","Javna dokumentacija","Zdravstveni, HR, finansijski ili poverljivi podaci",[705,706,707],"Autonomija","Preporuka samo za čitanje","Agent sa alatima za pisanje\u002Fplaćanje\u002Fobjavljivanje",[709,710,711],"Reverzibilnost","Lako regenerisan rezime","Nepovratna eksterna transakcija",[713,714,715],"Izloženost","Mali interni pilot","Javni sistem ili sistem okrenut kupcima u velikom obimu",[717,718,719],"Autoritet izvora","Sadržaj savetodavne prirode","Sistem na koji se oslanja za regulisane ili ugovorne činjenice",[721,722,723],"Uočljivost greške","Očigledan nedostatak u formatiranju","Uverljiva, ali suštinski pogrešna preporuka",{},{"id":726,"data":727,"type":218,"tunes":729},"p-risk-2",{"text":728},"Metod klasifikacije može biti jednostavan ili sofisticiran, ali treba da se preslika u konkretne posledice: više testiranja, uža ovlašćenja, obavezan ljudski nadzor, bezbednosni pregled, prihvatanje rizika od strane rukovodstva ili zabranu uvođenja.",{},{"id":731,"data":732,"type":42,"tunes":734},"h-map",{"text":733,"level":247},"Upravljanje mora da očuva kontekst slučaja upotrebe",{},{"id":736,"data":737,"type":218,"tunes":739},"p-map-1",{"text":738},"NIST-ova funkcija MAP naglašava predviđenu svrhu, korisnike, kontekst uvođenja, pretpostavke, uticaje i primenljive zakone ili norme. To je važno jer isti model može biti niskog rizika u jednom slučaju upotrebe, a sa visokim posledicama u drugom.",{},{"id":741,"data":742,"type":218,"tunes":744},"p-map-2",{"text":743},"Zapisi o upravljanju bi stoga trebalo da klasifikuju aplikaciju, a ne samo model. „Koristimo model X“ nije dovoljno da se odredi rizik.",{},{"id":746,"data":747,"type":218,"tunes":749},"p-map-3",{"text":748},"Relevantni upravljački objekat je sistem\u002Fslučaj upotrebe: model + podaci + kontekst + alati + korisnici + okruženje za uvođenje + poslovni proces.",{},{"id":751,"data":752,"type":42,"tunes":754},"h-evaluation",{"text":753,"level":247},"Evaluacija je dokaz za upravljanje",{},{"id":756,"data":757,"type":218,"tunes":759},"p-eval-1",{"text":758},"Proces upravljanja AI-jem ne bi trebalo da odobri uvođenje samo na osnovu prodavčevih referentnih vrednosti ili uspešne demonstracije. Sistemu su potrebni dokazi povezani sa njegovom stvarnom predviđenom upotrebom.",{},{"id":761,"data":762,"type":218,"tunes":764},"p-eval-2",{"text":763},"Korisni dokazi mogu uključivati evaluaciju uspešnosti zadatka, kvalitet pronalaženja, činjeničnu utemeljenost, bezbednosne testove, testove dozvola, adversarne scenarije, studije ljudskog pregleda, latenciju\u002Ftroškove, robusnost i poređenja regresija.",{},{"id":766,"data":767,"type":218,"tunes":769},"p-eval-3",{"text":768},"NIST-ova funkcija MEASURE to eksplicitno naglašava: organizacije treba da identifikuju i primene odgovarajuće metode i metrike za rizike identifikovane tokom mapiranja, uz dokumentovanje rizika koji ne mogu ili neće biti mereni.",{},{"id":771,"data":772,"type":226,"tunes":776},"eval-boundary",{"body":773,"title":774,"variant":775},"„Tim smatra da je model dovoljno dobar“ je slab artefakt odobrenja. „Sistem je ispunio definisane kriterijume prihvatanja na reprezentativnim testovima, uz ova poznata ograničenja i preostale rizike“ može se upravljati.","Kapija upravljanja treba da traži dokaze, a ne samopouzdanje","success",{},{"id":778,"data":779,"type":42,"tunes":781},"h-gates",{"text":780,"level":247},"Kapije upravljanja treba da postoje tokom celog životnog ciklusa",{},{"id":783,"data":784,"type":320,"tunes":811},"gate-flow",{"steps":785,"title":810,"orientation":319},[786,789,792,795,798,801,804,807],{"label":787,"description":788},"Kapija ideje \u002F otkrivanja","Potvrdite poslovnu svrhu, vlasnika i da li je AI odgovarajuće rešenje.",{"label":790,"description":791},"Arhitektonska kapija","Pregledajte model\u002Fprovajdera, tok podataka, identitet, dozvole, izolaciju i operativni dizajn.",{"label":793,"description":794},"Kapija rizika\u002Fusaglašenosti","Klasifikujte rizik i primenljive obaveze; definišite potrebne kontrole.",{"label":796,"description":797},"Kapija validacije","Zahtevajte dokaz da su funkcionalni, bezbednosni, sigurnosni i kriterijumi kvaliteta ispunjeni.",{"label":799,"description":800},"Kapija implementacije","Odobrite konkretnu konfiguraciju, verziju, okruženje i operativnog vlasnika.",{"label":802,"description":803},"Kapija promene","Ponovo procenite promene modela\u002Fprovajdera\u002Falata\u002Fpodataka u skladu sa materijalnošću.",{"label":805,"description":806},"Kapija incidenta","Pauzirajte, ograničite ili vratite unazad kada se pojave definisani okidači rizika.",{"label":808,"description":809},"Kapija ukidanja","Uklonite pristup, izvedene podatke, akreditive i zastarele zavisnosti na čist način.","Primeri kapija životnog ciklusa",{},{"id":813,"data":814,"type":42,"tunes":816},"h-change",{"text":815,"level":247},"Upravljanje promenama je centralno za AI upravljanje",{},{"id":818,"data":819,"type":218,"tunes":821},"p-change-1",{"text":820},"AI sistemi se menjaju čak i kada se kod aplikacije ne menja. Provajderi ažuriraju modele, sigurnosne filtere, ograničenja konteksta, cene, politike i infrastrukturu. Korpusi za pretragu se menjaju. Alati agenata dobijaju dozvole. Propisi i ugovori se razvijaju.",{},{"id":823,"data":824,"type":218,"tunes":826},"p-change-2",{"text":825},"Upravljanje bi stoga trebalo da definiše okidače materijalnih promena. Manje prilagođavanje formulacije upita može zahtevati obične regresione testove; zamena modela, omogućavanje alata za pisanje ili uvođenje osetljivih podataka može zahtevati novu kapiju odobrenja.",{},{"id":828,"data":829,"type":218,"tunes":831},"p-change-3",{"text":830},"Zapis o upravljanju treba da sačuva koja je verzija odobrena i koji uslovi su učinili odobrenje važećim.",{},{"id":833,"data":834,"type":42,"tunes":836},"h-exceptions",{"text":835,"level":247},"Izuzeci zahtevaju vlasnike, rok trajanja i kompenzujuće kontrole",{},{"id":838,"data":839,"type":218,"tunes":841},"p-exc-1",{"text":840},"Stvarne organizacije zahtevaju izuzetke. Timu može biti potreban neodobreni model za vremenski ograničen eksperiment, ili nasleđeni sistem možda još ne ispunjava novi zahtev za evidentiranje.",{},{"id":843,"data":844,"type":218,"tunes":846},"p-exc-2",{"text":845},"Opasan obrazac je trajni nedokumentovani izuzetak. Izuzeci kojima se može upravljati preciziraju vlasnika, obrazloženje, obim, preostali rizik, kompenzujuću kontrolu, datum isteka i uslov pregleda.",{},{"id":848,"data":849,"type":218,"tunes":851},"p-exc-3",{"text":850},"Rukovanje izuzecima treba da bude deo normalnog sistema upravljanja, a ne neformalni sporedni kanal.",{},{"id":853,"data":854,"type":42,"tunes":856},"h-audit",{"text":855,"level":247},"Revizibilnost je sposobnost rekonstrukcije odluke i izvršenja",{},{"id":858,"data":859,"type":218,"tunes":861},"p-audit-1",{"text":860},"AI revizibilnost nije samo čuvanje upita modela. To znači biti u mogućnosti da se rekonstruiše koja je verzija sistema korišćena, koji podaci i dozvole su primenjeni, ko je odobrio konfiguraciju, koje evaluacije su podržale implementaciju i šta se dogodilo tokom relevantnog izvršenja.",{},{"id":863,"data":864,"type":218,"tunes":866},"p-audit-2",{"text":865},"Za agenta, to može zahtevati identitet principala, pozive alata, odobrenja, ciljne resurse, promene stanja i ishode. Za RAG, to može zahtevati verziju korpusa\u002Findeksa, upit za pretragu, izabrane dokaze i poreklo. Za promenu modela, to može zahtevati prethodne i nove rezultate evaluacije.",{},{"id":868,"data":869,"type":218,"tunes":871},"p-audit-3",{"text":870},"Revizijski dokazi treba da budu proporcionalni. Evidentiranje svakog mogućeg tokena može stvoriti sopstveni rizik za privatnost i bezbednost. Upravljanje treba da definiše koji dokazi su neophodni, koliko dugo se čuvaju i ko može da im pristupi.",{},{"id":873,"data":874,"type":377,"tunes":900},"audit-table",{"content":875,"stretched":43,"withHeadings":14},[876,879,882,885,888,891,894,897],[877,878],"Revizijski objekat","Korisni dokazi",[880,881],"Odluka o upravljanju","Vlasnik, datum, odluka, uslovi, dokazi, izuzeci",[883,884],"Izdanje modela","Model\u002Fprovajder\u002Fverzija, konfiguracija, rezultati regresije",[886,887],"Pristup podacima","Principal, zakupac\u002Fobim, klasa izvora, odluka o politici",[889,890],"Akcija agenta","Alat, argumenti\u002Fcilj, odobrenje, rezultat, promena stanja",[892,893],"RAG odgovor","Verzija korpusa\u002Findeksa, skup pretrage, izabrani dokazi, citati",[895,896],"Incident","Okidač, pogođeni sistemi, obuzdavanje, vlasnik odluke, sanacija",[898,899],"Ukidanje","Onemogućeni endpointi, opozvane akreditive, izbrisani izvedeni podaci, odluka o arhiviranju",{},{"id":902,"data":903,"type":42,"tunes":905},"h-observability",{"text":904,"level":247},"Nadzor zatvara petlju upravljanja",{},{"id":907,"data":908,"type":218,"tunes":910},"p-monitor-1",{"text":909},"Odobrenje je snimak stanja. Nadzor u produkciji govori upravljanju da li pretpostavke iza odobrenja još uvek važe.",{},{"id":912,"data":913,"type":218,"tunes":915},"p-monitor-2",{"text":914},"Korisni signali zavise od slučaja upotrebe: regresija kvaliteta, nesigurni izlazi, kvarovi alata, odbijanja politike, neuobičajeni troškovi, latencija, pritužbe korisnika, drift, svežina pretrage, incidenti provajdera, bezbednosna upozorenja ili nove regulatorne klasifikacije.",{},{"id":917,"data":918,"type":218,"tunes":920},"p-monitor-3",{"text":919},"Upravljanje treba da definiše pragove koji izazivaju akciju: istražiti, ograničiti, zahtevati ljudski pregled, vratiti unazad, promeniti provajdera, suspendovati ili ukinuti.",{},{"id":922,"data":923,"type":42,"tunes":925},"h-incidents",{"text":924,"level":247},"AI incidenti zahtevaju definisan operativni put",{},{"id":927,"data":928,"type":218,"tunes":930},"p-inc-1",{"text":929},"AI-specifični incidenti mogu uključivati štetni sadržaj, curenje podataka, neovlašćene radnje, trajni činjenični neuspeh, prekid rada modela\u002Fpružaoca usluga, prompt injection, cross-tenant pretragu ili neočekivano ponašanje nakon ažuriranja modela.",{},{"id":932,"data":933,"type":218,"tunes":935},"p-inc-2",{"text":934},"Proces za incidente treba da poveže tehnički odgovor sa upravljačkim vlasništvom. Neko mora biti ovlašćen da onemogući model, ukloni alat, opozove akreditive, ograniči korisnike, obavesti pogođene funkcije i odluči da li sistem može da se vrati u upotrebu.",{},{"id":937,"data":938,"type":218,"tunes":940},"p-inc-3",{"text":939},"Naučene lekcije iz incidenata treba da ažuriraju politike, testove, klasifikaciju rizika i kontrole platforme koje se mogu ponovo koristiti, umesto da ostanu izolovane u jednom timu.",{},{"id":942,"data":943,"type":42,"tunes":945},"h-procurement",{"text":944,"level":247},"Nabavka je deo AI upravljanja",{},{"id":947,"data":948,"type":218,"tunes":950},"p-proc-1",{"text":949},"Organizacije mogu steći značajne AI sposobnosti kroz običnu SaaS nabavku. Upravljanje stoga treba da pokriva i kupljene AI funkcije i interne inženjerske sisteme.",{},{"id":952,"data":953,"type":218,"tunes":955},"p-proc-2",{"text":954},"Procena dobavljača može uključivati korišćenje podataka, zadržavanje, politiku obuke modela, podprocesore, bezbednost, obaveštavanje o incidentima, izvoz\u002Fbrisanje, geografsku obradu, promenu verzije, kontinuitet usluge i ugovorni izlaz.",{},{"id":957,"data":958,"type":218,"tunes":960},"p-proc-3",{"text":959},"Pregled tehničke arhitekture i pregled nabavke treba da dele isti inventar sistema kako komercijalno odobrenje ne bi odstupilo od stvarnog toka podataka u upotrebi.",{},{"id":962,"data":963,"type":42,"tunes":965},"h-human",{"text":964,"level":247},"Ljudski nadzor treba da bude dizajniran, a ne samo deklarisan",{},{"id":967,"data":968,"type":218,"tunes":970},"p-human-1",{"text":969},"„Čovek u petlji“ ima smisla samo ako čovek ima ovlašćenje, vreme, informacije i upotrebljiv mehanizam intervencije.",{},{"id":972,"data":973,"type":218,"tunes":975},"p-human-2",{"text":974},"Recenzent koji vidi samo AI preporuku, ali ne i njene dokaze, neizvesnost ili stanje izvora, može jednostavno automatski odobriti izlaz. Upravljanje treba da precizira šta recenzent može da pregleda i koje su radnje dostupne: odobri, odbije, izmeni, eskalira ili zaustavi.",{},{"id":977,"data":978,"type":218,"tunes":980},"p-human-3",{"text":979},"Ljudski nadzor takođe treba da se zasniva na riziku. Sistemi sa malim posledicama mogu koristiti uzorkovanje ili naknadni pregled, dok efekti sa velikim posledicama mogu zahtevati odobrenje pre izvršenja.",{},{"id":982,"data":983,"type":42,"tunes":985},"h-platform",{"text":984,"level":247},"Upravljanje platformom i upravljanje slučajevima upotrebe su različiti",{},{"id":987,"data":988,"type":385,"tunes":1014},"platform-comparison",{"rows":989,"title":1006,"layout":377,"columns":1007},[990,994,998,1002],{"id":991,"label":992,"values":993},"owner","Primarna briga",[355,355],{"id":995,"label":996,"values":997},"approval","Tipično odobrenje",[355,355],{"id":999,"label":1000,"values":1001},"evidence","Dokazi",[355,355],{"id":1003,"label":1004,"values":1005},"failure","Neuspeh upravljanja",[355,355],"Dva nivoa upravljanja",[1008,1011],{"id":1009,"label":1010},"platform","Deljena AI platforma",{"id":1012,"label":1013},"usecase","Pojedinačni slučaj upotrebe AI",{},{"id":1016,"data":1017,"type":218,"tunes":1019},"p-platform-1",{"text":1018},"Odobrenje platforme stoga treba da smanji ponavljanje posla, a ne da eliminiše odgovornost za slučaj upotrebe. „Model je odobren“ je različito od „ova primena modela je odobrena.“",{},{"id":1021,"data":1022,"type":42,"tunes":1024},"h-architecture",{"text":1023,"level":247},"AI upravljanje i Enterprise AI arhitektura",{},{"id":1026,"data":1027,"type":218,"tunes":1029},"p-arch-1",{"text":1028},"Enterprise AI arhitektura opisuje kako se AI sistemi, platforme, podaci, identiteti, pružaoci usluga, operacije i organizacioni sistemi uklapaju zajedno. AI upravljanje opisuje sistem odlučivanja i kontrole koji određuje kako se te arhitekture mogu kreirati i menjati.",{},{"id":1031,"data":1032,"type":218,"tunes":1034},"p-arch-2",{"text":1033},"Njih dvoje su tesno povezani. Upravljanje bez arhitekture može postati apstraktna politika. Arhitektura bez upravljanja može proizvesti tehnički elegantne sisteme sa nejasnim vlasništvom, nekontrolisanim usvajanjem pružalaca usluga ili nepregledanim rizikom.",{},{"id":1036,"data":1037,"type":218,"tunes":1039},"p-arch-3",{"text":1038},"Najjači dizajn je dvosmeran: zahtevi upravljanja postaju arhitektonske kontrole, dok arhitektura otkriva stvarne odluke koje upravljanje mora da preuzme.",{},{"id":1041,"data":1042,"type":42,"tunes":1044},"h-implementation",{"text":1043,"level":247},"Dokazi iz originalnog projekta",{},{"id":1046,"data":1047,"type":42,"tunes":1049},"h-enterprise",{"text":1048,"level":246},"Enterprise Aaasaasa 0.1: upravljanje kao struktura isporuke",{},{"id":1051,"data":1052,"type":226,"tunes":1055},"enterprise-note",{"body":1053,"title":1054,"variant":240},"Enterprise Aaasaasa 0.1 predstavlja dokaze projekta i obuke\u002FPoC-a, a ne dokaz komercijalnog usvajanja u preduzeću. Ovde je koristan jer njegova struktura isporuke eksplicitno povezuje arhitekturu, prekretnice, rizike, zainteresovane strane, validaciju i projektne odluke.","Dokazi projekta \u002F PoC-a",{},{"id":1057,"data":1058,"type":218,"tunes":1060},"p-ent-1",{"text":1059},"Enterprise Aaasaasa 0.1 koristi definisane prekretnice za zahteve, arhitekturu, prototip, validaciju i zatvaranje projekta. Ta struktura ilustruje osnovni princip upravljanja: tranzicije životnog ciklusa treba da imaju eksplicitne izlaze i tačke odlučivanja umesto neformalnog procesa „prvo izgradi, pa pregledaj kasnije“.",{},{"id":1062,"data":1063,"type":218,"tunes":1065},"p-ent-2",{"text":1064},"Projekat takođe prati rizike kao što su širenje obima, kašnjenje arhitekture i zabrinutosti vezane za AI\u002FGDPR i identifikuje grupe zainteresovanih strana uključujući sponzorstvo, upravni odbor, arhitekturu, bezbednost, marketing, eksterne API-je i hosting.",{},{"id":1067,"data":1068,"type":218,"tunes":1070},"p-ent-3",{"text":1069},"Ovo ne predstavlja ISO\u002FIEC 42001 sistem upravljanja. To su uži projektni dokazi koji pokazuju kako se vlasništvo, rizik, prekretnice i validacija mogu integrisati u tehničku isporuku.",{},{"id":1072,"data":1073,"type":42,"tunes":1075},"h-senseflow",{"text":1074,"level":246},"SenseFlow: sledljivost zahteva i odluka",{},{"id":1077,"data":1078,"type":218,"tunes":1080},"p-sense-1",{"text":1079},"SenseFlow koristi strukturisan put od cilja proizvoda i korisničke potrebe kroz epove, korisničke priče, kriterijume prihvatanja, arhitekturu, implementaciju i validaciju. Zapisi o odlukama čuvaju odluku, obrazloženje, alternative, kompromise, status i datum\u002Fverziju.",{},{"id":1082,"data":1083,"type":218,"tunes":1085},"p-sense-2",{"text":1084},"Taj obrazac sledljivosti je direktno relevantan za upravljanje jer AI kontrola treba da se poveže sa zahtevom ili rizikom koji ju je opravdao. Sistem upravljanja postaje jači kada se lanac od poslovne potrebe do arhitektonske odluke do dokaza validacije može rekonstruisati.",{},{"id":1087,"data":1088,"type":42,"tunes":1090},"h-client",{"text":1089,"level":246},"Aaasaasa AI Client: dozvole i vreme izvršavanja kao upravljana konfiguracija",{},{"id":1092,"data":1093,"type":218,"tunes":1095},"p-client-1",{"text":1094},"Aaasaasa AI Client razdvaja provajdera, model, lokaciju izvršavanja i dozvole umesto da ih tretira kao jedno „AI podešavanje“. Centralni profili dozvola radnog prostora upravljaju pristupom alatima, Direct Chat nema alate za fajl sistem\u002Fšel, a okruženja sposobna za agente rade pod eksplicitnim profilima dozvola.",{},{"id":1097,"data":1098,"type":218,"tunes":1100},"p-client-2",{"text":1099},"To razdvajanje pokazuje važan obrazac upravljanja: izbor modela i autoritet za delovanje treba da budu nezavisni konfiguracijski objekti. Jači model automatski ne dobija šire dozvole za fajl sistem, šel ili poslovanje.",{},{"id":1102,"data":1103,"type":218,"tunes":1105},"p-client-3",{"text":1104},"Dokazi implementacije su arhitektonski, a ne tvrdnja da aplikacija predstavlja sertifikovani organizacioni sistem upravljanja AI-jem.",{},{"id":1107,"data":1108,"type":377,"tunes":1134},"impl-table",{"content":1109,"stretched":43,"withHeadings":14},[1110,1113,1116,1119,1122,1125,1128,1131],[1111,1112],"Uočeni obrazac projekta","Lekcija upravljanja",[1114,1115],"Kapije prekretnica","Tranzicije životnog ciklusa mogu zahtevati eksplicitne dokaze",[1117,1118],"Registar rizika","Poznate neizvesnosti postaju upravljani objekti umesto neformalnih briga",[1120,1121],"Mapiranje zainteresovanih strana","Odgovornost za odlučivanje može se namerno rasporediti",[1123,1124],"Kriterijumi prihvatanja + validacija","Odluke o uvođenju mogu zavisiti od dokaza",[1126,1127],"Zapisi o odlukama","Arhitektonski kompromisi ostaju sledljivi",[1129,1130],"Odvojeni model\u002Fprovajder\u002Fvreme izvršavanja\u002Fdozvole","Sposobnost i autoritet mogu se upravljati nezavisno",[1132,1133],"Eksplicitne oznake zrelosti projekta","PoC dokazi se ne predstavljaju pogrešno kao produkcijski ili tržišni dokaz",{},{"id":1136,"data":1137,"type":42,"tunes":1139},"h-failures",{"text":1138,"level":247},"Uobičajeni načini neuspeha upravljanja AI-jem",{},{"id":1141,"data":1142,"type":377,"tunes":1186},"failures-table",{"content":1143,"stretched":43,"withHeadings":14},[1144,1147,1150,1153,1156,1159,1162,1165,1168,1171,1174,1177,1180,1183],[1145,1146],"Način neuspeha","Šta ide naopako",[1148,1149],"Upravljanje je samo PDF sa politikom","Timovi ne mogu da prevedu politiku u kontrole u vreme izvršavanja ili odluke o uvođenju",[1151,1152],"Nema inventara AI-ja","Organizacija ne može da identifikuje gde se koriste modeli, agenti ili ugrađeni AI",[1154,1155],"Odobrenje modela se tretira kao odobrenje slučaja upotrebe","Odobreni model se koristi za suštinski drugačiji kontekst rizika",[1157,1158],"Nema imenovanog poslovnog vlasnika","Tehnički timovi po defaultu nasleđuju odluke o poslovnom riziku",[1160,1161],"Klasifikacija rizika nema posledicu na kontrolu","Svaki sistem dobija isti pregled bez obzira na posledice",[1163,1164],"Dozvole žive samo u promptovima","Instrukcije modela postaju zamena za stvarnu autorizaciju",[1166,1167],"Promena provajdera je nevidljiva","Pretpostavke o ponašanju\u002Fpodacima\u002Fusaglašenosti se menjaju bez ponovne evaluacije",[1169,1170],"Uspeh demo-a je dokaz za odobrenje","Produkcijski rizik se zaključuje iz malog testa srećnog puta",[1172,1173],"Ljudski nadzor je ceremonijalan","Recenzent ne može da pregleda dokaze ili zaustavi radnju",[1175,1176],"Izuzetak nema rok isteka","Privremeno zaobilazno rešenje postaje trajni dug upravljanja",[1178,1179],"Logovi postoje ali ne mogu da rekonstruišu odluke","Revizibilnost se meša sa čuvanjem sirovih podataka",[1181,1182],"Usaglašenost sama poseduje upravljanje","Proizvod, inženjering, bezbednost i operacije se isključuju iz odgovornosti",[1184,1185],"Svaka odluka ide centralnom odboru","Upravljanje postaje usko grlo umesto skalabilnog sistema kontrole",{},{"id":1188,"data":1189,"type":42,"tunes":1191},"h-federated",{"text":1190,"level":247},"Centralno upravljanje ne znači centralizaciju svake odluke",{},{"id":1193,"data":1194,"type":218,"tunes":1196},"p-fed-1",{"text":1195},"Zrela organizacija može centralizovati politiku, kontrolne obrasce i eskalaciju, dok istovremeno delegira odluke niskog rizika produktnim ili platformskim timovima.",{},{"id":1198,"data":1199,"type":218,"tunes":1201},"p-fed-2",{"text":1200},"Ovaj federativni model skalira se bolje od zahteva da centralni komitet odobrava svaku izmenu prompta. Centralna funkcija definiše nivoe rizika, obavezne kontrole, politiku provajdera, ovlašćenja za izuzetke i zahteve za reviziju; timovi deluju autonomno unutar tih granica.",{},{"id":1203,"data":1204,"type":218,"tunes":1206},"p-fed-3",{"text":1205},"Cilj dizajna je dosledna odgovornost, a ne maksimalna centralizacija.",{},{"id":1208,"data":1209,"type":42,"tunes":1211},"h-metrics",{"text":1210,"level":247},"Upravljajte samim sistemom upravljanja",{},{"id":1213,"data":1214,"type":218,"tunes":1216},"p-metric-1",{"text":1215},"Upravljanje zahteva povratne informacije. U suprotnom, kontrole mogu postati skupi rituali koji ne smanjuju rizik.",{},{"id":1218,"data":1219,"type":377,"tunes":1251},"metrics-table",{"content":1220,"stretched":43,"withHeadings":14},[1221,1224,1227,1230,1233,1236,1239,1242,1245,1248],[1222,1223],"Metrika \u002F signal","Šta može otkriti",[1225,1226],"Pokrivenost inventara","Da li je usvajanje AI vidljivo upravljanju",[1228,1229],"Vreme do odluke","Da li upravljanje nepotrebno blokira isporuku",[1231,1232],"Broj i starost izuzetaka","Da li su politike realistične ili se rutinski zaobilaze",[1234,1235],"Stopa neuspeha evaluacije","Da li kontrole pre implementacije otkrivaju defekte",[1237,1238],"Stopa incidenata nakon implementacije","Da li dokazi o odobrenju predviđaju ponašanje u produkciji",[1240,1241],"Stopa odbijanja neovlašćenih alata","Da li se granice dozvola aktivno sprovode",[1243,1244],"Učestalost promena modela\u002Fprovajdera","Koliko često odobrene pretpostavke mogu postati zastarele",[1246,1247],"Sistemi u penziji ali aktivni","Neuspeh čišćenja\u002Fkontrole životnog ciklusa",[1249,1250],"Ponavljajući obrasci incidenata","Da li lekcije postaju ponovo upotrebljive platformske kontrole",{},{"id":1253,"data":1254,"type":218,"tunes":1256},"p-metric-2",{"text":1255},"Metrike upravljanja ne bi trebalo da nagrađuju obim papirologije. Korisna mera je da li se kvalitet odlučivanja, sledljivost, detekcija rizika i bezbedna isporuka poboljšavaju.",{},{"id":1258,"data":1259,"type":42,"tunes":1261},"h-sequence",{"text":1260,"level":247},"Praktičan redosled implementacije AI upravljanja",{},{"id":1263,"data":1264,"type":320,"tunes":1303},"design-flow",{"steps":1265,"title":1302,"orientation":319},[1266,1269,1272,1275,1278,1281,1284,1287,1290,1293,1296,1299],{"label":1267,"description":1268},"1. Definišite obim upravljanja","Odlučite koji su interno izgrađeni, kupljeni, ugrađeni i eksperimentalni AI sistemi obuhvaćeni.",{"label":1270,"description":1271},"2. Kreirajte AI inventar","Zabeležite vlasnike, slučajeve upotrebe, modele\u002Fprovajdere, podatke, alate, korisnike, stanje životnog ciklusa i klasu rizika.",{"label":1273,"description":1274},"3. Definišite prava odlučivanja","Odredite ko može da odobrava provajdere, upotrebu podataka, prihvatanje rizika, izuzetke, implementaciju i stavljanje van upotrebe.",{"label":1276,"description":1277},"4. Uspostavite nivoe rizika","Mapirajte posledice i izloženost na različite zahteve kontrola.",{"label":1279,"description":1280},"5. Definišite ponovo upotrebljive minimalne kontrole","Postavite osnovne zahteve za identitet, dozvole, podatke, bezbednost, evaluaciju, evidentiranje i ljudski nadzor.",{"label":1282,"description":1283},"6. Povežite upravljanje sa arhitekturom","Pretvorite politiku u platformske\u002Fruntime kontrole koje timovi ne mogu slučajno da zaobiđu.",{"label":1285,"description":1286},"7. Izgradite kapije zasnovane na dokazima","Zahtevajte relevantne dokaze o evaluaciji, bezbednosti, privatnosti, arhitekturi i usklađenosti pre prelaza u životnom ciklusu.",{"label":1288,"description":1289},"8. Upravljajte promenama modela\u002Fprovajdera","Pratite verzije, zastarevanje i materijalne promene uz dokaze o regresiji.",{"label":1291,"description":1292},"9. Dodajte nadzor i okidače incidenata","Definišite koji produkcijski signali prisiljavaju na istragu, ograničenje ili suspenziju.",{"label":1294,"description":1295},"10. Formalizujte izuzetke","Zahtevajte obim, vlasnika, preostali rizik, kompenzujuće kontrole i rok isteka.",{"label":1297,"description":1298},"11. Revidirajte odluke i izvršenje","Čuvajte proporcionalne dokaze koji povezuju vlasnike, konfiguraciju, dozvole, evaluacije i značajne radnje.",{"label":1300,"description":1301},"12. Poboljšajte sistem upravljanja","Koristite incidente, kašnjenja i ponavljajuće izuzetke za reviziju kontrola i platformskih obrazaca.","Izgradite upravljanje od vidljivosti do kontrole",{},{"id":1305,"data":1306,"type":42,"tunes":1308},"h-checklist",{"text":1307,"level":247},"Kontrolna lista za AI upravljanje",{},{"id":1310,"data":1311,"type":377,"tunes":1361},"checklist-table",{"content":1312,"stretched":43,"withHeadings":14},[1313,1316,1319,1322,1325,1328,1331,1334,1337,1340,1343,1346,1349,1352,1355,1358],[1314,1315],"Pitanje","Očekivani dokaz upravljanja",[1317,1318],"Zašto ovaj AI sistem postoji?","Svrha, poslovni vlasnik i nameravani ishod",[1320,1321],"Ko upravlja tehničkim radom?","Imenovani tehnički\u002Fplatformski vlasnik",[1323,1324],"Koji model\u002Fprovajder\u002Fverzija se koristi?","Registrovana i verzionisana zavisnost",[1326,1327],"Koji podaci mogu ući u sistem?","Klasifikacija, ovlašćenje i odluka o dozvoljenoj upotrebi",[1329,1330],"Koji identiteti ga mogu koristiti?","Model autentifikacije i autorizacije",[1332,1333],"Koje radnje može izvršiti?","Matrica alata\u002Fdozvola i granica autonomije",[1335,1336],"Koji je nivo rizika?","Dokumentovana klasifikacija sa obrazloženjem",[1338,1339],"Koje kontrole su obavezne?","Osnovne kontrole za nivo rizika",[1341,1342],"Kako je evaluiran?","Reprezentativni testovi i kriterijumi prihvatanja",[1344,1345],"Ko je prihvatio preostali rizik?","Imenovani odgovorni organ",[1347,1348],"Šta zahteva ljudski pregled?","Eksplicitna pravila nadzora\u002Fodobravanja",[1350,1351],"Šta se evidentira?","Politika revizije\u002Fopservabilnosti proporcionalna posledicama",[1353,1354],"Šta pokreće ponovni pregled?","Događaji promene modela\u002Fprovajdera\u002Fpodataka\u002Falata\u002Fregulative\u002Fmaterijalnih promena",[1356,1357],"Kako se može suspendovati?","Operativni put za prekid\u002Fograničenje i vlasnik",[1359,1360],"Kako se stavlja van upotrebe?","Čišćenje akreditiva, podataka, izvedenih vrednosti, endpointa i zapisa",{},{"id":1363,"data":1364,"type":42,"tunes":1366},"h-misconceptions",{"text":1365,"level":247},"Uobičajene zablude",{},{"id":1368,"data":1369,"type":377,"tunes":1404},"misconceptions-table",{"content":1370,"stretched":43,"withHeadings":14},[1371,1374,1377,1380,1383,1386,1389,1392,1395,1398,1401],[1372,1373],"Zabluda","Ispravka",[1375,1376],"„AI upravljanje je usklađenost.“","Usklađenost je jedan input upravljanja; upravljanje takođe pokriva vlasništvo, arhitekturu, dozvole, kvalitet, rizik i odluke o životnom ciklusu.",[1378,1379],"„Upravljanje znači revizorski komitet.“","Komiteti mogu odobravati izuzetke ili sisteme visokog rizika, ali mnoge kontrole treba ugraditi u normalnu isporuku i platformsku arhitekturu.",[1381,1382],"„Odobreni model je bezbedan za svaku upotrebu.“","Rizik pripada slučaju upotrebe i kontekstu sistema, ne samo modelu.",[1384,1385],"„Dobavljač upravlja umesto nas.“","Provajder kontroliše deo steka; organizacija i dalje poseduje svoj slučaj upotrebe, podatke, dozvole i poslovne posledice.",[1387,1388],"„Čovek u petlji automatski rešava rizik.“","Nadzor funkcioniše samo kada recenzenti imaju ovlašćenja, kontekst i sposobnost intervencije.",[1390,1391],"„Evidentiranje svega daje revizibilnost.“","Revizibilnost zahteva rekonstruktivne relevantne dokaze sa kontrolisanim čuvanjem i pristupom.",[1393,1394],"„Upravljanje blokira inovacije.“","Loše upravljanje može blokirati isporuku; dobro dizajnirano upravljanje stvara ponovo upotrebljive bezbedne puteve i jasnije vlasništvo nad odlukama.",[1396,1397],"„Pilot projekti niskog rizika ne zahtevaju upravljanje.“","Mogu koristiti lagano upravljanje, ali inventar, vlasništvo i granice podataka\u002Falata su i dalje važni.",[1399,1400],"„Lokalni AI zahteva manje upravljanja.“","Lokalni hosting može promeniti rizik privatnosti\u002Fprovajdera, ali kvalitet modela, dozvole, bezbednost i upravljanje životnim ciklusom ostaju.",[1402,1403],"„Jednom odobren, sistem ostaje odobren.“","Model, provajder, podaci, regulativa i upotreba se mogu promeniti; odluke upravljanja zahtevaju okidače za reviziju.",{},{"id":1406,"data":1407,"type":42,"tunes":1409},"h-edge",{"text":1408,"level":247},"Granični slučajevi i ograničenja",{},{"id":1411,"data":1412,"type":218,"tunes":1414},"p-edge-1",{"text":1413},"Vrlo male organizacije možda ne zahtevaju namensku funkciju AI upravljanja. Isti principi mogu se primeniti kroz lagane arhitekturne odluke, registre rizika, mapiranja vlasnika i kapije izdanja.",{},{"id":1416,"data":1417,"type":218,"tunes":1419},"p-edge-2",{"text":1418},"Visoko regulisane organizacije mogu zahtevati mnogo formalnije upravljanje, nezavisno uveravanje, dokumentovane procese usklađenosti i pravno tumačenje nego što ovaj članak na arhitektonskom nivou opisuje.",{},{"id":1421,"data":1422,"type":218,"tunes":1424},"p-edge-3",{"text":1423},"Open-source i samostalno hostovani modeli smanjuju neke zavisnosti od provajdera, ali stvaraju druge: zakrpe, poreklo modela, evaluaciju, bezbednost infrastrukture, licenciranje i operativno vlasništvo.",{},{"id":1426,"data":1427,"type":218,"tunes":1429},"p-edge-4",{"text":1428},"AI modeli opšte namene mogu se koristiti u mnogim kontekstima. Upravljanje treba da izbegne pretpostavku da kontrole modela na nivou provajdera u potpunosti određuju rizik aplikacije nizvodno.",{},{"id":1431,"data":1432,"type":218,"tunes":1434},"p-edge-5",{"text":1433},"Nijedan okvir upravljanja ne garantuje da je AI sistem bezbedan ili ispravan. Upravljanje poboljšava odgovornost i kvalitet odluka; tehnička validacija, praćenje i ljudska procena ostaju neophodni.",{},{"id":1436,"data":1437,"type":42,"tunes":1439},"h-change-answer",{"text":1438,"level":247},"Šta bi promenilo ovaj odgovor?",{},{"id":1441,"data":1442,"type":218,"tunes":1444},"p-change-answer-1",{"text":1443},"Tačan skup kontrola menja se u zavisnosti od zakona, industrije, veličine organizacije, osetljivosti podataka, autonomije, modela uvođenja i poslovnih posledica.",{},{"id":1446,"data":1447,"type":218,"tunes":1449},"p-change-answer-2",{"text":1448},"NIST trenutno revidira AI RMF 1.0, tako da se buduća NIST terminologija ili preporučene prakse mogu promeniti. ISO standardi takođe mogu biti revidirani, a smernice i detalji tranzicije EU AI Act-a nastavljaju da se razvijaju.",{},{"id":1451,"data":1452,"type":218,"tunes":1454},"p-change-answer-3",{"text":1453},"Stabilan arhitektonski princip je da AI odluke zahtevaju eksplicitne vlasnike, dokaze, dozvole, tretman rizika i pregled životnog ciklusa, umesto da budu skrivene unutar konfiguracije modela ili aplikacije.",{},{"id":1456,"data":1457,"type":42,"tunes":1459},"h-related",{"text":1458,"level":247},"Povezano kanonsko znanje",{},{"id":1461,"data":1462,"type":218,"tunes":1464},"p-related-1",{"text":1463},"AI upravljanje zavisi od koncepata koji su već razdvojeni na drugim mestima u ovom grafu znanja: Izvor istine određuje autoritet, RBAC i izolacija zakupaca ograničavaju pristup, inženjering konteksta kontroliše informacije vidljive modelu, a agentna arhitektura definiše kako alati i akcije ulaze u izvršnu petlju.",{},{"id":1466,"data":1467,"type":218,"tunes":1469},"p-related-2",{"text":1468},"Enterprise AI Architecture je nadređeni koncept organizacione arhitekture. Upravljanje je operativni kontrolni sloj koji određuje kako se ti enterprise AI komponenti mogu uvesti, menjati i ukinuti.",{},{"id":1471,"data":1472,"type":218,"tunes":1474},"p-related-3",{"text":1473},"Agentni sistemi povećavaju zahteve upravljanja jer odluke modela mogu postati stvarne posledice. Kontrole dozvola, odobrenja i revizije stoga moraju postojati izvan samog modela.",{},{"id":1476,"data":1477,"type":1482,"tunes":1483},"ref-agent-reliability",{"url":1478,"title":1479,"excerpt":1480,"ctaLabel":1481},"https:\u002F\u002Fstajic.de\u002Fsr\u002Fblog\u002Fai-agent-reliability-why-the-final-answer-is-not-enough","Pouzdanost AI agenata: Zašto konačan odgovor nije dovoljan","Upravljanje agentima zahteva dokaze o izvršnim putanjama, korišćenju alata, promenama stanja i mogućnosti oporavka — ne samo o kvalitetu konačnog izlaza.","Pročitajte članak o pouzdanosti agenata","referralArticle",{},{"id":1485,"data":1486,"type":1482,"tunes":1491},"ref-memory",{"url":1487,"title":1488,"excerpt":1489,"ctaLabel":1490},"https:\u002F\u002Fstajic.de\u002Fsr\u002Fblog\u002Fai-agent-memory-is-not-rag-how-to-separate-memory-retrieval-state-and-context","Memorija AI agenata nije RAG: Kako razdvojiti memoriju, pretragu, stanje i kontekst","Upravljanje zahteva različite politike za trajnu memoriju, autoritativno stanje, preuzete informacije i privremeni kontekst modela.","Pročitajte članak o arhitekturi memorije",{},{"id":1493,"data":1494,"type":1482,"tunes":1499},"ref-avb",{"url":1495,"title":1496,"excerpt":1497,"ctaLabel":1498},"https:\u002F\u002Fstajic.de\u002Fsr\u002Fblog\u002Fthe-answer-validity-boundary-the-missing-layer-between-relevance-and-reliable-ai-answers","Granica valjanosti odgovora: Sloj koji nedostaje između relevantnosti i pouzdanih AI odgovora","Odluke upravljanja treba da očuvaju uslove pod kojima dokazi i odobrenje ostaju valjani, uključujući verziju, obim, izvor i vreme.","Pročitajte Granicu valjanosti odgovora",{},{"id":1501,"data":1502,"type":42,"tunes":1504},"h-faq",{"text":1503,"level":247},"Često postavljana pitanja",{},{"id":1506,"data":1507,"type":1506,"tunes":1546},"faq",{"items":1508,"title":1545},[1509,1513,1517,1521,1525,1529,1533,1537,1541],{"id":1510,"answer":1511,"question":1512},"faq1","AI upravljanje je sistem vlasništva, prava odlučivanja, kontrola i dokaza koji se koristi za upravljanje načinom na koji se AI sistemi razvijaju, nabavljaju, uvode, koriste, menjaju i ukidaju.","Šta je AI upravljanje?",{"id":1514,"answer":1515,"question":1516},"faq2","Ne. Upravljanje rizikom identifikuje, procenjuje i tretira rizik. Upravljanje definiše ko mora da obavi taj posao, koje odluke ga zahtevaju i koji dokazi ili autoritet su potrebni.","Da li je AI upravljanje isto što i upravljanje AI rizikom?",{"id":1518,"answer":1519,"question":1520},"faq3","Ne. Usklađenost se odnosi na primenljive zakonske, regulatorne, ugovorne ili interne obaveze. Upravljanje integriše usklađenost sa arhitekturom, bezbednošću, podacima, kvalitetom, dozvolama i poslovnim vlasništvom.","Da li je AI upravljanje isto što i usklađenost?",{"id":1522,"answer":1523,"question":1524},"faq4","Enterprise AI Architecture definiše kako se AI sposobnosti i sistemi uklapaju u organizaciju. AI upravljanje definiše sistem odlučivanja i kontrole koji upravlja načinom na koji se ti komponenti mogu uvesti, koristiti i menjati.","Koja je razlika između AI upravljanja i Enterprise AI Architecture?",{"id":1526,"answer":1527,"question":1528},"faq5","Da, ali ne nužno i namenski odsek. Lagani inventar, vlasništvo, dozvole, evaluacija i kontrole promena mogu primeniti iste principe.","Da li su male kompanije potrebne AI upravljanje?",{"id":1530,"answer":1531,"question":1532},"faq6","Najmanje: slučaj upotrebe, vlasnike, model\u002Fprovajdera\u002Fverziju, klase podataka, korisnike, alate\u002Fakcije, dozvole, klasifikaciju rizika, status evaluacije, stanje životnog ciklusa i okidače pregleda.","Šta treba da sadrži AI inventar?",{"id":1534,"answer":1535,"question":1536},"faq7","Ne. Rizik zavisi od konteksta primene: podataka, korisnika, alata, autonomije, posledica i poslovnog procesa.","Da li korišćenje odobrenog modela znači da je slučaj upotrebe odobren?",{"id":1538,"answer":1539,"question":1540},"faq8","Organizacija može da rekonstruiše relevantno vlasništvo, odobrenu konfiguraciju, model\u002Fprovajdera\u002Fverziju, kontekst podataka\u002Fdozvola, dokaze evaluacije, značajne akcije i odluke o životnom ciklusu.","Šta čini AI sistem revizibilnim?",{"id":1542,"answer":1543,"question":1544},"faq9","Koristite intervale pregleda zasnovane na riziku plus okidače događaja kao što su promene modela\u002Fprovajdera, novi podaci, novi alati, incidenti, materijalna promena performansi ili regulatorna ažuriranja.","Koliko često treba pregledati odluke AI upravljanja?","AI upravljanje — često postavljana pitanja",{},{"id":1548,"data":1549,"type":42,"tunes":1551},"h-glossary",{"text":1550,"level":247},"Pojmovnik",{},{"id":1553,"data":1554,"type":1553,"tunes":1605},"glossary",{"title":1555,"entries":1556},"Ključni pojmovi AI upravljanja",[1557,1561,1565,1569,1573,1577,1581,1585,1589,1593,1597,1601],{"term":1558,"anchor":1559,"definition":1560},"AI upravljanje","ai-governance","Organizacioni sistem vlasništva, prava odlučivanja, kontrola i dokaza koji upravlja životnim ciklusom AI.",{"term":1562,"anchor":1563,"definition":1564},"AI sistem upravljanja","ai-management-system","Međusobno povezane organizacione politike, ciljevi i procesi za odgovoran razvoj, pružanje ili korišćenje AI; ISO\u002FIEC 42001 specificira zahteve za takav sistem.",{"term":1566,"anchor":1567,"definition":1568},"AI inventar","ai-inventory","Registar AI sistema, modela, provajdera, slučajeva upotrebe, vlasnika, podataka, klasifikacija rizika i stanja životnog ciklusa.",{"term":1570,"anchor":1571,"definition":1572},"Vlasnik rizika","risk-owner","Imenovani autoritet odgovoran za odlučivanje o tome kako se definisani rizik tretira ili da li se prihvata preostali rizik.",{"term":1574,"anchor":1575,"definition":1576},"Kontrola","control","Tehnička, organizaciona ili proceduralna mera namenjena sprečavanju, otkrivanju, smanjenju ili odgovoru na rizik.",{"term":1578,"anchor":1579,"definition":1580},"Kapija upravljanja","governance-gate","Tačka odlučivanja u životnom ciklusu u kojoj su definisani dokazi i autoritet potrebni pre nastavka.",{"term":1582,"anchor":1583,"definition":1584},"Preostali rizik","residual-risk","Rizik koji ostaje nakon primene kontrola ili ublažavanja.",{"term":1586,"anchor":1587,"definition":1588},"Izuzetak","exception","Eksplicitno, obimom ograničeno i obično vremenski ograničeno ovlašćenje za odstupanje od normalnog zahteva upravljanja.",{"term":1590,"anchor":1591,"definition":1592},"Revizibilnost","auditability","Sposobnost rekonstrukcije relevantnih odluka, konfiguracija, dokaza, identiteta i događaja izvršavanja.",{"term":1594,"anchor":1595,"definition":1596},"Upravljanje modelom","model-governance","Kontrole i odluke koje pokrivaju izbor modela, verzionisanje, evaluaciju, dozvoljenu upotrebu, promenu i ukidanje.",{"term":1598,"anchor":1599,"definition":1600},"Upravljanje provajderom","provider-governance","Kontrole koje pokrivaju zavisnosti od spoljnih ili internih AI provajdera, rukovanje podacima, bezbednost, ugovore, životni ciklus i izlaz.",{"term":1602,"anchor":1603,"definition":1604},"Ljudski nadzor","human-oversight","Projektovana sposobnost ljudskog pregleda ili intervencije za AI odluke ili akcije u definisanim tačkama.",{},{"id":1607,"data":1608,"type":42,"tunes":1610},"h-conclusion",{"text":1609,"level":247},"Zaključak",{},{"id":1612,"data":1613,"type":218,"tunes":1615},"p-conclusion-1",{"text":1614},"AI upravljanje je organizaciona kontrolna ravan oko AI. Ono daje imena i dokaze odlukama koje bi inače ostale skrivene unutar koda, podešavanja provajdera, upita ili neformalne procene tima.",{},{"id":1617,"data":1618,"type":218,"tunes":1620},"p-conclusion-2",{"text":1619},"Snažno upravljanje povezuje kompletan sistem: poslovnu svrhu, modele, pružaoce usluga, autoritet nad podacima, identitet, dozvole, evaluaciju, rizik, usklađenost, nadzor, incidente, promene i ukidanje.",{},{"id":1622,"data":1623,"type":218,"tunes":1625},"p-conclusion-3",{"text":1624},"Praktični cilj nije maksimalan proces. To je minimalna struktura upravljanja koja omogućava da važne AI odluke budu vlasnički definisane, zasnovane na dokazima, sprovodive, pregledne i revizorske tokom celog životnog ciklusa.",{},{"id":1627,"data":1628,"type":42,"tunes":1630},"h-sources",{"text":1629,"level":247},"Primarni izvori i aktuelne reference",{},{"id":1632,"data":1633,"type":218,"tunes":1635},"p-sources-note",{"text":1634},"Izvori navedeni u nastavku pružaju aktuelno eksterno utemeljenje za upravljanje AI, rizik i regulativu. Sekcije projekta predstavljaju originalne dokaze o implementaciji\u002Fprojektu i eksplicitno se razlikuju od formalnih standarda ili sertifikovanih sistema upravljanja.",{},{"id":1637,"data":1638,"type":1644,"tunes":1645},"src-nist-rmf",{"link":1639,"meta":1640},"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework",{"image":1641,"title":1642,"description":1643},{"url":355},"NIST — Okvir za upravljanje rizicima AI","Aktuelno NIST čvorište za AI RMF 1.0, reviziju u toku, GenAI profil i povezane resurse za upravljanje rizicima.","linkTool",{},{"id":1647,"data":1648,"type":1644,"tunes":1654},"src-nist-core",{"link":1649,"meta":1650},"https:\u002F\u002Fairc.nist.gov\u002Fairmf-resources\u002Fairmf\u002F5-sec-core\u002F",{"image":1651,"title":1652,"description":1653},{"url":355},"NIST AIRC — AI RMF jezgro","Zvanično AI RMF jezgro koje opisuje GOVERN, MAP, MEASURE i MANAGE, pri čemu je GOVERN funkcija koja se proteže kroz ceo životni ciklus.",{},{"id":1656,"data":1657,"type":1644,"tunes":1663},"src-nist-playbook",{"link":1658,"meta":1659},"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework\u002Fnist-ai-rmf-playbook",{"image":1660,"title":1661,"description":1662},{"url":355},"NIST — AI RMF priručnik","Predložene akcije za operacionalizaciju pouzdanosti i upravljanja rizicima tokom životnog ciklusa AI.",{},{"id":1665,"data":1666,"type":1644,"tunes":1672},"src-nist-genai",{"link":1667,"meta":1668},"https:\u002F\u002Fwww.nist.gov\u002Fpublications\u002Fartificial-intelligence-risk-management-framework-generative-artificial-intelligence",{"image":1669,"title":1670,"description":1671},{"url":355},"NIST AI 600-1 — Profil generativne AI","NIST prateći profil koji primenjuje koncepte AI RMF na rizike generativne AI i upravljanje životnim ciklusom.",{},{"id":1674,"data":1675,"type":1644,"tunes":1681},"src-iso42001",{"link":1676,"meta":1677},"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F42001",{"image":1678,"title":1679,"description":1680},{"url":355},"ISO\u002FIEC 42001:2023 — Sistemi upravljanja AI","Međunarodni standard koji specificira zahteve za uspostavljanje, implementaciju, održavanje i kontinuirano unapređenje sistema upravljanja AI.",{},{"id":1683,"data":1684,"type":1644,"tunes":1690},"src-iso23894",{"link":1685,"meta":1686},"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F77304.html",{"image":1687,"title":1688,"description":1689},{"url":355},"ISO\u002FIEC 23894:2023 — Upravljanje rizicima AI","Međunarodne smernice za integraciju upravljanja rizicima specifičnim za AI u organizacione aktivnosti i funkcije.",{},{"id":1692,"data":1693,"type":1644,"tunes":1699},"src-eu-act",{"link":1694,"meta":1695},"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Fpolicies\u002Fregulatory-framework-ai",{"image":1696,"title":1697,"description":1698},{"url":355},"Evropska komisija — AI akt","Aktuelni pregled Komisije o EU AI aktu, vremenskom okviru primene i okviru za implementaciju.",{},{"id":1701,"data":1702,"type":1644,"tunes":1708},"src-eu-faq",{"link":1703,"meta":1704},"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Ffaqs\u002Fnavigating-ai-act",{"image":1705,"title":1706,"description":1707},{"url":355},"Evropska komisija — Navigacija kroz AI akt","Aktuelna često postavljana pitanja koja pokrivaju upravljanje, sprovođenje, implementaciju i vremenski okvir primene koji se razvija.",{},{"id":1710,"data":1711,"type":1644,"tunes":1717},"src-eu-gpai",{"link":1712,"meta":1713},"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Ffactpages\u002Fgeneral-purpose-ai-obligations-under-ai-act",{"image":1714,"title":1715,"description":1716},{"url":355},"Evropska komisija — Obaveze za AI opšte namene","Aktuelni pregled obaveza u vezi sa dokumentacijom, autorskim pravima, sadržajem za obuku i sistemskim rizicima za pružaoce GPAI.",{},"2.31","Upravljanje veštačkom inteligencijom definiše ko može da odobri, upravlja, menja i revidira sisteme veštačke inteligencije kroz modele, pružaoce usluga, podatke, dozvole, rizik, evaluaciju i ceo životni ciklus.","\u002Fuploads\u002F2026\u002F10\u002Fai-governance-models-data-permissions-risk-and-auditability-1791485901301-g60xyu.webp","ai-governance-models-data-permissions-risk-and-auditability-1791485901301-g60xyu","PUBLISHED","2026-10-08T14:56:00.000Z","2026-10-08T18:56:36.234Z","2026-10-08T19:08:41.676Z",{"en":1727,"de":1728,"sr":1729,"es":1730,"fr":1731,"it":1732,"ru":1733,"zh":1734},"\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability","\u002Fde\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability","\u002Fsr\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability","\u002Fes\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability","\u002Ffr\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability","\u002Fit\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability","\u002Fru\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability","\u002Fzh\u002Fblog\u002Fai-governance-models-data-permissions-risk-and-auditability",[],{"id":1737,"login":1738,"email":1739,"displayName":1740},"20","rooth8233","aleksandar@stajic.de","Aleksandar Stajić",[1742,3012],{"lang":1743,"title":1744,"content":1745,"contentJson":1746,"excerpt":3011},"en","AI Governance: Models, Data, Permissions, Risk and Auditability","{\"time\":1791485902655,\"blocks\":[{\"id\":\"intro\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI governance is the system of decision rights, responsibilities, controls and evidence used to decide how an organization may develop, acquire, deploy, operate, change and retire AI systems. It is broader than a policy document and narrower than enterprise architecture as a whole. Effective AI governance connects business ownership, model and provider choices, data authority, permissions, risk classification, evaluation, monitoring, incident handling, auditability and lifecycle decisions so that someone can answer not only “does the AI work?” but also “who approved it, under which conditions, with what evidence, and when must that decision be revisited?”\"},\"tunes\":{}},{\"id\":\"direct\",\"type\":\"callout\",\"data\":{\"variant\":\"info\",\"title\":\"Direct answer\",\"body\":\"\u003Cstrong>AI governance turns AI from an informal technical capability into an accountable organizational capability.\u003C\u002Fstrong>\u003Cbr>\u003Cbr>Architecture determines how the system is built. Engineering implements it. Risk management evaluates uncertainty and harm. Compliance addresses applicable obligations. Governance connects these activities through ownership, decision rights, required controls, evidence and lifecycle gates.\"},\"tunes\":{}},{\"id\":\"boundary\",\"type\":\"callout\",\"data\":{\"variant\":\"warning\",\"title\":\"Governance is not a committee and not a PDF\",\"body\":\"A governance board can be one mechanism, and policies can document expectations, but governance only becomes operational when decisions change what systems are allowed to do: which models may be used, which data may enter them, which tools an agent may execute, which evaluations are required, who can approve exceptions, what must be logged and what triggers suspension or retirement.\"},\"tunes\":{}},{\"id\":\"current\",\"type\":\"callout\",\"data\":{\"variant\":\"note\",\"title\":\"Current-source note — 8 October 2026\",\"body\":\"NIST AI RMF 1.0 remains the current published framework while NIST is revising it. Its core is organized around \u003Cstrong>GOVERN, MAP, MEASURE and MANAGE\u003C\u002Fstrong>, with GOVERN as a cross-cutting function. ISO\u002FIEC 42001:2023 remains the international AI management-system standard for establishing, operating and continually improving an AI management system. The EU AI Act is now generally applicable from 2 August 2026, while some obligations had earlier application dates and some high-risk requirements have later transition dates. Regulatory timelines should always be rechecked before making a concrete compliance decision.\"},\"tunes\":{}},{\"id\":\"toc\",\"type\":\"tableOfContents\",\"data\":{\"title\":\"Contents\",\"minLevel\":2,\"maxLevel\":3},\"tunes\":{}},{\"id\":\"h-meaning\",\"type\":\"header\",\"data\":{\"text\":\"What AI governance really means\",\"level\":2},\"tunes\":{}},{\"id\":\"p-meaning-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI governance answers organizational questions that a model, SDK or architecture diagram cannot answer by itself. Who owns the business outcome? Who may approve a new provider? Which data classes are prohibited from external processing? What evidence is required before deployment? Which permissions may an agent receive? Who can accept residual risk? What happens when a model changes behavior after an upgrade?\"},\"tunes\":{}},{\"id\":\"p-meaning-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The purpose is not to prevent change. Good governance makes change legible: decisions have owners, evidence, conditions, exceptions, review dates and rollback or escalation paths.\"},\"tunes\":{}},{\"id\":\"p-meaning-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"This is why NIST places GOVERN across the entire AI risk-management lifecycle rather than treating governance as one final approval step. Governance establishes the culture, policies, accountability and organizational structures that make mapping, measuring and managing AI risk possible.\"},\"tunes\":{}},{\"id\":\"h-simple\",\"type\":\"header\",\"data\":{\"text\":\"The simplest example\",\"level\":2},\"tunes\":{}},{\"id\":\"p-simple-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"A product team wants to add an external generative-AI provider to summarize internal customer-support tickets. Technically, the integration may require only an API call.\"},\"tunes\":{}},{\"id\":\"p-simple-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance asks a different set of questions: Are the ticket contents permitted to leave the organization's environment? Which provider and model version are approved? Is retention disabled? Which users may invoke the feature? How is output evaluated? Is human review required? What gets logged? Who owns incidents? What happens if the provider changes its terms or model behavior?\"},\"tunes\":{}},{\"id\":\"p-simple-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The governance result may still be “deploy it.” The difference is that deployment is now a traceable decision with explicit conditions instead of an unrecorded engineering choice.\"},\"tunes\":{}},{\"id\":\"simple-flow\",\"type\":\"processFlow\",\"data\":{\"title\":\"A basic governed AI decision\",\"orientation\":\"auto\",\"steps\":[{\"label\":\"1. Register the use case\",\"description\":\"Record purpose, owner, users, data, model\u002Fprovider and intended outcome.\"},{\"label\":\"2. Classify risk and obligations\",\"description\":\"Determine business consequence, data sensitivity, autonomy, regulatory exposure and misuse potential.\"},{\"label\":\"3. Define required controls\",\"description\":\"Specify permissions, data handling, evaluations, human oversight, security, logging and provider constraints.\"},{\"label\":\"4. Collect evidence\",\"description\":\"Run tests, security\u002Fprivacy review, architecture review and relevant legal\u002Fcompliance checks.\"},{\"label\":\"5. Make a decision\",\"description\":\"Approve, approve with conditions, request changes, hold or reject.\"},{\"label\":\"6. Deploy under controlled configuration\",\"description\":\"Pin the approved model\u002Fprovider\u002Fruntime and enforce required boundaries.\"},{\"label\":\"7. Monitor and re-evaluate\",\"description\":\"Track incidents, quality, drift, provider changes, new risks and changed regulations.\"},{\"label\":\"8. Change, suspend or retire\",\"description\":\"Use evidence and ownership rules to decide the next lifecycle state.\"}]},\"tunes\":{}},{\"id\":\"h-stops\",\"type\":\"header\",\"data\":{\"text\":\"Where the simple example stops\",\"level\":2},\"tunes\":{}},{\"id\":\"p-stops-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Large organizations rarely govern one AI system in isolation. The same model may support dozens of products; one provider may process several data classes; an agent platform may expose shared tools to many teams.\"},\"tunes\":{}},{\"id\":\"p-stops-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance therefore needs portfolio-level structures as well as system-level controls: AI inventory, approved providers, model catalogs, shared evaluation baselines, security patterns, risk thresholds, exception registers and ownership mappings.\"},\"tunes\":{}},{\"id\":\"p-stops-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance also cannot be identical for every AI use. A public-content summarizer, an internal coding assistant, a hiring-support system and an agent that can initiate payments have materially different consequence and control profiles.\"},\"tunes\":{}},{\"id\":\"h-not\",\"type\":\"header\",\"data\":{\"text\":\"What AI governance is — and what it is not\",\"level\":2},\"tunes\":{}},{\"id\":\"not-comparison\",\"type\":\"comparison\",\"data\":{\"title\":\"AI governance compared with adjacent disciplines\",\"layout\":\"table\",\"columns\":[{\"id\":\"governance\",\"label\":\"AI governance\"},{\"id\":\"adjacent\",\"label\":\"Adjacent discipline\"}],\"rows\":[{\"id\":\"architecture\",\"label\":\"Enterprise \u002F solution architecture\",\"values\":[\"\",\"\"]},{\"id\":\"risk\",\"label\":\"AI risk management\",\"values\":[\"\",\"\"]},{\"id\":\"compliance\",\"label\":\"Compliance\",\"values\":[\"\",\"\"]},{\"id\":\"security\",\"label\":\"Security\",\"values\":[\"\",\"\"]},{\"id\":\"mlops\",\"label\":\"MLOps \u002F LLMOps\",\"values\":[\"\",\"\"]},{\"id\":\"ethics\",\"label\":\"AI ethics principles\",\"values\":[\"\",\"\"]}]},\"tunes\":{}},{\"id\":\"h-governance-compliance\",\"type\":\"header\",\"data\":{\"text\":\"Governance is broader than compliance\",\"level\":2},\"tunes\":{}},{\"id\":\"p-compliance-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Compliance is one input to governance, not the entire governance system. An AI use case can be legally permitted yet still violate company risk appetite, security policy, contractual obligations or product-quality requirements.\"},\"tunes\":{}},{\"id\":\"p-compliance-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The reverse also matters: internal approval does not override law. Governance should make applicable legal obligations visible inside the same decision path used for architecture, security and business risk.\"},\"tunes\":{}},{\"id\":\"p-compliance-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"ISO\u002FIEC 42001 explicitly frames an AI management system as a structured way to establish policies, objectives and processes for responsible AI. ISO also states that the standard does not replace laws or regulations; it provides a management framework that can support compliance.\"},\"tunes\":{}},{\"id\":\"h-frameworks\",\"type\":\"header\",\"data\":{\"text\":\"NIST AI RMF and ISO\u002FIEC 42001 solve different governance needs\",\"level\":2},\"tunes\":{}},{\"id\":\"framework-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Framework \u002F standard\",\"Primary role\",\"Useful governance value\"],[\"NIST AI RMF 1.0\",\"Voluntary AI risk-management framework\",\"Organizes outcomes around GOVERN, MAP, MEASURE and MANAGE across the lifecycle\"],[\"NIST AI 600-1\",\"Generative-AI profile for AI RMF\",\"Adds GenAI-specific risk considerations and actions\"],[\"ISO\u002FIEC 42001:2023\",\"AI management-system requirements\",\"Creates an organization-wide management system with policy, roles, processes and continual improvement\"],[\"ISO\u002FIEC 23894:2023\",\"AI risk-management guidance\",\"Guides integration of AI-specific risk management into organizational activities\"],[\"EU AI Act\",\"Binding regulation in the EU\",\"Creates legal obligations according to actor, AI category and use case\"]]},\"tunes\":{}},{\"id\":\"p-framework-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"These sources should not be collapsed into one checklist. NIST AI RMF is risk-management guidance. ISO\u002FIEC 42001 is a management-system standard. The EU AI Act is law. An organization can use them together, but their authority, scope and implementation purpose are different.\"},\"tunes\":{}},{\"id\":\"h-current-eu\",\"type\":\"header\",\"data\":{\"text\":\"Current EU AI Act timing matters\",\"level\":2},\"tunes\":{}},{\"id\":\"p-eu-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"As of 8 October 2026, the European Commission states that the AI Act became generally applicable on 2 August 2026. Prohibited-practice and AI-literacy provisions applied from 2 February 2025, while governance rules and obligations for general-purpose AI models applied from 2 August 2025.\"},\"tunes\":{}},{\"id\":\"p-eu-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The Commission's current guidance also reflects later application dates for certain high-risk requirements. Exact dates and transition rules are a moving compliance input and should be verified against current Commission material before a deployment decision.\"},\"tunes\":{}},{\"id\":\"eu-boundary\",\"type\":\"callout\",\"data\":{\"variant\":\"warning\",\"title\":\"Architecture article, not legal advice\",\"body\":\"The regulatory examples here explain why governance needs versioned legal\u002Fcompliance inputs. They do not determine whether a specific product is legally classified as prohibited, high-risk, GPAI, deployer, provider or another regulated actor.\"},\"tunes\":{}},{\"id\":\"h-inventory\",\"type\":\"header\",\"data\":{\"text\":\"AI governance starts with an inventory\",\"level\":2},\"tunes\":{}},{\"id\":\"p-inventory-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"An organization cannot govern AI systems it cannot identify. The inventory should cover more than custom-trained models. It may include external model APIs, embedded copilots, local models, AI-enabled SaaS features, agent runtimes, retrieval systems and automated decision components.\"},\"tunes\":{}},{\"id\":\"p-inventory-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"A useful inventory connects the AI capability to its business owner, technical owner, use case, users, data classes, model\u002Fprovider, deployment environment, permissions, risk classification, evaluation status, applicable obligations and lifecycle state.\"},\"tunes\":{}},{\"id\":\"p-inventory-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The inventory is not only a spreadsheet for auditors. It is the index that lets the organization know what must be reviewed when a provider changes, a vulnerability appears, a regulation becomes applicable or a model is retired.\"},\"tunes\":{}},{\"id\":\"inventory-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Inventory field\",\"Why governance needs it\"],[\"Use case \u002F purpose\",\"Defines why AI exists and what success means\"],[\"Business owner\",\"Owns outcome and business risk\"],[\"Technical owner\",\"Owns architecture, implementation and operation\"],[\"Model + version\",\"Identifies the behavior-producing dependency\"],[\"Provider \u002F runtime\",\"Identifies contractual, hosting and operational dependency\"],[\"Data classes\",\"Determines privacy, confidentiality and Source-of-Truth constraints\"],[\"Users \u002F affected parties\",\"Determines exposure and human-impact context\"],[\"Tools \u002F actions\",\"Determines autonomy and side-effect risk\"],[\"Permissions \u002F identity\",\"Defines who or what may invoke the capability\"],[\"Risk classification\",\"Determines required controls and approval path\"],[\"Evaluation evidence\",\"Shows whether intended behavior was tested\"],[\"Lifecycle state\",\"Draft, review, approved, restricted, suspended or retired\"],[\"Review date \u002F triggers\",\"Defines when the governance decision must be revisited\"]]},\"tunes\":{}},{\"id\":\"h-ownership\",\"type\":\"header\",\"data\":{\"text\":\"Governance requires named ownership\",\"level\":2},\"tunes\":{}},{\"id\":\"p-own-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI failures often cross organizational boundaries. A model-quality problem may become a product failure, security issue, privacy incident or contractual breach. Governance needs named owners before the incident occurs.\"},\"tunes\":{}},{\"id\":\"p-own-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Ownership does not mean one person is responsible for everything. A strong model separates decision rights: business owner, product owner, technical owner, data owner, security\u002Fprivacy specialists, legal\u002Fcompliance actors and operational support.\"},\"tunes\":{}},{\"id\":\"p-own-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The critical property is that every required decision has an owner and every owner knows which evidence they are expected to review.\"},\"tunes\":{}},{\"id\":\"h-decision-rights\",\"type\":\"header\",\"data\":{\"text\":\"Decision rights should be explicit\",\"level\":2},\"tunes\":{}},{\"id\":\"decision-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Decision\",\"Typical accountable function\"],[\"May this AI use case exist?\",\"Business\u002Fproduct owner with governance\u002Frisk input\"],[\"May this data class be processed?\",\"Data owner + privacy\u002Fsecurity according to policy\"],[\"May this provider\u002Fmodel be used?\",\"Architecture\u002Fplatform + security\u002Fprocurement + governance\"],[\"May this agent execute this action?\",\"Application owner + authorization\u002Fbusiness-policy owner\"],[\"Is quality sufficient for deployment?\",\"Product\u002Ftechnical owner against defined acceptance criteria\"],[\"Can residual risk be accepted?\",\"Named risk owner at appropriate authority level\"],[\"Can an exception be granted?\",\"Explicit exception authority, time-bounded and documented\"],[\"Should the system be suspended?\",\"Operational\u002Fbusiness owner under incident or risk triggers\"],[\"Can a model upgrade go live?\",\"Change owner after regression\u002Fevaluation evidence\"]]},\"tunes\":{}},{\"id\":\"h-model\",\"type\":\"header\",\"data\":{\"text\":\"Model governance is more than choosing a model\",\"level\":2},\"tunes\":{}},{\"id\":\"p-model-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Model governance tracks which model is used, for what purpose, under which configuration and evidence. This applies to external APIs, locally hosted models, fine-tuned models and models embedded in third-party software.\"},\"tunes\":{}},{\"id\":\"p-model-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"A model decision should consider capability, evaluation results, cost, latency, data handling, provider terms, lifecycle support, geographic\u002Fhosting constraints, security, fallback behavior and the consequences of version change.\"},\"tunes\":{}},{\"id\":\"p-model-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Model aliases such as “latest” can be operationally convenient but weaken reproducibility if behavior changes without a governed release process. Consequential systems benefit from explicit version tracking and regression evaluation.\"},\"tunes\":{}},{\"id\":\"h-provider\",\"type\":\"header\",\"data\":{\"text\":\"Provider governance is a separate dependency layer\",\"level\":2},\"tunes\":{}},{\"id\":\"p-provider-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Two systems using the same model family can have different governance risk if one runs locally and another sends data to an external provider. Provider governance covers contractual terms, processing location, retention, logging, sub-processors, availability, deprecation and exit strategy.\"},\"tunes\":{}},{\"id\":\"p-provider-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Provider abstraction can reduce technical lock-in, but it does not remove governance work. Swapping providers can change data flows, model behavior, security assumptions, cost and compliance obligations.\"},\"tunes\":{}},{\"id\":\"p-provider-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"An approved provider list should therefore not be interpreted as “every model and every data class from this provider is automatically approved.” Approval needs scope.\"},\"tunes\":{}},{\"id\":\"h-data\",\"type\":\"header\",\"data\":{\"text\":\"Data governance remains the Source-of-Truth layer\",\"level\":2},\"tunes\":{}},{\"id\":\"p-data-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI governance does not make the model the authority for organizational facts. Data governance still determines ownership, classification, retention, quality and permitted use of source data.\"},\"tunes\":{}},{\"id\":\"p-data-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"For RAG and agents, governance should identify which sources are authoritative, which are advisory, how provenance is preserved, which data may enter model context and which tenant\u002Fuser boundaries must be enforced.\"},\"tunes\":{}},{\"id\":\"p-data-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Generated outputs create new data-governance questions as well: whether prompts and responses are retained, who may access traces, whether generated summaries become records and how derived embeddings or indexes are deleted when source data is removed.\"},\"tunes\":{}},{\"id\":\"h-permissions\",\"type\":\"header\",\"data\":{\"text\":\"Permissions are governance decisions with runtime enforcement\",\"level\":2},\"tunes\":{}},{\"id\":\"p-perm-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Agentic AI makes permissions a first-class governance object. The organization needs to decide which tools, files, APIs, databases and side effects each agent or user may access.\"},\"tunes\":{}},{\"id\":\"p-perm-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance defines the policy and approval logic; the trusted runtime enforces it. Natural-language instructions such as “do not delete files” are not a substitute for filesystem, API or service authorization.\"},\"tunes\":{}},{\"id\":\"p-perm-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The same principle applies to tenant isolation: a role can authorize an operation while tenant scope constrains which customer's resources that operation may reach.\"},\"tunes\":{}},{\"id\":\"h-risk\",\"type\":\"header\",\"data\":{\"text\":\"Risk classification should change the control set\",\"level\":2},\"tunes\":{}},{\"id\":\"p-risk-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Not every AI system needs the same review depth. Governance becomes scalable when risk classification changes the evidence, approval and monitoring requirements.\"},\"tunes\":{}},{\"id\":\"risk-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Risk driver\",\"Lower-control example\",\"Higher-control example\"],[\"Business consequence\",\"Draft internal text\",\"Approve financial settlement\"],[\"Human impact\",\"Optional writing aid\",\"Employment or eligibility decision support\"],[\"Data sensitivity\",\"Public documentation\",\"Health, HR, financial or confidential data\"],[\"Autonomy\",\"Read-only recommendation\",\"Agent with write\u002Fpayment\u002Fdeployment tools\"],[\"Reversibility\",\"Easily regenerated summary\",\"Irreversible external transaction\"],[\"Exposure\",\"Small internal pilot\",\"Public\u002Fcustomer-facing system at scale\"],[\"Source authority\",\"Advisory content\",\"System relied on for regulated or contractual fact\"],[\"Failure detectability\",\"Obvious formatting defect\",\"Plausible but materially wrong recommendation\"]]},\"tunes\":{}},{\"id\":\"p-risk-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The classification method can be simple or sophisticated, but it should map to concrete consequences: more testing, narrower permissions, required human oversight, security review, executive risk acceptance or deployment prohibition.\"},\"tunes\":{}},{\"id\":\"h-map\",\"type\":\"header\",\"data\":{\"text\":\"Governance must preserve use-case context\",\"level\":2},\"tunes\":{}},{\"id\":\"p-map-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"NIST's MAP function emphasizes intended purpose, users, deployment context, assumptions, impacts and applicable laws or norms. This matters because the same model can be low risk in one use case and high consequence in another.\"},\"tunes\":{}},{\"id\":\"p-map-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance records should therefore classify the application, not only the model. “We use model X” is not enough to determine risk.\"},\"tunes\":{}},{\"id\":\"p-map-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The relevant governance object is the system\u002Fuse case: model + data + context + tools + users + deployment environment + business process.\"},\"tunes\":{}},{\"id\":\"h-evaluation\",\"type\":\"header\",\"data\":{\"text\":\"Evaluation is governance evidence\",\"level\":2},\"tunes\":{}},{\"id\":\"p-eval-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"An AI governance process should not approve deployment based only on vendor benchmarks or a successful demo. The system needs evidence tied to its actual intended use.\"},\"tunes\":{}},{\"id\":\"p-eval-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Useful evidence can include task-success evaluation, retrieval quality, factual grounding, security tests, permission tests, adversarial scenarios, human-review studies, latency\u002Fcost, robustness and regression comparisons.\"},\"tunes\":{}},{\"id\":\"p-eval-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"NIST's MEASURE function makes this explicit: organizations should identify and apply appropriate methods and metrics for risks identified during mapping, while documenting risks that cannot or will not be measured.\"},\"tunes\":{}},{\"id\":\"eval-boundary\",\"type\":\"callout\",\"data\":{\"variant\":\"success\",\"title\":\"A governance gate should ask for evidence, not confidence\",\"body\":\"“The team thinks the model is good enough” is a weak approval artifact. “The system met defined acceptance criteria on representative tests, with these known limitations and residual risks” is governable.\"},\"tunes\":{}},{\"id\":\"h-gates\",\"type\":\"header\",\"data\":{\"text\":\"Governance gates should exist across the lifecycle\",\"level\":2},\"tunes\":{}},{\"id\":\"gate-flow\",\"type\":\"processFlow\",\"data\":{\"title\":\"Example lifecycle gates\",\"orientation\":\"auto\",\"steps\":[{\"label\":\"Idea \u002F discovery gate\",\"description\":\"Confirm business purpose, owner and whether AI is an appropriate solution.\"},{\"label\":\"Architecture gate\",\"description\":\"Review model\u002Fprovider, data flow, identity, permissions, isolation and operational design.\"},{\"label\":\"Risk\u002Fcompliance gate\",\"description\":\"Classify risk and applicable obligations; define required controls.\"},{\"label\":\"Validation gate\",\"description\":\"Require evidence that functional, safety, security and quality criteria are met.\"},{\"label\":\"Deployment gate\",\"description\":\"Approve concrete configuration, version, environment and operational owner.\"},{\"label\":\"Change gate\",\"description\":\"Re-evaluate model\u002Fprovider\u002Ftool\u002Fdata changes according to materiality.\"},{\"label\":\"Incident gate\",\"description\":\"Pause, restrict or roll back when defined risk triggers occur.\"},{\"label\":\"Retirement gate\",\"description\":\"Remove access, data derivatives, credentials and obsolete dependencies cleanly.\"}]},\"tunes\":{}},{\"id\":\"h-change\",\"type\":\"header\",\"data\":{\"text\":\"Change management is central to AI governance\",\"level\":2},\"tunes\":{}},{\"id\":\"p-change-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI systems change even when application code does not. Providers update models, safety filters, context limits, pricing, policies and infrastructure. Retrieval corpora change. Agent tools gain permissions. Regulations and contracts evolve.\"},\"tunes\":{}},{\"id\":\"p-change-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance should therefore define material-change triggers. A minor prompt wording adjustment may need ordinary regression tests; replacing the model, enabling write tools or introducing sensitive data may require a new approval gate.\"},\"tunes\":{}},{\"id\":\"p-change-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The governance record should preserve which version was approved and what conditions made the approval valid.\"},\"tunes\":{}},{\"id\":\"h-exceptions\",\"type\":\"header\",\"data\":{\"text\":\"Exceptions need owners, expiry and compensating controls\",\"level\":2},\"tunes\":{}},{\"id\":\"p-exc-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Real organizations need exceptions. A team may need an unapproved model for a time-bounded experiment, or a legacy system may not yet meet a new logging requirement.\"},\"tunes\":{}},{\"id\":\"p-exc-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The dangerous pattern is a permanent undocumented exception. Governable exceptions specify owner, rationale, scope, residual risk, compensating control, expiration date and review condition.\"},\"tunes\":{}},{\"id\":\"p-exc-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Exception handling should be part of the normal governance system rather than an informal side channel.\"},\"tunes\":{}},{\"id\":\"h-audit\",\"type\":\"header\",\"data\":{\"text\":\"Auditability is the ability to reconstruct the decision and execution\",\"level\":2},\"tunes\":{}},{\"id\":\"p-audit-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI auditability is not merely storing model prompts. It means being able to reconstruct which system version was used, which data and permissions applied, who approved the configuration, what evaluations supported deployment and what happened during relevant execution.\"},\"tunes\":{}},{\"id\":\"p-audit-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"For an agent, this may require principal identity, tool calls, approvals, target resources, state changes and outcomes. For RAG, it may require corpus\u002Findex version, retrieval query, selected evidence and provenance. For a model change, it may require the previous and new evaluation results.\"},\"tunes\":{}},{\"id\":\"p-audit-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Audit evidence should be proportionate. Logging every possible token can create privacy and security risk of its own. Governance should define which evidence is necessary, how long it is retained and who may access it.\"},\"tunes\":{}},{\"id\":\"audit-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Audit object\",\"Useful evidence\"],[\"Governance decision\",\"Owner, date, decision, conditions, evidence, exceptions\"],[\"Model release\",\"Model\u002Fprovider\u002Fversion, configuration, regression results\"],[\"Data access\",\"Principal, tenant\u002Fscope, source class, policy decision\"],[\"Agent action\",\"Tool, arguments\u002Ftarget, approval, result, state change\"],[\"RAG answer\",\"Corpus\u002Findex version, retrieval set, selected evidence, citations\"],[\"Incident\",\"Trigger, affected systems, containment, decision owner, remediation\"],[\"Retirement\",\"Disabled endpoints, revoked credentials, deleted derived data, archive decision\"]]},\"tunes\":{}},{\"id\":\"h-observability\",\"type\":\"header\",\"data\":{\"text\":\"Monitoring closes the governance loop\",\"level\":2},\"tunes\":{}},{\"id\":\"p-monitor-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Approval is a snapshot. Production monitoring tells governance whether the assumptions behind approval still hold.\"},\"tunes\":{}},{\"id\":\"p-monitor-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Useful signals depend on the use case: quality regression, unsafe outputs, tool failures, policy denials, unusual cost, latency, user complaints, drift, retrieval freshness, provider incidents, security alerts or new regulatory classifications.\"},\"tunes\":{}},{\"id\":\"p-monitor-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance should define thresholds that cause action: investigate, restrict, require human review, roll back, switch provider, suspend or retire.\"},\"tunes\":{}},{\"id\":\"h-incidents\",\"type\":\"header\",\"data\":{\"text\":\"AI incidents need a defined operational path\",\"level\":2},\"tunes\":{}},{\"id\":\"p-inc-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI-specific incidents may involve harmful content, data leakage, unauthorized actions, persistent factual failure, model\u002Fprovider outage, prompt injection, cross-tenant retrieval or unexpected behavior after a model update.\"},\"tunes\":{}},{\"id\":\"p-inc-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The incident process should connect technical response with governance ownership. Someone must be authorized to disable a model, remove a tool, revoke credentials, restrict users, notify affected functions and decide whether the system may return to service.\"},\"tunes\":{}},{\"id\":\"p-inc-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The lessons from incidents should update policies, tests, risk classification and reusable platform controls rather than remain isolated in one team.\"},\"tunes\":{}},{\"id\":\"h-procurement\",\"type\":\"header\",\"data\":{\"text\":\"Procurement is part of AI governance\",\"level\":2},\"tunes\":{}},{\"id\":\"p-proc-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Organizations can acquire substantial AI capability through ordinary SaaS procurement. Governance should therefore cover purchased AI features as well as internally engineered systems.\"},\"tunes\":{}},{\"id\":\"p-proc-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Vendor review can include data use, retention, model training policy, sub-processors, security, incident notification, export\u002Fdeletion, geographic processing, version change, service continuity and contractual exit.\"},\"tunes\":{}},{\"id\":\"p-proc-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"A technical architecture review and procurement review should share the same system inventory so commercial approval does not drift away from the actual deployed data flow.\"},\"tunes\":{}},{\"id\":\"h-human\",\"type\":\"header\",\"data\":{\"text\":\"Human oversight should be designed, not merely declared\",\"level\":2},\"tunes\":{}},{\"id\":\"p-human-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"“Human in the loop” is meaningful only if the human has authority, time, information and a usable intervention mechanism.\"},\"tunes\":{}},{\"id\":\"p-human-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"A reviewer who sees only the AI recommendation but not its evidence, uncertainty or source state may simply rubber-stamp the output. Governance should specify what the reviewer can inspect and what actions are available: approve, reject, edit, escalate or stop.\"},\"tunes\":{}},{\"id\":\"p-human-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Human oversight should also be risk-based. Low-consequence systems may use sampling or post-hoc review, while high-consequence side effects may require approval before execution.\"},\"tunes\":{}},{\"id\":\"h-platform\",\"type\":\"header\",\"data\":{\"text\":\"Platform governance and use-case governance are different\",\"level\":2},\"tunes\":{}},{\"id\":\"platform-comparison\",\"type\":\"comparison\",\"data\":{\"title\":\"Two governance levels\",\"layout\":\"table\",\"columns\":[{\"id\":\"platform\",\"label\":\"Shared AI platform\"},{\"id\":\"usecase\",\"label\":\"Individual AI use case\"}],\"rows\":[{\"id\":\"owner\",\"label\":\"Primary concern\",\"values\":[\"\",\"\"]},{\"id\":\"approval\",\"label\":\"Typical approval\",\"values\":[\"\",\"\"]},{\"id\":\"evidence\",\"label\":\"Evidence\",\"values\":[\"\",\"\"]},{\"id\":\"failure\",\"label\":\"Governance failure\",\"values\":[\"\",\"\"]}]},\"tunes\":{}},{\"id\":\"p-platform-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Platform approval should therefore reduce repeated work, not eliminate use-case accountability. “The model is approved” is different from “this application of the model is approved.”\"},\"tunes\":{}},{\"id\":\"h-architecture\",\"type\":\"header\",\"data\":{\"text\":\"AI governance and Enterprise AI Architecture\",\"level\":2},\"tunes\":{}},{\"id\":\"p-arch-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Enterprise AI Architecture describes how AI systems, platforms, data, identities, providers, operations and organizational systems fit together. AI governance describes the decision and control system that determines how those architectures may be created and changed.\"},\"tunes\":{}},{\"id\":\"p-arch-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The two are tightly coupled. Governance without architecture can become abstract policy. Architecture without governance can produce technically elegant systems with unclear ownership, uncontrolled provider adoption or unreviewed risk.\"},\"tunes\":{}},{\"id\":\"p-arch-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The strongest design is bidirectional: governance requirements become architecture controls, while architecture exposes the real decisions that governance must own.\"},\"tunes\":{}},{\"id\":\"h-implementation\",\"type\":\"header\",\"data\":{\"text\":\"Original project evidence\",\"level\":2},\"tunes\":{}},{\"id\":\"h-enterprise\",\"type\":\"header\",\"data\":{\"text\":\"Enterprise Aaasaasa 0.1: governance as delivery structure\",\"level\":3},\"tunes\":{}},{\"id\":\"enterprise-note\",\"type\":\"callout\",\"data\":{\"variant\":\"note\",\"title\":\"Project \u002F PoC evidence\",\"body\":\"Enterprise Aaasaasa 0.1 is project and training\u002FPoC evidence, not evidence of commercial enterprise adoption. It is useful here because its delivery structure explicitly connects architecture, milestones, risks, stakeholders, validation and project decisions.\"},\"tunes\":{}},{\"id\":\"p-ent-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Enterprise Aaasaasa 0.1 uses defined milestones for requirements, architecture, prototype, validation and project closure. That structure illustrates a core governance principle: lifecycle transitions should have explicit outputs and decision points instead of an informal “build first, review later” process.\"},\"tunes\":{}},{\"id\":\"p-ent-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"The project also tracks risks such as scope creep, architecture delay and AI\u002FGDPR concerns and identifies stakeholder groups including sponsorship, steering, architecture, security, marketing, external APIs and hosting.\"},\"tunes\":{}},{\"id\":\"p-ent-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"This does not constitute an ISO\u002FIEC 42001 management system. It is narrower project evidence showing how ownership, risk, milestones and validation can be integrated into technical delivery.\"},\"tunes\":{}},{\"id\":\"h-senseflow\",\"type\":\"header\",\"data\":{\"text\":\"SenseFlow: requirements and decision traceability\",\"level\":3},\"tunes\":{}},{\"id\":\"p-sense-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"SenseFlow uses a structured path from product goal and user need through epics, user stories, acceptance criteria, architecture, implementation and validation. Decision records preserve the decision, rationale, alternatives, trade-offs, status and date\u002Fversion.\"},\"tunes\":{}},{\"id\":\"p-sense-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"That traceability pattern is directly relevant to governance because an AI control should connect to the requirement or risk that justified it. A governance system becomes stronger when the chain from business need to architecture decision to validation evidence can be reconstructed.\"},\"tunes\":{}},{\"id\":\"h-client\",\"type\":\"header\",\"data\":{\"text\":\"Aaasaasa AI Client: permissions and runtime as governed configuration\",\"level\":3},\"tunes\":{}},{\"id\":\"p-client-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Aaasaasa AI Client separates provider, model, runtime location and permissions rather than treating them as one “AI setting.” Central workspace permission profiles govern tool access, Direct Chat has no filesystem\u002Fshell tools, and agent-capable runtimes operate under explicit permission profiles.\"},\"tunes\":{}},{\"id\":\"p-client-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"That separation demonstrates an important governance pattern: model choice and action authority should be independent configuration objects. A stronger model does not automatically receive broader filesystem, shell or business permissions.\"},\"tunes\":{}},{\"id\":\"p-client-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The implementation evidence is architectural, not a claim that the application constitutes a certified organizational AI governance system.\"},\"tunes\":{}},{\"id\":\"impl-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Observed project pattern\",\"Governance lesson\"],[\"Milestone gates\",\"Lifecycle transitions can require explicit evidence\"],[\"Risk register\",\"Known uncertainties become managed objects rather than informal concerns\"],[\"Stakeholder mapping\",\"Decision responsibility can be distributed deliberately\"],[\"Acceptance criteria + validation\",\"Deployment decisions can depend on evidence\"],[\"Decision records\",\"Architecture trade-offs remain traceable\"],[\"Separate model\u002Fprovider\u002Fruntime\u002Fpermissions\",\"Capability and authority can be governed independently\"],[\"Explicit project maturity labels\",\"PoC evidence is not misrepresented as production or market proof\"]]},\"tunes\":{}},{\"id\":\"h-failures\",\"type\":\"header\",\"data\":{\"text\":\"Common AI governance failure modes\",\"level\":2},\"tunes\":{}},{\"id\":\"failures-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Failure mode\",\"What goes wrong\"],[\"Governance is only a policy PDF\",\"Teams cannot translate policy into runtime controls or deployment decisions\"],[\"No AI inventory\",\"The organization cannot identify where models, agents or embedded AI are used\"],[\"Model approval is treated as use-case approval\",\"An approved model is used for a materially different risk context\"],[\"No named business owner\",\"Technical teams inherit business-risk decisions by default\"],[\"Risk classification has no control consequence\",\"Every system receives the same review regardless of consequence\"],[\"Permissions live only in prompts\",\"Model instructions become a substitute for real authorization\"],[\"Provider change is invisible\",\"Behavior\u002Fdata\u002Fcompliance assumptions change without re-evaluation\"],[\"Demo success is approval evidence\",\"Production risk is inferred from a small happy-path test\"],[\"Human oversight is ceremonial\",\"Reviewer cannot inspect evidence or stop the action\"],[\"Exception has no expiry\",\"Temporary workaround becomes permanent governance debt\"],[\"Logs exist but cannot reconstruct decisions\",\"Auditability is confused with raw data retention\"],[\"Compliance owns governance alone\",\"Product, engineering, security and operations disengage from accountability\"],[\"Every decision goes to a central board\",\"Governance becomes a bottleneck instead of a scalable control system\"]]},\"tunes\":{}},{\"id\":\"h-federated\",\"type\":\"header\",\"data\":{\"text\":\"Central governance does not mean centralizing every decision\",\"level\":2},\"tunes\":{}},{\"id\":\"p-fed-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"A mature organization can centralize policy, control patterns and escalation while delegating low-risk decisions to product or platform teams.\"},\"tunes\":{}},{\"id\":\"p-fed-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"This federated model scales better than requiring a central committee to approve every prompt change. The central function defines risk tiers, mandatory controls, provider policy, exception authority and audit requirements; teams operate autonomously inside those boundaries.\"},\"tunes\":{}},{\"id\":\"p-fed-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The design objective is consistent accountability, not maximum centralization.\"},\"tunes\":{}},{\"id\":\"h-metrics\",\"type\":\"header\",\"data\":{\"text\":\"Govern the governance system itself\",\"level\":2},\"tunes\":{}},{\"id\":\"p-metric-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance needs feedback. Otherwise controls can become expensive rituals that do not reduce risk.\"},\"tunes\":{}},{\"id\":\"metrics-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Metric \u002F signal\",\"What it can reveal\"],[\"Inventory coverage\",\"Whether AI adoption is visible to governance\"],[\"Time to decision\",\"Whether governance blocks delivery unnecessarily\"],[\"Exception count and age\",\"Whether policies are realistic or routinely bypassed\"],[\"Evaluation failure rate\",\"Whether pre-deployment controls catch defects\"],[\"Post-deployment incident rate\",\"Whether approval evidence predicts production behavior\"],[\"Unauthorized-tool denial rate\",\"Whether permission boundaries are actively exercised\"],[\"Model\u002Fprovider change frequency\",\"How often approved assumptions may become stale\"],[\"Retired-but-active systems\",\"Lifecycle cleanup\u002Fcontrol failure\"],[\"Repeated incident patterns\",\"Whether lessons are becoming reusable platform controls\"]]},\"tunes\":{}},{\"id\":\"p-metric-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Governance metrics should not reward paperwork volume. The useful measure is whether decision quality, traceability, risk detection and safe delivery improve.\"},\"tunes\":{}},{\"id\":\"h-sequence\",\"type\":\"header\",\"data\":{\"text\":\"A practical AI governance implementation sequence\",\"level\":2},\"tunes\":{}},{\"id\":\"design-flow\",\"type\":\"processFlow\",\"data\":{\"title\":\"Build governance from visibility to control\",\"orientation\":\"auto\",\"steps\":[{\"label\":\"1. Define governance scope\",\"description\":\"Decide which internally built, purchased, embedded and experimental AI systems are covered.\"},{\"label\":\"2. Create the AI inventory\",\"description\":\"Capture owners, use cases, models\u002Fproviders, data, tools, users, lifecycle state and risk class.\"},{\"label\":\"3. Define decision rights\",\"description\":\"Name who can approve providers, data use, risk acceptance, exceptions, deployment and retirement.\"},{\"label\":\"4. Establish risk tiers\",\"description\":\"Map consequence and exposure to different control requirements.\"},{\"label\":\"5. Define reusable minimum controls\",\"description\":\"Set baseline requirements for identity, permissions, data, security, evaluation, logging and human oversight.\"},{\"label\":\"6. Connect governance to architecture\",\"description\":\"Turn policy into platform\u002Fruntime controls that teams cannot accidentally bypass.\"},{\"label\":\"7. Build evidence-based gates\",\"description\":\"Require relevant evaluation, security, privacy, architecture and compliance evidence before lifecycle transitions.\"},{\"label\":\"8. Govern model\u002Fprovider change\",\"description\":\"Track versions, deprecations and material changes with regression evidence.\"},{\"label\":\"9. Add monitoring and incident triggers\",\"description\":\"Define which production signals force investigation, restriction or suspension.\"},{\"label\":\"10. Formalize exceptions\",\"description\":\"Require scope, owner, residual risk, compensating controls and expiry.\"},{\"label\":\"11. Audit decisions and execution\",\"description\":\"Retain proportionate evidence that links owners, configuration, permissions, evaluations and significant actions.\"},{\"label\":\"12. Improve the governance system\",\"description\":\"Use incidents, delays and repeated exceptions to revise controls and platform patterns.\"}]},\"tunes\":{}},{\"id\":\"h-checklist\",\"type\":\"header\",\"data\":{\"text\":\"AI governance checklist\",\"level\":2},\"tunes\":{}},{\"id\":\"checklist-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Question\",\"Expected governance evidence\"],[\"Why does this AI system exist?\",\"Purpose, business owner and intended outcome\"],[\"Who owns technical operation?\",\"Named technical\u002Fplatform owner\"],[\"Which model\u002Fprovider\u002Fversion is used?\",\"Registered and versioned dependency\"],[\"Which data may enter the system?\",\"Classification, authority and permitted-use decision\"],[\"Which identities may use it?\",\"Authentication and authorization model\"],[\"Which actions may it perform?\",\"Tool\u002Fpermission matrix and autonomy boundary\"],[\"What is the risk tier?\",\"Documented classification with rationale\"],[\"Which controls are mandatory?\",\"Risk-tier control baseline\"],[\"How was it evaluated?\",\"Representative tests and acceptance criteria\"],[\"Who accepted residual risk?\",\"Named accountable authority\"],[\"What requires human review?\",\"Explicit oversight\u002Fapproval rules\"],[\"What gets logged?\",\"Audit\u002Fobservability policy proportional to consequence\"],[\"What triggers re-review?\",\"Model\u002Fprovider\u002Fdata\u002Ftool\u002Fregulatory\u002Fmaterial-change events\"],[\"How can it be suspended?\",\"Operational kill\u002Frestriction path and owner\"],[\"How is it retired?\",\"Credential, data, derivative, endpoint and record cleanup\"]]},\"tunes\":{}},{\"id\":\"h-misconceptions\",\"type\":\"header\",\"data\":{\"text\":\"Common misconceptions\",\"level\":2},\"tunes\":{}},{\"id\":\"misconceptions-table\",\"type\":\"table\",\"data\":{\"withHeadings\":true,\"stretched\":false,\"content\":[[\"Misconception\",\"Correction\"],[\"“AI governance is compliance.”\",\"Compliance is one governance input; governance also covers ownership, architecture, permissions, quality, risk and lifecycle decisions.\"],[\"“Governance means a review committee.”\",\"Committees can approve exceptions or high-risk systems, but many controls should be embedded in normal delivery and platform architecture.\"],[\"“An approved model is safe for every use.”\",\"Risk belongs to the use case and system context, not only the model.\"],[\"“A vendor handles governance for us.”\",\"A provider controls part of the stack; the organization still owns its use case, data, permissions and business consequences.\"],[\"“Human-in-the-loop automatically solves risk.”\",\"Oversight only works when reviewers have authority, context and intervention capability.\"],[\"“Logging everything gives auditability.”\",\"Auditability requires reconstructable relevant evidence with controlled retention and access.\"],[\"“Governance blocks innovation.”\",\"Poor governance can block delivery; well-designed governance creates reusable safe paths and clearer decision ownership.\"],[\"“Low-risk pilots need no governance.”\",\"They can use lightweight governance, but inventory, ownership and data\u002Ftool boundaries still matter.\"],[\"“Local AI needs less governance.”\",\"Local hosting can change privacy\u002Fprovider risk, but model quality, permissions, security and lifecycle governance remain.\"],[\"“Once approved, the system stays approved.”\",\"Model, provider, data, regulation and use can change; governance decisions need review triggers.\"]]},\"tunes\":{}},{\"id\":\"h-edge\",\"type\":\"header\",\"data\":{\"text\":\"Edge cases and limitations\",\"level\":2},\"tunes\":{}},{\"id\":\"p-edge-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"Very small organizations may not need a dedicated AI governance function. The same principles can be implemented through lightweight architecture decisions, risk registers, owner mappings and release gates.\"},\"tunes\":{}},{\"id\":\"p-edge-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Highly regulated organizations may need much more formal governance, independent assurance, documented conformity processes and legal interpretation than this architecture-level article describes.\"},\"tunes\":{}},{\"id\":\"p-edge-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Open-source and self-hosted models reduce some provider dependencies but create others: patching, model provenance, evaluation, infrastructure security, licensing and operational ownership.\"},\"tunes\":{}},{\"id\":\"p-edge-4\",\"type\":\"paragraph\",\"data\":{\"text\":\"General-purpose AI models can be used across many contexts. Governance should avoid assuming that provider-level model controls fully determine downstream application risk.\"},\"tunes\":{}},{\"id\":\"p-edge-5\",\"type\":\"paragraph\",\"data\":{\"text\":\"No governance framework guarantees that an AI system is safe or correct. Governance improves accountability and decision quality; technical validation, monitoring and human judgment remain necessary.\"},\"tunes\":{}},{\"id\":\"h-change-answer\",\"type\":\"header\",\"data\":{\"text\":\"What would change this answer?\",\"level\":2},\"tunes\":{}},{\"id\":\"p-change-answer-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"The exact control set changes with law, industry, organization size, data sensitivity, autonomy, deployment model and business consequence.\"},\"tunes\":{}},{\"id\":\"p-change-answer-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"NIST is currently revising AI RMF 1.0, so future NIST terminology or recommended practices may change. ISO standards can also be revised, and EU AI Act guidance and transition details continue to evolve.\"},\"tunes\":{}},{\"id\":\"p-change-answer-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The stable architectural principle is that AI decisions need explicit owners, evidence, permissions, risk treatment and lifecycle review rather than being hidden inside model or application configuration.\"},\"tunes\":{}},{\"id\":\"h-related\",\"type\":\"header\",\"data\":{\"text\":\"Related canonical knowledge\",\"level\":2},\"tunes\":{}},{\"id\":\"p-related-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI governance depends on concepts already separated elsewhere in this knowledge graph: Source of Truth determines authority, RBAC and tenant isolation constrain access, context engineering controls model-visible information, and agentic architecture defines how tools and actions enter an execution loop.\"},\"tunes\":{}},{\"id\":\"p-related-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Enterprise AI Architecture is the parent organizational architecture concept. Governance is the operating control layer that determines how those enterprise AI components may be introduced, changed and retired.\"},\"tunes\":{}},{\"id\":\"p-related-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"Agentic systems increase governance requirements because model decisions can become real side effects. Permission, approval and audit controls must therefore exist outside the model itself.\"},\"tunes\":{}},{\"id\":\"ref-agent-reliability\",\"type\":\"referralArticle\",\"data\":{\"url\":\"https:\u002F\u002Fstajic.de\u002Fblog\u002Fai-agent-reliability-why-the-final-answer-is-not-enough\",\"title\":\"AI Agent Reliability: Why the Final Answer Is Not Enough\",\"excerpt\":\"Agent governance requires evidence about execution trajectories, tool use, state changes and recoverability — not only final output quality.\",\"ctaLabel\":\"Read the agent reliability article\"},\"tunes\":{}},{\"id\":\"ref-memory\",\"type\":\"referralArticle\",\"data\":{\"url\":\"https:\u002F\u002Fstajic.de\u002Fblog\u002Fai-agent-memory-is-not-rag-how-to-separate-memory-retrieval-state-and-context\",\"title\":\"AI Agent Memory Is Not RAG: How to Separate Memory, Retrieval, State and Context\",\"excerpt\":\"Governance needs different policies for durable memory, authoritative state, retrieved information and temporary model context.\",\"ctaLabel\":\"Read the memory architecture article\"},\"tunes\":{}},{\"id\":\"ref-avb\",\"type\":\"referralArticle\",\"data\":{\"url\":\"https:\u002F\u002Fstajic.de\u002Fblog\u002Fthe-answer-validity-boundary-the-missing-layer-between-relevance-and-reliable-ai-answers\",\"title\":\"The Answer Validity Boundary: The Missing Layer Between Relevance and Reliable AI Answers\",\"excerpt\":\"Governance decisions should preserve the conditions under which evidence and approval remain valid, including version, scope, source and time.\",\"ctaLabel\":\"Read the Answer Validity Boundary\"},\"tunes\":{}},{\"id\":\"h-faq\",\"type\":\"header\",\"data\":{\"text\":\"Frequently asked questions\",\"level\":2},\"tunes\":{}},{\"id\":\"faq\",\"type\":\"faq\",\"data\":{\"title\":\"AI governance FAQ\",\"items\":[{\"id\":\"faq1\",\"question\":\"What is AI governance?\",\"answer\":\"AI governance is the system of ownership, decision rights, controls and evidence used to manage how AI systems are developed, acquired, deployed, operated, changed and retired.\"},{\"id\":\"faq2\",\"question\":\"Is AI governance the same as AI risk management?\",\"answer\":\"No. Risk management identifies, assesses and treats risk. Governance defines who must do that work, which decisions require it and what evidence or authority is required.\"},{\"id\":\"faq3\",\"question\":\"Is AI governance the same as compliance?\",\"answer\":\"No. Compliance concerns applicable legal, regulatory, contractual or internal obligations. Governance integrates compliance with architecture, security, data, quality, permissions and business ownership.\"},{\"id\":\"faq4\",\"question\":\"What is the difference between AI governance and Enterprise AI Architecture?\",\"answer\":\"Enterprise AI Architecture defines how AI capabilities and systems fit into the organization. AI governance defines the decision and control system governing how those components may be introduced, operated and changed.\"},{\"id\":\"faq5\",\"question\":\"Do small companies need AI governance?\",\"answer\":\"Yes, but not necessarily a dedicated department. Lightweight inventory, ownership, permissions, evaluation and change controls can implement the same principles.\"},{\"id\":\"faq6\",\"question\":\"What should an AI inventory contain?\",\"answer\":\"At minimum: use case, owners, model\u002Fprovider\u002Fversion, data classes, users, tools\u002Factions, permissions, risk classification, evaluation status, lifecycle state and review triggers.\"},{\"id\":\"faq7\",\"question\":\"Does using an approved model mean a use case is approved?\",\"answer\":\"No. Risk depends on the application context: data, users, tools, autonomy, consequences and business process.\"},{\"id\":\"faq8\",\"question\":\"What makes an AI system auditable?\",\"answer\":\"The organization can reconstruct relevant ownership, approved configuration, model\u002Fprovider\u002Fversion, data\u002Fpermission context, evaluation evidence, significant actions and lifecycle decisions.\"},{\"id\":\"faq9\",\"question\":\"How often should AI governance decisions be reviewed?\",\"answer\":\"Use risk-based review intervals plus event triggers such as model\u002Fprovider changes, new data, new tools, incidents, material performance change or regulatory updates.\"}]},\"tunes\":{}},{\"id\":\"h-glossary\",\"type\":\"header\",\"data\":{\"text\":\"Glossary\",\"level\":2},\"tunes\":{}},{\"id\":\"glossary\",\"type\":\"glossary\",\"data\":{\"title\":\"Key AI governance terms\",\"entries\":[{\"term\":\"AI governance\",\"definition\":\"Organizational system of ownership, decision rights, controls and evidence governing the AI lifecycle.\",\"anchor\":\"ai-governance\"},{\"term\":\"AI management system\",\"definition\":\"Interrelated organizational policies, objectives and processes for responsible development, provision or use of AI; ISO\u002FIEC 42001 specifies requirements for such a system.\",\"anchor\":\"ai-management-system\"},{\"term\":\"AI inventory\",\"definition\":\"Registry of AI systems, models, providers, use cases, owners, data, risk classifications and lifecycle state.\",\"anchor\":\"ai-inventory\"},{\"term\":\"Risk owner\",\"definition\":\"Named authority accountable for deciding how a defined risk is treated or whether residual risk is accepted.\",\"anchor\":\"risk-owner\"},{\"term\":\"Control\",\"definition\":\"Technical, organizational or procedural measure intended to prevent, detect, reduce or respond to risk.\",\"anchor\":\"control\"},{\"term\":\"Governance gate\",\"definition\":\"Lifecycle decision point at which defined evidence and authority are required before proceeding.\",\"anchor\":\"governance-gate\"},{\"term\":\"Residual risk\",\"definition\":\"Risk that remains after controls or mitigation have been applied.\",\"anchor\":\"residual-risk\"},{\"term\":\"Exception\",\"definition\":\"Explicit, scoped and usually time-bounded authorization to deviate from a normal governance requirement.\",\"anchor\":\"exception\"},{\"term\":\"Auditability\",\"definition\":\"Ability to reconstruct relevant decisions, configurations, evidence, identities and execution events.\",\"anchor\":\"auditability\"},{\"term\":\"Model governance\",\"definition\":\"Controls and decisions covering model selection, versioning, evaluation, permitted use, change and retirement.\",\"anchor\":\"model-governance\"},{\"term\":\"Provider governance\",\"definition\":\"Controls covering external or internal AI provider dependencies, data handling, security, contracts, lifecycle and exit.\",\"anchor\":\"provider-governance\"},{\"term\":\"Human oversight\",\"definition\":\"Designed human review or intervention capability for AI decisions or actions at defined points.\",\"anchor\":\"human-oversight\"}]},\"tunes\":{}},{\"id\":\"h-conclusion\",\"type\":\"header\",\"data\":{\"text\":\"Conclusion\",\"level\":2},\"tunes\":{}},{\"id\":\"p-conclusion-1\",\"type\":\"paragraph\",\"data\":{\"text\":\"AI governance is the organizational control plane around AI. It gives names and evidence to decisions that otherwise remain hidden inside code, provider settings, prompts or informal team judgment.\"},\"tunes\":{}},{\"id\":\"p-conclusion-2\",\"type\":\"paragraph\",\"data\":{\"text\":\"Strong governance connects the complete system: business purpose, models, providers, data authority, identity, permissions, evaluation, risk, compliance, monitoring, incidents, change and retirement.\"},\"tunes\":{}},{\"id\":\"p-conclusion-3\",\"type\":\"paragraph\",\"data\":{\"text\":\"The practical goal is not maximum process. It is the minimum governance structure that makes important AI decisions owned, evidence-based, enforceable, reviewable and auditable throughout the lifecycle.\"},\"tunes\":{}},{\"id\":\"h-sources\",\"type\":\"header\",\"data\":{\"text\":\"Primary sources and current references\",\"level\":2},\"tunes\":{}},{\"id\":\"p-sources-note\",\"type\":\"paragraph\",\"data\":{\"text\":\"The sources below provide current external grounding for AI management, risk and regulation. Project sections are original implementation\u002Fproject evidence and are explicitly distinguished from formal standards or certified governance systems.\"},\"tunes\":{}},{\"id\":\"src-nist-rmf\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"NIST — AI Risk Management Framework\",\"description\":\"Current NIST hub for AI RMF 1.0, the ongoing revision, the GenAI Profile and related risk-management resources.\"}},\"tunes\":{}},{\"id\":\"src-nist-core\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fairc.nist.gov\u002Fairmf-resources\u002Fairmf\u002F5-sec-core\u002F\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"NIST AIRC — AI RMF Core\",\"description\":\"Official AI RMF Core describing GOVERN, MAP, MEASURE and MANAGE, with GOVERN as a cross-cutting lifecycle function.\"}},\"tunes\":{}},{\"id\":\"src-nist-playbook\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework\u002Fnist-ai-rmf-playbook\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"NIST — AI RMF Playbook\",\"description\":\"Suggested actions for operationalizing trustworthiness and risk management across the AI lifecycle.\"}},\"tunes\":{}},{\"id\":\"src-nist-genai\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fwww.nist.gov\u002Fpublications\u002Fartificial-intelligence-risk-management-framework-generative-artificial-intelligence\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"NIST AI 600-1 — Generative AI Profile\",\"description\":\"NIST companion profile applying AI RMF concepts to generative-AI risks and lifecycle management.\"}},\"tunes\":{}},{\"id\":\"src-iso42001\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F42001\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"ISO\u002FIEC 42001:2023 — AI management systems\",\"description\":\"International standard specifying requirements for establishing, implementing, maintaining and continually improving an AI management system.\"}},\"tunes\":{}},{\"id\":\"src-iso23894\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F77304.html\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"ISO\u002FIEC 23894:2023 — AI risk management\",\"description\":\"International guidance for integrating AI-specific risk management into organizational activities and functions.\"}},\"tunes\":{}},{\"id\":\"src-eu-act\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Fpolicies\u002Fregulatory-framework-ai\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"European Commission — AI Act\",\"description\":\"Current Commission overview of the EU AI Act, application timeline and implementation framework.\"}},\"tunes\":{}},{\"id\":\"src-eu-faq\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Ffaqs\u002Fnavigating-ai-act\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"European Commission — Navigating the AI Act\",\"description\":\"Current FAQ covering governance, enforcement, implementation and the evolving application timeline.\"}},\"tunes\":{}},{\"id\":\"src-eu-gpai\",\"type\":\"linkTool\",\"data\":{\"link\":\"https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Ffactpages\u002Fgeneral-purpose-ai-obligations-under-ai-act\",\"meta\":{\"image\":{\"url\":\"\"},\"title\":\"European Commission — General-purpose AI obligations\",\"description\":\"Current overview of documentation, copyright, training-content and systemic-risk obligations for GPAI providers.\"}},\"tunes\":{}}],\"version\":\"2.31.6\"}",{"time":1747,"blocks":1748,"version":3010},1791485902655,[1749,1753,1758,1763,1768,1772,1776,1780,1784,1788,1792,1796,1800,1804,1833,1837,1841,1845,1849,1853,1880,1884,1888,1892,1896,1900,1923,1927,1931,1935,1939,1944,1948,1952,1956,1960,2006,2010,2014,2018,2022,2026,2060,2064,2068,2072,2076,2080,2084,2088,2092,2096,2100,2104,2108,2112,2116,2120,2124,2128,2132,2172,2176,2180,2184,2188,2192,2196,2200,2204,2208,2213,2217,2246,2250,2254,2258,2262,2266,2270,2274,2278,2282,2286,2290,2294,2321,2325,2329,2333,2337,2341,2345,2349,2353,2357,2361,2365,2369,2373,2377,2381,2385,2389,2411,2415,2419,2423,2427,2431,2435,2439,2444,2448,2452,2456,2460,2464,2468,2472,2476,2480,2484,2512,2516,2562,2566,2570,2574,2578,2582,2586,2620,2624,2628,2669,2673,2725,2729,2766,2770,2774,2778,2782,2786,2790,2794,2798,2802,2806,2810,2814,2818,2822,2829,2836,2843,2847,2879,2883,2923,2927,2931,2935,2939,2943,2947,2954,2961,2968,2975,2982,2989,2996,3003],{"id":215,"data":1750,"type":218,"tunes":1752},{"text":1751},"AI governance is the system of decision rights, responsibilities, controls and evidence used to decide how an organization may develop, acquire, deploy, operate, change and retire AI systems. It is broader than a policy document and narrower than enterprise architecture as a whole. Effective AI governance connects business ownership, model and provider choices, data authority, permissions, risk classification, evaluation, monitoring, incident handling, auditability and lifecycle decisions so that someone can answer not only “does the AI work?” but also “who approved it, under which conditions, with what evidence, and when must that decision be revisited?”",{},{"id":221,"data":1754,"type":226,"tunes":1757},{"body":1755,"title":1756,"variant":225},"\u003Cstrong>AI governance turns AI from an informal technical capability into an accountable organizational capability.\u003C\u002Fstrong>\u003Cbr>\u003Cbr>Architecture determines how the system is built. Engineering implements it. Risk management evaluates uncertainty and harm. Compliance addresses applicable obligations. Governance connects these activities through ownership, decision rights, required controls, evidence and lifecycle gates.","Direct answer",{},{"id":229,"data":1759,"type":226,"tunes":1762},{"body":1760,"title":1761,"variant":233},"A governance board can be one mechanism, and policies can document expectations, but governance only becomes operational when decisions change what systems are allowed to do: which models may be used, which data may enter them, which tools an agent may execute, which evaluations are required, who can approve exceptions, what must be logged and what triggers suspension or retirement.","Governance is not a committee and not a PDF",{},{"id":236,"data":1764,"type":226,"tunes":1767},{"body":1765,"title":1766,"variant":240},"NIST AI RMF 1.0 remains the current published framework while NIST is revising it. Its core is organized around \u003Cstrong>GOVERN, MAP, MEASURE and MANAGE\u003C\u002Fstrong>, with GOVERN as a cross-cutting function. ISO\u002FIEC 42001:2023 remains the international AI management-system standard for establishing, operating and continually improving an AI management system. The EU AI Act is now generally applicable from 2 August 2026, while some obligations had earlier application dates and some high-risk requirements have later transition dates. Regulatory timelines should always be rechecked before making a concrete compliance decision.","Current-source note — 8 October 2026",{},{"id":243,"data":1769,"type":248,"tunes":1771},{"title":1770,"maxLevel":246,"minLevel":247},"Contents",{},{"id":251,"data":1773,"type":42,"tunes":1775},{"text":1774,"level":247},"What AI governance really means",{},{"id":256,"data":1777,"type":218,"tunes":1779},{"text":1778},"AI governance answers organizational questions that a model, SDK or architecture diagram cannot answer by itself. Who owns the business outcome? Who may approve a new provider? Which data classes are prohibited from external processing? What evidence is required before deployment? Which permissions may an agent receive? Who can accept residual risk? What happens when a model changes behavior after an upgrade?",{},{"id":261,"data":1781,"type":218,"tunes":1783},{"text":1782},"The purpose is not to prevent change. Good governance makes change legible: decisions have owners, evidence, conditions, exceptions, review dates and rollback or escalation paths.",{},{"id":266,"data":1785,"type":218,"tunes":1787},{"text":1786},"This is why NIST places GOVERN across the entire AI risk-management lifecycle rather than treating governance as one final approval step. Governance establishes the culture, policies, accountability and organizational structures that make mapping, measuring and managing AI risk possible.",{},{"id":271,"data":1789,"type":42,"tunes":1791},{"text":1790,"level":247},"The simplest example",{},{"id":276,"data":1793,"type":218,"tunes":1795},{"text":1794},"A product team wants to add an external generative-AI provider to summarize internal customer-support tickets. Technically, the integration may require only an API call.",{},{"id":281,"data":1797,"type":218,"tunes":1799},{"text":1798},"Governance asks a different set of questions: Are the ticket contents permitted to leave the organization's environment? Which provider and model version are approved? Is retention disabled? Which users may invoke the feature? How is output evaluated? Is human review required? What gets logged? Who owns incidents? What happens if the provider changes its terms or model behavior?",{},{"id":286,"data":1801,"type":218,"tunes":1803},{"text":1802},"The governance result may still be “deploy it.” The difference is that deployment is now a traceable decision with explicit conditions instead of an unrecorded engineering choice.",{},{"id":291,"data":1805,"type":320,"tunes":1832},{"steps":1806,"title":1831,"orientation":319},[1807,1810,1813,1816,1819,1822,1825,1828],{"label":1808,"description":1809},"1. Register the use case","Record purpose, owner, users, data, model\u002Fprovider and intended outcome.",{"label":1811,"description":1812},"2. Classify risk and obligations","Determine business consequence, data sensitivity, autonomy, regulatory exposure and misuse potential.",{"label":1814,"description":1815},"3. Define required controls","Specify permissions, data handling, evaluations, human oversight, security, logging and provider constraints.",{"label":1817,"description":1818},"4. Collect evidence","Run tests, security\u002Fprivacy review, architecture review and relevant legal\u002Fcompliance checks.",{"label":1820,"description":1821},"5. Make a decision","Approve, approve with conditions, request changes, hold or reject.",{"label":1823,"description":1824},"6. Deploy under controlled configuration","Pin the approved model\u002Fprovider\u002Fruntime and enforce required boundaries.",{"label":1826,"description":1827},"7. Monitor and re-evaluate","Track incidents, quality, drift, provider changes, new risks and changed regulations.",{"label":1829,"description":1830},"8. Change, suspend or retire","Use evidence and ownership rules to decide the next lifecycle state.","A basic governed AI decision",{},{"id":323,"data":1834,"type":42,"tunes":1836},{"text":1835,"level":247},"Where the simple example stops",{},{"id":328,"data":1838,"type":218,"tunes":1840},{"text":1839},"Large organizations rarely govern one AI system in isolation. The same model may support dozens of products; one provider may process several data classes; an agent platform may expose shared tools to many teams.",{},{"id":333,"data":1842,"type":218,"tunes":1844},{"text":1843},"Governance therefore needs portfolio-level structures as well as system-level controls: AI inventory, approved providers, model catalogs, shared evaluation baselines, security patterns, risk thresholds, exception registers and ownership mappings.",{},{"id":338,"data":1846,"type":218,"tunes":1848},{"text":1847},"Governance also cannot be identical for every AI use. A public-content summarizer, an internal coding assistant, a hiring-support system and an agent that can initiate payments have materially different consequence and control profiles.",{},{"id":343,"data":1850,"type":42,"tunes":1852},{"text":1851,"level":247},"What AI governance is — and what it is not",{},{"id":348,"data":1854,"type":385,"tunes":1879},{"rows":1855,"title":1873,"layout":377,"columns":1874},[1856,1859,1862,1865,1868,1870],{"id":352,"label":1857,"values":1858},"Enterprise \u002F solution architecture",[355,355],{"id":357,"label":1860,"values":1861},"AI risk management",[355,355],{"id":361,"label":1863,"values":1864},"Compliance",[355,355],{"id":365,"label":1866,"values":1867},"Security",[355,355],{"id":369,"label":370,"values":1869},[355,355],{"id":373,"label":1871,"values":1872},"AI ethics principles",[355,355],"AI governance compared with adjacent disciplines",[1875,1877],{"id":380,"label":1876},"AI governance",{"id":383,"label":1878},"Adjacent discipline",{},{"id":388,"data":1881,"type":42,"tunes":1883},{"text":1882,"level":247},"Governance is broader than compliance",{},{"id":393,"data":1885,"type":218,"tunes":1887},{"text":1886},"Compliance is one input to governance, not the entire governance system. An AI use case can be legally permitted yet still violate company risk appetite, security policy, contractual obligations or product-quality requirements.",{},{"id":398,"data":1889,"type":218,"tunes":1891},{"text":1890},"The reverse also matters: internal approval does not override law. Governance should make applicable legal obligations visible inside the same decision path used for architecture, security and business risk.",{},{"id":403,"data":1893,"type":218,"tunes":1895},{"text":1894},"ISO\u002FIEC 42001 explicitly frames an AI management system as a structured way to establish policies, objectives and processes for responsible AI. ISO also states that the standard does not replace laws or regulations; it provides a management framework that can support compliance.",{},{"id":408,"data":1897,"type":42,"tunes":1899},{"text":1898,"level":247},"NIST AI RMF and ISO\u002FIEC 42001 solve different governance needs",{},{"id":413,"data":1901,"type":377,"tunes":1922},{"content":1902,"stretched":43,"withHeadings":14},[1903,1907,1910,1913,1916,1919],[1904,1905,1906],"Framework \u002F standard","Primary role","Useful governance value",[421,1908,1909],"Voluntary AI risk-management framework","Organizes outcomes around GOVERN, MAP, MEASURE and MANAGE across the lifecycle",[425,1911,1912],"Generative-AI profile for AI RMF","Adds GenAI-specific risk considerations and actions",[429,1914,1915],"AI management-system requirements","Creates an organization-wide management system with policy, roles, processes and continual improvement",[433,1917,1918],"AI risk-management guidance","Guides integration of AI-specific risk management into organizational activities",[437,1920,1921],"Binding regulation in the EU","Creates legal obligations according to actor, AI category and use case",{},{"id":442,"data":1924,"type":218,"tunes":1926},{"text":1925},"These sources should not be collapsed into one checklist. NIST AI RMF is risk-management guidance. ISO\u002FIEC 42001 is a management-system standard. The EU AI Act is law. An organization can use them together, but their authority, scope and implementation purpose are different.",{},{"id":447,"data":1928,"type":42,"tunes":1930},{"text":1929,"level":247},"Current EU AI Act timing matters",{},{"id":452,"data":1932,"type":218,"tunes":1934},{"text":1933},"As of 8 October 2026, the European Commission states that the AI Act became generally applicable on 2 August 2026. Prohibited-practice and AI-literacy provisions applied from 2 February 2025, while governance rules and obligations for general-purpose AI models applied from 2 August 2025.",{},{"id":457,"data":1936,"type":218,"tunes":1938},{"text":1937},"The Commission's current guidance also reflects later application dates for certain high-risk requirements. Exact dates and transition rules are a moving compliance input and should be verified against current Commission material before a deployment decision.",{},{"id":462,"data":1940,"type":226,"tunes":1943},{"body":1941,"title":1942,"variant":233},"The regulatory examples here explain why governance needs versioned legal\u002Fcompliance inputs. They do not determine whether a specific product is legally classified as prohibited, high-risk, GPAI, deployer, provider or another regulated actor.","Architecture article, not legal advice",{},{"id":468,"data":1945,"type":42,"tunes":1947},{"text":1946,"level":247},"AI governance starts with an inventory",{},{"id":473,"data":1949,"type":218,"tunes":1951},{"text":1950},"An organization cannot govern AI systems it cannot identify. The inventory should cover more than custom-trained models. It may include external model APIs, embedded copilots, local models, AI-enabled SaaS features, agent runtimes, retrieval systems and automated decision components.",{},{"id":478,"data":1953,"type":218,"tunes":1955},{"text":1954},"A useful inventory connects the AI capability to its business owner, technical owner, use case, users, data classes, model\u002Fprovider, deployment environment, permissions, risk classification, evaluation status, applicable obligations and lifecycle state.",{},{"id":483,"data":1957,"type":218,"tunes":1959},{"text":1958},"The inventory is not only a spreadsheet for auditors. It is the index that lets the organization know what must be reviewed when a provider changes, a vulnerability appears, a regulation becomes applicable or a model is retired.",{},{"id":488,"data":1961,"type":377,"tunes":2005},{"content":1962,"stretched":43,"withHeadings":14},[1963,1966,1969,1972,1975,1978,1981,1984,1987,1990,1993,1996,1999,2002],[1964,1965],"Inventory field","Why governance needs it",[1967,1968],"Use case \u002F purpose","Defines why AI exists and what success means",[1970,1971],"Business owner","Owns outcome and business risk",[1973,1974],"Technical owner","Owns architecture, implementation and operation",[1976,1977],"Model + version","Identifies the behavior-producing dependency",[1979,1980],"Provider \u002F runtime","Identifies contractual, hosting and operational dependency",[1982,1983],"Data classes","Determines privacy, confidentiality and Source-of-Truth constraints",[1985,1986],"Users \u002F affected parties","Determines exposure and human-impact context",[1988,1989],"Tools \u002F actions","Determines autonomy and side-effect risk",[1991,1992],"Permissions \u002F identity","Defines who or what may invoke the capability",[1994,1995],"Risk classification","Determines required controls and approval path",[1997,1998],"Evaluation evidence","Shows whether intended behavior was tested",[2000,2001],"Lifecycle state","Draft, review, approved, restricted, suspended or retired",[2003,2004],"Review date \u002F triggers","Defines when the governance decision must be revisited",{},{"id":535,"data":2007,"type":42,"tunes":2009},{"text":2008,"level":247},"Governance requires named ownership",{},{"id":540,"data":2011,"type":218,"tunes":2013},{"text":2012},"AI failures often cross organizational boundaries. A model-quality problem may become a product failure, security issue, privacy incident or contractual breach. Governance needs named owners before the incident occurs.",{},{"id":545,"data":2015,"type":218,"tunes":2017},{"text":2016},"Ownership does not mean one person is responsible for everything. A strong model separates decision rights: business owner, product owner, technical owner, data owner, security\u002Fprivacy specialists, legal\u002Fcompliance actors and operational support.",{},{"id":550,"data":2019,"type":218,"tunes":2021},{"text":2020},"The critical property is that every required decision has an owner and every owner knows which evidence they are expected to review.",{},{"id":555,"data":2023,"type":42,"tunes":2025},{"text":2024,"level":247},"Decision rights should be explicit",{},{"id":560,"data":2027,"type":377,"tunes":2059},{"content":2028,"stretched":43,"withHeadings":14},[2029,2032,2035,2038,2041,2044,2047,2050,2053,2056],[2030,2031],"Decision","Typical accountable function",[2033,2034],"May this AI use case exist?","Business\u002Fproduct owner with governance\u002Frisk input",[2036,2037],"May this data class be processed?","Data owner + privacy\u002Fsecurity according to policy",[2039,2040],"May this provider\u002Fmodel be used?","Architecture\u002Fplatform + security\u002Fprocurement + governance",[2042,2043],"May this agent execute this action?","Application owner + authorization\u002Fbusiness-policy owner",[2045,2046],"Is quality sufficient for deployment?","Product\u002Ftechnical owner against defined acceptance criteria",[2048,2049],"Can residual risk be accepted?","Named risk owner at appropriate authority level",[2051,2052],"Can an exception be granted?","Explicit exception authority, time-bounded and documented",[2054,2055],"Should the system be suspended?","Operational\u002Fbusiness owner under incident or risk triggers",[2057,2058],"Can a model upgrade go live?","Change owner after regression\u002Fevaluation evidence",{},{"id":595,"data":2061,"type":42,"tunes":2063},{"text":2062,"level":247},"Model governance is more than choosing a model",{},{"id":600,"data":2065,"type":218,"tunes":2067},{"text":2066},"Model governance tracks which model is used, for what purpose, under which configuration and evidence. This applies to external APIs, locally hosted models, fine-tuned models and models embedded in third-party software.",{},{"id":605,"data":2069,"type":218,"tunes":2071},{"text":2070},"A model decision should consider capability, evaluation results, cost, latency, data handling, provider terms, lifecycle support, geographic\u002Fhosting constraints, security, fallback behavior and the consequences of version change.",{},{"id":610,"data":2073,"type":218,"tunes":2075},{"text":2074},"Model aliases such as “latest” can be operationally convenient but weaken reproducibility if behavior changes without a governed release process. Consequential systems benefit from explicit version tracking and regression evaluation.",{},{"id":615,"data":2077,"type":42,"tunes":2079},{"text":2078,"level":247},"Provider governance is a separate dependency layer",{},{"id":620,"data":2081,"type":218,"tunes":2083},{"text":2082},"Two systems using the same model family can have different governance risk if one runs locally and another sends data to an external provider. Provider governance covers contractual terms, processing location, retention, logging, sub-processors, availability, deprecation and exit strategy.",{},{"id":625,"data":2085,"type":218,"tunes":2087},{"text":2086},"Provider abstraction can reduce technical lock-in, but it does not remove governance work. Swapping providers can change data flows, model behavior, security assumptions, cost and compliance obligations.",{},{"id":630,"data":2089,"type":218,"tunes":2091},{"text":2090},"An approved provider list should therefore not be interpreted as “every model and every data class from this provider is automatically approved.” Approval needs scope.",{},{"id":635,"data":2093,"type":42,"tunes":2095},{"text":2094,"level":247},"Data governance remains the Source-of-Truth layer",{},{"id":640,"data":2097,"type":218,"tunes":2099},{"text":2098},"AI governance does not make the model the authority for organizational facts. Data governance still determines ownership, classification, retention, quality and permitted use of source data.",{},{"id":645,"data":2101,"type":218,"tunes":2103},{"text":2102},"For RAG and agents, governance should identify which sources are authoritative, which are advisory, how provenance is preserved, which data may enter model context and which tenant\u002Fuser boundaries must be enforced.",{},{"id":650,"data":2105,"type":218,"tunes":2107},{"text":2106},"Generated outputs create new data-governance questions as well: whether prompts and responses are retained, who may access traces, whether generated summaries become records and how derived embeddings or indexes are deleted when source data is removed.",{},{"id":655,"data":2109,"type":42,"tunes":2111},{"text":2110,"level":247},"Permissions are governance decisions with runtime enforcement",{},{"id":660,"data":2113,"type":218,"tunes":2115},{"text":2114},"Agentic AI makes permissions a first-class governance object. The organization needs to decide which tools, files, APIs, databases and side effects each agent or user may access.",{},{"id":665,"data":2117,"type":218,"tunes":2119},{"text":2118},"Governance defines the policy and approval logic; the trusted runtime enforces it. Natural-language instructions such as “do not delete files” are not a substitute for filesystem, API or service authorization.",{},{"id":670,"data":2121,"type":218,"tunes":2123},{"text":2122},"The same principle applies to tenant isolation: a role can authorize an operation while tenant scope constrains which customer's resources that operation may reach.",{},{"id":675,"data":2125,"type":42,"tunes":2127},{"text":2126,"level":247},"Risk classification should change the control set",{},{"id":680,"data":2129,"type":218,"tunes":2131},{"text":2130},"Not every AI system needs the same review depth. Governance becomes scalable when risk classification changes the evidence, approval and monitoring requirements.",{},{"id":685,"data":2133,"type":377,"tunes":2171},{"content":2134,"stretched":43,"withHeadings":14},[2135,2139,2143,2147,2151,2155,2159,2163,2167],[2136,2137,2138],"Risk driver","Lower-control example","Higher-control example",[2140,2141,2142],"Business consequence","Draft internal text","Approve financial settlement",[2144,2145,2146],"Human impact","Optional writing aid","Employment or eligibility decision support",[2148,2149,2150],"Data sensitivity","Public documentation","Health, HR, financial or confidential data",[2152,2153,2154],"Autonomy","Read-only recommendation","Agent with write\u002Fpayment\u002Fdeployment tools",[2156,2157,2158],"Reversibility","Easily regenerated summary","Irreversible external transaction",[2160,2161,2162],"Exposure","Small internal pilot","Public\u002Fcustomer-facing system at scale",[2164,2165,2166],"Source authority","Advisory content","System relied on for regulated or contractual fact",[2168,2169,2170],"Failure detectability","Obvious formatting defect","Plausible but materially wrong recommendation",{},{"id":726,"data":2173,"type":218,"tunes":2175},{"text":2174},"The classification method can be simple or sophisticated, but it should map to concrete consequences: more testing, narrower permissions, required human oversight, security review, executive risk acceptance or deployment prohibition.",{},{"id":731,"data":2177,"type":42,"tunes":2179},{"text":2178,"level":247},"Governance must preserve use-case context",{},{"id":736,"data":2181,"type":218,"tunes":2183},{"text":2182},"NIST's MAP function emphasizes intended purpose, users, deployment context, assumptions, impacts and applicable laws or norms. This matters because the same model can be low risk in one use case and high consequence in another.",{},{"id":741,"data":2185,"type":218,"tunes":2187},{"text":2186},"Governance records should therefore classify the application, not only the model. “We use model X” is not enough to determine risk.",{},{"id":746,"data":2189,"type":218,"tunes":2191},{"text":2190},"The relevant governance object is the system\u002Fuse case: model + data + context + tools + users + deployment environment + business process.",{},{"id":751,"data":2193,"type":42,"tunes":2195},{"text":2194,"level":247},"Evaluation is governance evidence",{},{"id":756,"data":2197,"type":218,"tunes":2199},{"text":2198},"An AI governance process should not approve deployment based only on vendor benchmarks or a successful demo. The system needs evidence tied to its actual intended use.",{},{"id":761,"data":2201,"type":218,"tunes":2203},{"text":2202},"Useful evidence can include task-success evaluation, retrieval quality, factual grounding, security tests, permission tests, adversarial scenarios, human-review studies, latency\u002Fcost, robustness and regression comparisons.",{},{"id":766,"data":2205,"type":218,"tunes":2207},{"text":2206},"NIST's MEASURE function makes this explicit: organizations should identify and apply appropriate methods and metrics for risks identified during mapping, while documenting risks that cannot or will not be measured.",{},{"id":771,"data":2209,"type":226,"tunes":2212},{"body":2210,"title":2211,"variant":775},"“The team thinks the model is good enough” is a weak approval artifact. “The system met defined acceptance criteria on representative tests, with these known limitations and residual risks” is governable.","A governance gate should ask for evidence, not confidence",{},{"id":778,"data":2214,"type":42,"tunes":2216},{"text":2215,"level":247},"Governance gates should exist across the lifecycle",{},{"id":783,"data":2218,"type":320,"tunes":2245},{"steps":2219,"title":2244,"orientation":319},[2220,2223,2226,2229,2232,2235,2238,2241],{"label":2221,"description":2222},"Idea \u002F discovery gate","Confirm business purpose, owner and whether AI is an appropriate solution.",{"label":2224,"description":2225},"Architecture gate","Review model\u002Fprovider, data flow, identity, permissions, isolation and operational design.",{"label":2227,"description":2228},"Risk\u002Fcompliance gate","Classify risk and applicable obligations; define required controls.",{"label":2230,"description":2231},"Validation gate","Require evidence that functional, safety, security and quality criteria are met.",{"label":2233,"description":2234},"Deployment gate","Approve concrete configuration, version, environment and operational owner.",{"label":2236,"description":2237},"Change gate","Re-evaluate model\u002Fprovider\u002Ftool\u002Fdata changes according to materiality.",{"label":2239,"description":2240},"Incident gate","Pause, restrict or roll back when defined risk triggers occur.",{"label":2242,"description":2243},"Retirement gate","Remove access, data derivatives, credentials and obsolete dependencies cleanly.","Example lifecycle gates",{},{"id":813,"data":2247,"type":42,"tunes":2249},{"text":2248,"level":247},"Change management is central to AI governance",{},{"id":818,"data":2251,"type":218,"tunes":2253},{"text":2252},"AI systems change even when application code does not. Providers update models, safety filters, context limits, pricing, policies and infrastructure. Retrieval corpora change. Agent tools gain permissions. Regulations and contracts evolve.",{},{"id":823,"data":2255,"type":218,"tunes":2257},{"text":2256},"Governance should therefore define material-change triggers. A minor prompt wording adjustment may need ordinary regression tests; replacing the model, enabling write tools or introducing sensitive data may require a new approval gate.",{},{"id":828,"data":2259,"type":218,"tunes":2261},{"text":2260},"The governance record should preserve which version was approved and what conditions made the approval valid.",{},{"id":833,"data":2263,"type":42,"tunes":2265},{"text":2264,"level":247},"Exceptions need owners, expiry and compensating controls",{},{"id":838,"data":2267,"type":218,"tunes":2269},{"text":2268},"Real organizations need exceptions. A team may need an unapproved model for a time-bounded experiment, or a legacy system may not yet meet a new logging requirement.",{},{"id":843,"data":2271,"type":218,"tunes":2273},{"text":2272},"The dangerous pattern is a permanent undocumented exception. Governable exceptions specify owner, rationale, scope, residual risk, compensating control, expiration date and review condition.",{},{"id":848,"data":2275,"type":218,"tunes":2277},{"text":2276},"Exception handling should be part of the normal governance system rather than an informal side channel.",{},{"id":853,"data":2279,"type":42,"tunes":2281},{"text":2280,"level":247},"Auditability is the ability to reconstruct the decision and execution",{},{"id":858,"data":2283,"type":218,"tunes":2285},{"text":2284},"AI auditability is not merely storing model prompts. It means being able to reconstruct which system version was used, which data and permissions applied, who approved the configuration, what evaluations supported deployment and what happened during relevant execution.",{},{"id":863,"data":2287,"type":218,"tunes":2289},{"text":2288},"For an agent, this may require principal identity, tool calls, approvals, target resources, state changes and outcomes. For RAG, it may require corpus\u002Findex version, retrieval query, selected evidence and provenance. For a model change, it may require the previous and new evaluation results.",{},{"id":868,"data":2291,"type":218,"tunes":2293},{"text":2292},"Audit evidence should be proportionate. Logging every possible token can create privacy and security risk of its own. Governance should define which evidence is necessary, how long it is retained and who may access it.",{},{"id":873,"data":2295,"type":377,"tunes":2320},{"content":2296,"stretched":43,"withHeadings":14},[2297,2300,2303,2306,2309,2312,2315,2317],[2298,2299],"Audit object","Useful evidence",[2301,2302],"Governance decision","Owner, date, decision, conditions, evidence, exceptions",[2304,2305],"Model release","Model\u002Fprovider\u002Fversion, configuration, regression results",[2307,2308],"Data access","Principal, tenant\u002Fscope, source class, policy decision",[2310,2311],"Agent action","Tool, arguments\u002Ftarget, approval, result, state change",[2313,2314],"RAG answer","Corpus\u002Findex version, retrieval set, selected evidence, citations",[895,2316],"Trigger, affected systems, containment, decision owner, remediation",[2318,2319],"Retirement","Disabled endpoints, revoked credentials, deleted derived data, archive decision",{},{"id":902,"data":2322,"type":42,"tunes":2324},{"text":2323,"level":247},"Monitoring closes the governance loop",{},{"id":907,"data":2326,"type":218,"tunes":2328},{"text":2327},"Approval is a snapshot. Production monitoring tells governance whether the assumptions behind approval still hold.",{},{"id":912,"data":2330,"type":218,"tunes":2332},{"text":2331},"Useful signals depend on the use case: quality regression, unsafe outputs, tool failures, policy denials, unusual cost, latency, user complaints, drift, retrieval freshness, provider incidents, security alerts or new regulatory classifications.",{},{"id":917,"data":2334,"type":218,"tunes":2336},{"text":2335},"Governance should define thresholds that cause action: investigate, restrict, require human review, roll back, switch provider, suspend or retire.",{},{"id":922,"data":2338,"type":42,"tunes":2340},{"text":2339,"level":247},"AI incidents need a defined operational path",{},{"id":927,"data":2342,"type":218,"tunes":2344},{"text":2343},"AI-specific incidents may involve harmful content, data leakage, unauthorized actions, persistent factual failure, model\u002Fprovider outage, prompt injection, cross-tenant retrieval or unexpected behavior after a model update.",{},{"id":932,"data":2346,"type":218,"tunes":2348},{"text":2347},"The incident process should connect technical response with governance ownership. Someone must be authorized to disable a model, remove a tool, revoke credentials, restrict users, notify affected functions and decide whether the system may return to service.",{},{"id":937,"data":2350,"type":218,"tunes":2352},{"text":2351},"The lessons from incidents should update policies, tests, risk classification and reusable platform controls rather than remain isolated in one team.",{},{"id":942,"data":2354,"type":42,"tunes":2356},{"text":2355,"level":247},"Procurement is part of AI governance",{},{"id":947,"data":2358,"type":218,"tunes":2360},{"text":2359},"Organizations can acquire substantial AI capability through ordinary SaaS procurement. Governance should therefore cover purchased AI features as well as internally engineered systems.",{},{"id":952,"data":2362,"type":218,"tunes":2364},{"text":2363},"Vendor review can include data use, retention, model training policy, sub-processors, security, incident notification, export\u002Fdeletion, geographic processing, version change, service continuity and contractual exit.",{},{"id":957,"data":2366,"type":218,"tunes":2368},{"text":2367},"A technical architecture review and procurement review should share the same system inventory so commercial approval does not drift away from the actual deployed data flow.",{},{"id":962,"data":2370,"type":42,"tunes":2372},{"text":2371,"level":247},"Human oversight should be designed, not merely declared",{},{"id":967,"data":2374,"type":218,"tunes":2376},{"text":2375},"“Human in the loop” is meaningful only if the human has authority, time, information and a usable intervention mechanism.",{},{"id":972,"data":2378,"type":218,"tunes":2380},{"text":2379},"A reviewer who sees only the AI recommendation but not its evidence, uncertainty or source state may simply rubber-stamp the output. Governance should specify what the reviewer can inspect and what actions are available: approve, reject, edit, escalate or stop.",{},{"id":977,"data":2382,"type":218,"tunes":2384},{"text":2383},"Human oversight should also be risk-based. Low-consequence systems may use sampling or post-hoc review, while high-consequence side effects may require approval before execution.",{},{"id":982,"data":2386,"type":42,"tunes":2388},{"text":2387,"level":247},"Platform governance and use-case governance are different",{},{"id":987,"data":2390,"type":385,"tunes":2410},{"rows":2391,"title":2404,"layout":377,"columns":2405},[2392,2395,2398,2401],{"id":991,"label":2393,"values":2394},"Primary concern",[355,355],{"id":995,"label":2396,"values":2397},"Typical approval",[355,355],{"id":999,"label":2399,"values":2400},"Evidence",[355,355],{"id":1003,"label":2402,"values":2403},"Governance failure",[355,355],"Two governance levels",[2406,2408],{"id":1009,"label":2407},"Shared AI platform",{"id":1012,"label":2409},"Individual AI use case",{},{"id":1016,"data":2412,"type":218,"tunes":2414},{"text":2413},"Platform approval should therefore reduce repeated work, not eliminate use-case accountability. “The model is approved” is different from “this application of the model is approved.”",{},{"id":1021,"data":2416,"type":42,"tunes":2418},{"text":2417,"level":247},"AI governance and Enterprise AI Architecture",{},{"id":1026,"data":2420,"type":218,"tunes":2422},{"text":2421},"Enterprise AI Architecture describes how AI systems, platforms, data, identities, providers, operations and organizational systems fit together. AI governance describes the decision and control system that determines how those architectures may be created and changed.",{},{"id":1031,"data":2424,"type":218,"tunes":2426},{"text":2425},"The two are tightly coupled. Governance without architecture can become abstract policy. Architecture without governance can produce technically elegant systems with unclear ownership, uncontrolled provider adoption or unreviewed risk.",{},{"id":1036,"data":2428,"type":218,"tunes":2430},{"text":2429},"The strongest design is bidirectional: governance requirements become architecture controls, while architecture exposes the real decisions that governance must own.",{},{"id":1041,"data":2432,"type":42,"tunes":2434},{"text":2433,"level":247},"Original project evidence",{},{"id":1046,"data":2436,"type":42,"tunes":2438},{"text":2437,"level":246},"Enterprise Aaasaasa 0.1: governance as delivery structure",{},{"id":1051,"data":2440,"type":226,"tunes":2443},{"body":2441,"title":2442,"variant":240},"Enterprise Aaasaasa 0.1 is project and training\u002FPoC evidence, not evidence of commercial enterprise adoption. It is useful here because its delivery structure explicitly connects architecture, milestones, risks, stakeholders, validation and project decisions.","Project \u002F PoC evidence",{},{"id":1057,"data":2445,"type":218,"tunes":2447},{"text":2446},"Enterprise Aaasaasa 0.1 uses defined milestones for requirements, architecture, prototype, validation and project closure. That structure illustrates a core governance principle: lifecycle transitions should have explicit outputs and decision points instead of an informal “build first, review later” process.",{},{"id":1062,"data":2449,"type":218,"tunes":2451},{"text":2450},"The project also tracks risks such as scope creep, architecture delay and AI\u002FGDPR concerns and identifies stakeholder groups including sponsorship, steering, architecture, security, marketing, external APIs and hosting.",{},{"id":1067,"data":2453,"type":218,"tunes":2455},{"text":2454},"This does not constitute an ISO\u002FIEC 42001 management system. It is narrower project evidence showing how ownership, risk, milestones and validation can be integrated into technical delivery.",{},{"id":1072,"data":2457,"type":42,"tunes":2459},{"text":2458,"level":246},"SenseFlow: requirements and decision traceability",{},{"id":1077,"data":2461,"type":218,"tunes":2463},{"text":2462},"SenseFlow uses a structured path from product goal and user need through epics, user stories, acceptance criteria, architecture, implementation and validation. Decision records preserve the decision, rationale, alternatives, trade-offs, status and date\u002Fversion.",{},{"id":1082,"data":2465,"type":218,"tunes":2467},{"text":2466},"That traceability pattern is directly relevant to governance because an AI control should connect to the requirement or risk that justified it. A governance system becomes stronger when the chain from business need to architecture decision to validation evidence can be reconstructed.",{},{"id":1087,"data":2469,"type":42,"tunes":2471},{"text":2470,"level":246},"Aaasaasa AI Client: permissions and runtime as governed configuration",{},{"id":1092,"data":2473,"type":218,"tunes":2475},{"text":2474},"Aaasaasa AI Client separates provider, model, runtime location and permissions rather than treating them as one “AI setting.” Central workspace permission profiles govern tool access, Direct Chat has no filesystem\u002Fshell tools, and agent-capable runtimes operate under explicit permission profiles.",{},{"id":1097,"data":2477,"type":218,"tunes":2479},{"text":2478},"That separation demonstrates an important governance pattern: model choice and action authority should be independent configuration objects. A stronger model does not automatically receive broader filesystem, shell or business permissions.",{},{"id":1102,"data":2481,"type":218,"tunes":2483},{"text":2482},"The implementation evidence is architectural, not a claim that the application constitutes a certified organizational AI governance system.",{},{"id":1107,"data":2485,"type":377,"tunes":2511},{"content":2486,"stretched":43,"withHeadings":14},[2487,2490,2493,2496,2499,2502,2505,2508],[2488,2489],"Observed project pattern","Governance lesson",[2491,2492],"Milestone gates","Lifecycle transitions can require explicit evidence",[2494,2495],"Risk register","Known uncertainties become managed objects rather than informal concerns",[2497,2498],"Stakeholder mapping","Decision responsibility can be distributed deliberately",[2500,2501],"Acceptance criteria + validation","Deployment decisions can depend on evidence",[2503,2504],"Decision records","Architecture trade-offs remain traceable",[2506,2507],"Separate model\u002Fprovider\u002Fruntime\u002Fpermissions","Capability and authority can be governed independently",[2509,2510],"Explicit project maturity labels","PoC evidence is not misrepresented as production or market proof",{},{"id":1136,"data":2513,"type":42,"tunes":2515},{"text":2514,"level":247},"Common AI governance failure modes",{},{"id":1141,"data":2517,"type":377,"tunes":2561},{"content":2518,"stretched":43,"withHeadings":14},[2519,2522,2525,2528,2531,2534,2537,2540,2543,2546,2549,2552,2555,2558],[2520,2521],"Failure mode","What goes wrong",[2523,2524],"Governance is only a policy PDF","Teams cannot translate policy into runtime controls or deployment decisions",[2526,2527],"No AI inventory","The organization cannot identify where models, agents or embedded AI are used",[2529,2530],"Model approval is treated as use-case approval","An approved model is used for a materially different risk context",[2532,2533],"No named business owner","Technical teams inherit business-risk decisions by default",[2535,2536],"Risk classification has no control consequence","Every system receives the same review regardless of consequence",[2538,2539],"Permissions live only in prompts","Model instructions become a substitute for real authorization",[2541,2542],"Provider change is invisible","Behavior\u002Fdata\u002Fcompliance assumptions change without re-evaluation",[2544,2545],"Demo success is approval evidence","Production risk is inferred from a small happy-path test",[2547,2548],"Human oversight is ceremonial","Reviewer cannot inspect evidence or stop the action",[2550,2551],"Exception has no expiry","Temporary workaround becomes permanent governance debt",[2553,2554],"Logs exist but cannot reconstruct decisions","Auditability is confused with raw data retention",[2556,2557],"Compliance owns governance alone","Product, engineering, security and operations disengage from accountability",[2559,2560],"Every decision goes to a central board","Governance becomes a bottleneck instead of a scalable control system",{},{"id":1188,"data":2563,"type":42,"tunes":2565},{"text":2564,"level":247},"Central governance does not mean centralizing every decision",{},{"id":1193,"data":2567,"type":218,"tunes":2569},{"text":2568},"A mature organization can centralize policy, control patterns and escalation while delegating low-risk decisions to product or platform teams.",{},{"id":1198,"data":2571,"type":218,"tunes":2573},{"text":2572},"This federated model scales better than requiring a central committee to approve every prompt change. The central function defines risk tiers, mandatory controls, provider policy, exception authority and audit requirements; teams operate autonomously inside those boundaries.",{},{"id":1203,"data":2575,"type":218,"tunes":2577},{"text":2576},"The design objective is consistent accountability, not maximum centralization.",{},{"id":1208,"data":2579,"type":42,"tunes":2581},{"text":2580,"level":247},"Govern the governance system itself",{},{"id":1213,"data":2583,"type":218,"tunes":2585},{"text":2584},"Governance needs feedback. Otherwise controls can become expensive rituals that do not reduce risk.",{},{"id":1218,"data":2587,"type":377,"tunes":2619},{"content":2588,"stretched":43,"withHeadings":14},[2589,2592,2595,2598,2601,2604,2607,2610,2613,2616],[2590,2591],"Metric \u002F signal","What it can reveal",[2593,2594],"Inventory coverage","Whether AI adoption is visible to governance",[2596,2597],"Time to decision","Whether governance blocks delivery unnecessarily",[2599,2600],"Exception count and age","Whether policies are realistic or routinely bypassed",[2602,2603],"Evaluation failure rate","Whether pre-deployment controls catch defects",[2605,2606],"Post-deployment incident rate","Whether approval evidence predicts production behavior",[2608,2609],"Unauthorized-tool denial rate","Whether permission boundaries are actively exercised",[2611,2612],"Model\u002Fprovider change frequency","How often approved assumptions may become stale",[2614,2615],"Retired-but-active systems","Lifecycle cleanup\u002Fcontrol failure",[2617,2618],"Repeated incident patterns","Whether lessons are becoming reusable platform controls",{},{"id":1253,"data":2621,"type":218,"tunes":2623},{"text":2622},"Governance metrics should not reward paperwork volume. The useful measure is whether decision quality, traceability, risk detection and safe delivery improve.",{},{"id":1258,"data":2625,"type":42,"tunes":2627},{"text":2626,"level":247},"A practical AI governance implementation sequence",{},{"id":1263,"data":2629,"type":320,"tunes":2668},{"steps":2630,"title":2667,"orientation":319},[2631,2634,2637,2640,2643,2646,2649,2652,2655,2658,2661,2664],{"label":2632,"description":2633},"1. Define governance scope","Decide which internally built, purchased, embedded and experimental AI systems are covered.",{"label":2635,"description":2636},"2. Create the AI inventory","Capture owners, use cases, models\u002Fproviders, data, tools, users, lifecycle state and risk class.",{"label":2638,"description":2639},"3. Define decision rights","Name who can approve providers, data use, risk acceptance, exceptions, deployment and retirement.",{"label":2641,"description":2642},"4. Establish risk tiers","Map consequence and exposure to different control requirements.",{"label":2644,"description":2645},"5. Define reusable minimum controls","Set baseline requirements for identity, permissions, data, security, evaluation, logging and human oversight.",{"label":2647,"description":2648},"6. Connect governance to architecture","Turn policy into platform\u002Fruntime controls that teams cannot accidentally bypass.",{"label":2650,"description":2651},"7. Build evidence-based gates","Require relevant evaluation, security, privacy, architecture and compliance evidence before lifecycle transitions.",{"label":2653,"description":2654},"8. Govern model\u002Fprovider change","Track versions, deprecations and material changes with regression evidence.",{"label":2656,"description":2657},"9. Add monitoring and incident triggers","Define which production signals force investigation, restriction or suspension.",{"label":2659,"description":2660},"10. Formalize exceptions","Require scope, owner, residual risk, compensating controls and expiry.",{"label":2662,"description":2663},"11. Audit decisions and execution","Retain proportionate evidence that links owners, configuration, permissions, evaluations and significant actions.",{"label":2665,"description":2666},"12. Improve the governance system","Use incidents, delays and repeated exceptions to revise controls and platform patterns.","Build governance from visibility to control",{},{"id":1305,"data":2670,"type":42,"tunes":2672},{"text":2671,"level":247},"AI governance checklist",{},{"id":1310,"data":2674,"type":377,"tunes":2724},{"content":2675,"stretched":43,"withHeadings":14},[2676,2679,2682,2685,2688,2691,2694,2697,2700,2703,2706,2709,2712,2715,2718,2721],[2677,2678],"Question","Expected governance evidence",[2680,2681],"Why does this AI system exist?","Purpose, business owner and intended outcome",[2683,2684],"Who owns technical operation?","Named technical\u002Fplatform owner",[2686,2687],"Which model\u002Fprovider\u002Fversion is used?","Registered and versioned dependency",[2689,2690],"Which data may enter the system?","Classification, authority and permitted-use decision",[2692,2693],"Which identities may use it?","Authentication and authorization model",[2695,2696],"Which actions may it perform?","Tool\u002Fpermission matrix and autonomy boundary",[2698,2699],"What is the risk tier?","Documented classification with rationale",[2701,2702],"Which controls are mandatory?","Risk-tier control baseline",[2704,2705],"How was it evaluated?","Representative tests and acceptance criteria",[2707,2708],"Who accepted residual risk?","Named accountable authority",[2710,2711],"What requires human review?","Explicit oversight\u002Fapproval rules",[2713,2714],"What gets logged?","Audit\u002Fobservability policy proportional to consequence",[2716,2717],"What triggers re-review?","Model\u002Fprovider\u002Fdata\u002Ftool\u002Fregulatory\u002Fmaterial-change events",[2719,2720],"How can it be suspended?","Operational kill\u002Frestriction path and owner",[2722,2723],"How is it retired?","Credential, data, derivative, endpoint and record cleanup",{},{"id":1363,"data":2726,"type":42,"tunes":2728},{"text":2727,"level":247},"Common misconceptions",{},{"id":1368,"data":2730,"type":377,"tunes":2765},{"content":2731,"stretched":43,"withHeadings":14},[2732,2735,2738,2741,2744,2747,2750,2753,2756,2759,2762],[2733,2734],"Misconception","Correction",[2736,2737],"“AI governance is compliance.”","Compliance is one governance input; governance also covers ownership, architecture, permissions, quality, risk and lifecycle decisions.",[2739,2740],"“Governance means a review committee.”","Committees can approve exceptions or high-risk systems, but many controls should be embedded in normal delivery and platform architecture.",[2742,2743],"“An approved model is safe for every use.”","Risk belongs to the use case and system context, not only the model.",[2745,2746],"“A vendor handles governance for us.”","A provider controls part of the stack; the organization still owns its use case, data, permissions and business consequences.",[2748,2749],"“Human-in-the-loop automatically solves risk.”","Oversight only works when reviewers have authority, context and intervention capability.",[2751,2752],"“Logging everything gives auditability.”","Auditability requires reconstructable relevant evidence with controlled retention and access.",[2754,2755],"“Governance blocks innovation.”","Poor governance can block delivery; well-designed governance creates reusable safe paths and clearer decision ownership.",[2757,2758],"“Low-risk pilots need no governance.”","They can use lightweight governance, but inventory, ownership and data\u002Ftool boundaries still matter.",[2760,2761],"“Local AI needs less governance.”","Local hosting can change privacy\u002Fprovider risk, but model quality, permissions, security and lifecycle governance remain.",[2763,2764],"“Once approved, the system stays approved.”","Model, provider, data, regulation and use can change; governance decisions need review triggers.",{},{"id":1406,"data":2767,"type":42,"tunes":2769},{"text":2768,"level":247},"Edge cases and limitations",{},{"id":1411,"data":2771,"type":218,"tunes":2773},{"text":2772},"Very small organizations may not need a dedicated AI governance function. The same principles can be implemented through lightweight architecture decisions, risk registers, owner mappings and release gates.",{},{"id":1416,"data":2775,"type":218,"tunes":2777},{"text":2776},"Highly regulated organizations may need much more formal governance, independent assurance, documented conformity processes and legal interpretation than this architecture-level article describes.",{},{"id":1421,"data":2779,"type":218,"tunes":2781},{"text":2780},"Open-source and self-hosted models reduce some provider dependencies but create others: patching, model provenance, evaluation, infrastructure security, licensing and operational ownership.",{},{"id":1426,"data":2783,"type":218,"tunes":2785},{"text":2784},"General-purpose AI models can be used across many contexts. Governance should avoid assuming that provider-level model controls fully determine downstream application risk.",{},{"id":1431,"data":2787,"type":218,"tunes":2789},{"text":2788},"No governance framework guarantees that an AI system is safe or correct. Governance improves accountability and decision quality; technical validation, monitoring and human judgment remain necessary.",{},{"id":1436,"data":2791,"type":42,"tunes":2793},{"text":2792,"level":247},"What would change this answer?",{},{"id":1441,"data":2795,"type":218,"tunes":2797},{"text":2796},"The exact control set changes with law, industry, organization size, data sensitivity, autonomy, deployment model and business consequence.",{},{"id":1446,"data":2799,"type":218,"tunes":2801},{"text":2800},"NIST is currently revising AI RMF 1.0, so future NIST terminology or recommended practices may change. ISO standards can also be revised, and EU AI Act guidance and transition details continue to evolve.",{},{"id":1451,"data":2803,"type":218,"tunes":2805},{"text":2804},"The stable architectural principle is that AI decisions need explicit owners, evidence, permissions, risk treatment and lifecycle review rather than being hidden inside model or application configuration.",{},{"id":1456,"data":2807,"type":42,"tunes":2809},{"text":2808,"level":247},"Related canonical knowledge",{},{"id":1461,"data":2811,"type":218,"tunes":2813},{"text":2812},"AI governance depends on concepts already separated elsewhere in this knowledge graph: Source of Truth determines authority, RBAC and tenant isolation constrain access, context engineering controls model-visible information, and agentic architecture defines how tools and actions enter an execution loop.",{},{"id":1466,"data":2815,"type":218,"tunes":2817},{"text":2816},"Enterprise AI Architecture is the parent organizational architecture concept. Governance is the operating control layer that determines how those enterprise AI components may be introduced, changed and retired.",{},{"id":1471,"data":2819,"type":218,"tunes":2821},{"text":2820},"Agentic systems increase governance requirements because model decisions can become real side effects. Permission, approval and audit controls must therefore exist outside the model itself.",{},{"id":1476,"data":2823,"type":1482,"tunes":2828},{"url":2824,"title":2825,"excerpt":2826,"ctaLabel":2827},"https:\u002F\u002Fstajic.de\u002Fblog\u002Fai-agent-reliability-why-the-final-answer-is-not-enough","AI Agent Reliability: Why the Final Answer Is Not Enough","Agent governance requires evidence about execution trajectories, tool use, state changes and recoverability — not only final output quality.","Read the agent reliability article",{},{"id":1485,"data":2830,"type":1482,"tunes":2835},{"url":2831,"title":2832,"excerpt":2833,"ctaLabel":2834},"https:\u002F\u002Fstajic.de\u002Fblog\u002Fai-agent-memory-is-not-rag-how-to-separate-memory-retrieval-state-and-context","AI Agent Memory Is Not RAG: How to Separate Memory, Retrieval, State and Context","Governance needs different policies for durable memory, authoritative state, retrieved information and temporary model context.","Read the memory architecture article",{},{"id":1493,"data":2837,"type":1482,"tunes":2842},{"url":2838,"title":2839,"excerpt":2840,"ctaLabel":2841},"https:\u002F\u002Fstajic.de\u002Fblog\u002Fthe-answer-validity-boundary-the-missing-layer-between-relevance-and-reliable-ai-answers","The Answer Validity Boundary: The Missing Layer Between Relevance and Reliable AI Answers","Governance decisions should preserve the conditions under which evidence and approval remain valid, including version, scope, source and time.","Read the Answer Validity Boundary",{},{"id":1501,"data":2844,"type":42,"tunes":2846},{"text":2845,"level":247},"Frequently asked questions",{},{"id":1506,"data":2848,"type":1506,"tunes":2878},{"items":2849,"title":2877},[2850,2853,2856,2859,2862,2865,2868,2871,2874],{"id":1510,"answer":2851,"question":2852},"AI governance is the system of ownership, decision rights, controls and evidence used to manage how AI systems are developed, acquired, deployed, operated, changed and retired.","What is AI governance?",{"id":1514,"answer":2854,"question":2855},"No. Risk management identifies, assesses and treats risk. Governance defines who must do that work, which decisions require it and what evidence or authority is required.","Is AI governance the same as AI risk management?",{"id":1518,"answer":2857,"question":2858},"No. Compliance concerns applicable legal, regulatory, contractual or internal obligations. Governance integrates compliance with architecture, security, data, quality, permissions and business ownership.","Is AI governance the same as compliance?",{"id":1522,"answer":2860,"question":2861},"Enterprise AI Architecture defines how AI capabilities and systems fit into the organization. AI governance defines the decision and control system governing how those components may be introduced, operated and changed.","What is the difference between AI governance and Enterprise AI Architecture?",{"id":1526,"answer":2863,"question":2864},"Yes, but not necessarily a dedicated department. Lightweight inventory, ownership, permissions, evaluation and change controls can implement the same principles.","Do small companies need AI governance?",{"id":1530,"answer":2866,"question":2867},"At minimum: use case, owners, model\u002Fprovider\u002Fversion, data classes, users, tools\u002Factions, permissions, risk classification, evaluation status, lifecycle state and review triggers.","What should an AI inventory contain?",{"id":1534,"answer":2869,"question":2870},"No. Risk depends on the application context: data, users, tools, autonomy, consequences and business process.","Does using an approved model mean a use case is approved?",{"id":1538,"answer":2872,"question":2873},"The organization can reconstruct relevant ownership, approved configuration, model\u002Fprovider\u002Fversion, data\u002Fpermission context, evaluation evidence, significant actions and lifecycle decisions.","What makes an AI system auditable?",{"id":1542,"answer":2875,"question":2876},"Use risk-based review intervals plus event triggers such as model\u002Fprovider changes, new data, new tools, incidents, material performance change or regulatory updates.","How often should AI governance decisions be reviewed?","AI governance FAQ",{},{"id":1548,"data":2880,"type":42,"tunes":2882},{"text":2881,"level":247},"Glossary",{},{"id":1553,"data":2884,"type":1553,"tunes":2922},{"title":2885,"entries":2886},"Key AI governance terms",[2887,2889,2892,2895,2898,2901,2904,2907,2910,2913,2916,2919],{"term":1876,"anchor":1559,"definition":2888},"Organizational system of ownership, decision rights, controls and evidence governing the AI lifecycle.",{"term":2890,"anchor":1563,"definition":2891},"AI management system","Interrelated organizational policies, objectives and processes for responsible development, provision or use of AI; ISO\u002FIEC 42001 specifies requirements for such a system.",{"term":2893,"anchor":1567,"definition":2894},"AI inventory","Registry of AI systems, models, providers, use cases, owners, data, risk classifications and lifecycle state.",{"term":2896,"anchor":1571,"definition":2897},"Risk owner","Named authority accountable for deciding how a defined risk is treated or whether residual risk is accepted.",{"term":2899,"anchor":1575,"definition":2900},"Control","Technical, organizational or procedural measure intended to prevent, detect, reduce or respond to risk.",{"term":2902,"anchor":1579,"definition":2903},"Governance gate","Lifecycle decision point at which defined evidence and authority are required before proceeding.",{"term":2905,"anchor":1583,"definition":2906},"Residual risk","Risk that remains after controls or mitigation have been applied.",{"term":2908,"anchor":1587,"definition":2909},"Exception","Explicit, scoped and usually time-bounded authorization to deviate from a normal governance requirement.",{"term":2911,"anchor":1591,"definition":2912},"Auditability","Ability to reconstruct relevant decisions, configurations, evidence, identities and execution events.",{"term":2914,"anchor":1595,"definition":2915},"Model governance","Controls and decisions covering model selection, versioning, evaluation, permitted use, change and retirement.",{"term":2917,"anchor":1599,"definition":2918},"Provider governance","Controls covering external or internal AI provider dependencies, data handling, security, contracts, lifecycle and exit.",{"term":2920,"anchor":1603,"definition":2921},"Human oversight","Designed human review or intervention capability for AI decisions or actions at defined points.",{},{"id":1607,"data":2924,"type":42,"tunes":2926},{"text":2925,"level":247},"Conclusion",{},{"id":1612,"data":2928,"type":218,"tunes":2930},{"text":2929},"AI governance is the organizational control plane around AI. It gives names and evidence to decisions that otherwise remain hidden inside code, provider settings, prompts or informal team judgment.",{},{"id":1617,"data":2932,"type":218,"tunes":2934},{"text":2933},"Strong governance connects the complete system: business purpose, models, providers, data authority, identity, permissions, evaluation, risk, compliance, monitoring, incidents, change and retirement.",{},{"id":1622,"data":2936,"type":218,"tunes":2938},{"text":2937},"The practical goal is not maximum process. It is the minimum governance structure that makes important AI decisions owned, evidence-based, enforceable, reviewable and auditable throughout the lifecycle.",{},{"id":1627,"data":2940,"type":42,"tunes":2942},{"text":2941,"level":247},"Primary sources and current references",{},{"id":1632,"data":2944,"type":218,"tunes":2946},{"text":2945},"The sources below provide current external grounding for AI management, risk and regulation. Project sections are original implementation\u002Fproject evidence and are explicitly distinguished from formal standards or certified governance systems.",{},{"id":1637,"data":2948,"type":1644,"tunes":2953},{"link":1639,"meta":2949},{"image":2950,"title":2951,"description":2952},{"url":355},"NIST — AI Risk Management Framework","Current NIST hub for AI RMF 1.0, the ongoing revision, the GenAI Profile and related risk-management resources.",{},{"id":1647,"data":2955,"type":1644,"tunes":2960},{"link":1649,"meta":2956},{"image":2957,"title":2958,"description":2959},{"url":355},"NIST AIRC — AI RMF Core","Official AI RMF Core describing GOVERN, MAP, MEASURE and MANAGE, with GOVERN as a cross-cutting lifecycle function.",{},{"id":1656,"data":2962,"type":1644,"tunes":2967},{"link":1658,"meta":2963},{"image":2964,"title":2965,"description":2966},{"url":355},"NIST — AI RMF Playbook","Suggested actions for operationalizing trustworthiness and risk management across the AI lifecycle.",{},{"id":1665,"data":2969,"type":1644,"tunes":2974},{"link":1667,"meta":2970},{"image":2971,"title":2972,"description":2973},{"url":355},"NIST AI 600-1 — Generative AI Profile","NIST companion profile applying AI RMF concepts to generative-AI risks and lifecycle management.",{},{"id":1674,"data":2976,"type":1644,"tunes":2981},{"link":1676,"meta":2977},{"image":2978,"title":2979,"description":2980},{"url":355},"ISO\u002FIEC 42001:2023 — AI management systems","International standard specifying requirements for establishing, implementing, maintaining and continually improving an AI management system.",{},{"id":1683,"data":2983,"type":1644,"tunes":2988},{"link":1685,"meta":2984},{"image":2985,"title":2986,"description":2987},{"url":355},"ISO\u002FIEC 23894:2023 — AI risk management","International guidance for integrating AI-specific risk management into organizational activities and functions.",{},{"id":1692,"data":2990,"type":1644,"tunes":2995},{"link":1694,"meta":2991},{"image":2992,"title":2993,"description":2994},{"url":355},"European Commission — AI Act","Current Commission overview of the EU AI Act, application timeline and implementation framework.",{},{"id":1701,"data":2997,"type":1644,"tunes":3002},{"link":1703,"meta":2998},{"image":2999,"title":3000,"description":3001},{"url":355},"European Commission — Navigating the AI Act","Current FAQ covering governance, enforcement, implementation and the evolving application timeline.",{},{"id":1710,"data":3004,"type":1644,"tunes":3009},{"link":1712,"meta":3005},{"image":3006,"title":3007,"description":3008},{"url":355},"European Commission — General-purpose AI obligations","Current overview of documentation, copyright, training-content and systemic-risk obligations for GPAI providers.",{},"2.31.6","AI governance defines who can approve, operate, change and audit AI systems across models, providers, data, permissions, risk, evaluation and the full lifecycle.",{"lang":7,"title":208,"content":210,"contentJson":3013,"excerpt":1719},{"time":212,"blocks":3014,"version":1718},[3015,3018,3021,3024,3027,3030,3033,3036,3039,3042,3045,3048,3051,3054,3066,3069,3072,3075,3078,3081,3100,3103,3106,3109,3112,3115,3125,3128,3131,3134,3137,3140,3143,3146,3149,3152,3170,3173,3176,3179,3182,3185,3199,3202,3205,3208,3211,3214,3217,3220,3223,3226,3229,3232,3235,3238,3241,3244,3247,3250,3253,3266,3269,3272,3275,3278,3281,3284,3287,3290,3293,3296,3299,3311,3314,3317,3320,3323,3326,3329,3332,3335,3338,3341,3344,3347,3359,3362,3365,3368,3371,3374,3377,3380,3383,3386,3389,3392,3395,3398,3401,3404,3407,3410,3425,3428,3431,3434,3437,3440,3443,3446,3449,3452,3455,3458,3461,3464,3467,3470,3473,3476,3479,3491,3494,3512,3515,3518,3521,3524,3527,3530,3544,3547,3550,3566,3569,3589,3592,3607,3610,3613,3616,3619,3622,3625,3628,3631,3634,3637,3640,3643,3646,3649,3652,3655,3658,3661,3674,3677,3693,3696,3699,3702,3705,3708,3711,3716,3721,3726,3731,3736,3741,3746,3751],{"id":215,"data":3016,"type":218,"tunes":3017},{"text":217},{},{"id":221,"data":3019,"type":226,"tunes":3020},{"body":223,"title":224,"variant":225},{},{"id":229,"data":3022,"type":226,"tunes":3023},{"body":231,"title":232,"variant":233},{},{"id":236,"data":3025,"type":226,"tunes":3026},{"body":238,"title":239,"variant":240},{},{"id":243,"data":3028,"type":248,"tunes":3029},{"title":245,"maxLevel":246,"minLevel":247},{},{"id":251,"data":3031,"type":42,"tunes":3032},{"text":253,"level":247},{},{"id":256,"data":3034,"type":218,"tunes":3035},{"text":258},{},{"id":261,"data":3037,"type":218,"tunes":3038},{"text":263},{},{"id":266,"data":3040,"type":218,"tunes":3041},{"text":268},{},{"id":271,"data":3043,"type":42,"tunes":3044},{"text":273,"level":247},{},{"id":276,"data":3046,"type":218,"tunes":3047},{"text":278},{},{"id":281,"data":3049,"type":218,"tunes":3050},{"text":283},{},{"id":286,"data":3052,"type":218,"tunes":3053},{"text":288},{},{"id":291,"data":3055,"type":320,"tunes":3065},{"steps":3056,"title":318,"orientation":319},[3057,3058,3059,3060,3061,3062,3063,3064],{"label":295,"description":296},{"label":298,"description":299},{"label":301,"description":302},{"label":304,"description":305},{"label":307,"description":308},{"label":310,"description":311},{"label":313,"description":314},{"label":316,"description":317},{},{"id":323,"data":3067,"type":42,"tunes":3068},{"text":325,"level":247},{},{"id":328,"data":3070,"type":218,"tunes":3071},{"text":330},{},{"id":333,"data":3073,"type":218,"tunes":3074},{"text":335},{},{"id":338,"data":3076,"type":218,"tunes":3077},{"text":340},{},{"id":343,"data":3079,"type":42,"tunes":3080},{"text":345,"level":247},{},{"id":348,"data":3082,"type":385,"tunes":3099},{"rows":3083,"title":376,"layout":377,"columns":3096},[3084,3086,3088,3090,3092,3094],{"id":352,"label":353,"values":3085},[355,355],{"id":357,"label":358,"values":3087},[355,355],{"id":361,"label":362,"values":3089},[355,355],{"id":365,"label":366,"values":3091},[355,355],{"id":369,"label":370,"values":3093},[355,355],{"id":373,"label":374,"values":3095},[355,355],[3097,3098],{"id":380,"label":381},{"id":383,"label":384},{},{"id":388,"data":3101,"type":42,"tunes":3102},{"text":390,"level":247},{},{"id":393,"data":3104,"type":218,"tunes":3105},{"text":395},{},{"id":398,"data":3107,"type":218,"tunes":3108},{"text":400},{},{"id":403,"data":3110,"type":218,"tunes":3111},{"text":405},{},{"id":408,"data":3113,"type":42,"tunes":3114},{"text":410,"level":247},{},{"id":413,"data":3116,"type":377,"tunes":3124},{"content":3117,"stretched":43,"withHeadings":14},[3118,3119,3120,3121,3122,3123],[417,418,419],[421,422,423],[425,426,427],[429,430,431],[433,434,435],[437,438,439],{},{"id":442,"data":3126,"type":218,"tunes":3127},{"text":444},{},{"id":447,"data":3129,"type":42,"tunes":3130},{"text":449,"level":247},{},{"id":452,"data":3132,"type":218,"tunes":3133},{"text":454},{},{"id":457,"data":3135,"type":218,"tunes":3136},{"text":459},{},{"id":462,"data":3138,"type":226,"tunes":3139},{"body":464,"title":465,"variant":233},{},{"id":468,"data":3141,"type":42,"tunes":3142},{"text":470,"level":247},{},{"id":473,"data":3144,"type":218,"tunes":3145},{"text":475},{},{"id":478,"data":3147,"type":218,"tunes":3148},{"text":480},{},{"id":483,"data":3150,"type":218,"tunes":3151},{"text":485},{},{"id":488,"data":3153,"type":377,"tunes":3169},{"content":3154,"stretched":43,"withHeadings":14},[3155,3156,3157,3158,3159,3160,3161,3162,3163,3164,3165,3166,3167,3168],[492,493],[495,496],[498,499],[501,502],[504,505],[507,508],[510,511],[513,514],[516,517],[519,520],[522,523],[525,526],[528,529],[531,532],{},{"id":535,"data":3171,"type":42,"tunes":3172},{"text":537,"level":247},{},{"id":540,"data":3174,"type":218,"tunes":3175},{"text":542},{},{"id":545,"data":3177,"type":218,"tunes":3178},{"text":547},{},{"id":550,"data":3180,"type":218,"tunes":3181},{"text":552},{},{"id":555,"data":3183,"type":42,"tunes":3184},{"text":557,"level":247},{},{"id":560,"data":3186,"type":377,"tunes":3198},{"content":3187,"stretched":43,"withHeadings":14},[3188,3189,3190,3191,3192,3193,3194,3195,3196,3197],[564,565],[567,568],[570,571],[573,574],[576,577],[579,580],[582,583],[585,586],[588,589],[591,592],{},{"id":595,"data":3200,"type":42,"tunes":3201},{"text":597,"level":247},{},{"id":600,"data":3203,"type":218,"tunes":3204},{"text":602},{},{"id":605,"data":3206,"type":218,"tunes":3207},{"text":607},{},{"id":610,"data":3209,"type":218,"tunes":3210},{"text":612},{},{"id":615,"data":3212,"type":42,"tunes":3213},{"text":617,"level":247},{},{"id":620,"data":3215,"type":218,"tunes":3216},{"text":622},{},{"id":625,"data":3218,"type":218,"tunes":3219},{"text":627},{},{"id":630,"data":3221,"type":218,"tunes":3222},{"text":632},{},{"id":635,"data":3224,"type":42,"tunes":3225},{"text":637,"level":247},{},{"id":640,"data":3227,"type":218,"tunes":3228},{"text":642},{},{"id":645,"data":3230,"type":218,"tunes":3231},{"text":647},{},{"id":650,"data":3233,"type":218,"tunes":3234},{"text":652},{},{"id":655,"data":3236,"type":42,"tunes":3237},{"text":657,"level":247},{},{"id":660,"data":3239,"type":218,"tunes":3240},{"text":662},{},{"id":665,"data":3242,"type":218,"tunes":3243},{"text":667},{},{"id":670,"data":3245,"type":218,"tunes":3246},{"text":672},{},{"id":675,"data":3248,"type":42,"tunes":3249},{"text":677,"level":247},{},{"id":680,"data":3251,"type":218,"tunes":3252},{"text":682},{},{"id":685,"data":3254,"type":377,"tunes":3265},{"content":3255,"stretched":43,"withHeadings":14},[3256,3257,3258,3259,3260,3261,3262,3263,3264],[689,690,691],[693,694,695],[697,698,699],[701,702,703],[705,706,707],[709,710,711],[713,714,715],[717,718,719],[721,722,723],{},{"id":726,"data":3267,"type":218,"tunes":3268},{"text":728},{},{"id":731,"data":3270,"type":42,"tunes":3271},{"text":733,"level":247},{},{"id":736,"data":3273,"type":218,"tunes":3274},{"text":738},{},{"id":741,"data":3276,"type":218,"tunes":3277},{"text":743},{},{"id":746,"data":3279,"type":218,"tunes":3280},{"text":748},{},{"id":751,"data":3282,"type":42,"tunes":3283},{"text":753,"level":247},{},{"id":756,"data":3285,"type":218,"tunes":3286},{"text":758},{},{"id":761,"data":3288,"type":218,"tunes":3289},{"text":763},{},{"id":766,"data":3291,"type":218,"tunes":3292},{"text":768},{},{"id":771,"data":3294,"type":226,"tunes":3295},{"body":773,"title":774,"variant":775},{},{"id":778,"data":3297,"type":42,"tunes":3298},{"text":780,"level":247},{},{"id":783,"data":3300,"type":320,"tunes":3310},{"steps":3301,"title":810,"orientation":319},[3302,3303,3304,3305,3306,3307,3308,3309],{"label":787,"description":788},{"label":790,"description":791},{"label":793,"description":794},{"label":796,"description":797},{"label":799,"description":800},{"label":802,"description":803},{"label":805,"description":806},{"label":808,"description":809},{},{"id":813,"data":3312,"type":42,"tunes":3313},{"text":815,"level":247},{},{"id":818,"data":3315,"type":218,"tunes":3316},{"text":820},{},{"id":823,"data":3318,"type":218,"tunes":3319},{"text":825},{},{"id":828,"data":3321,"type":218,"tunes":3322},{"text":830},{},{"id":833,"data":3324,"type":42,"tunes":3325},{"text":835,"level":247},{},{"id":838,"data":3327,"type":218,"tunes":3328},{"text":840},{},{"id":843,"data":3330,"type":218,"tunes":3331},{"text":845},{},{"id":848,"data":3333,"type":218,"tunes":3334},{"text":850},{},{"id":853,"data":3336,"type":42,"tunes":3337},{"text":855,"level":247},{},{"id":858,"data":3339,"type":218,"tunes":3340},{"text":860},{},{"id":863,"data":3342,"type":218,"tunes":3343},{"text":865},{},{"id":868,"data":3345,"type":218,"tunes":3346},{"text":870},{},{"id":873,"data":3348,"type":377,"tunes":3358},{"content":3349,"stretched":43,"withHeadings":14},[3350,3351,3352,3353,3354,3355,3356,3357],[877,878],[880,881],[883,884],[886,887],[889,890],[892,893],[895,896],[898,899],{},{"id":902,"data":3360,"type":42,"tunes":3361},{"text":904,"level":247},{},{"id":907,"data":3363,"type":218,"tunes":3364},{"text":909},{},{"id":912,"data":3366,"type":218,"tunes":3367},{"text":914},{},{"id":917,"data":3369,"type":218,"tunes":3370},{"text":919},{},{"id":922,"data":3372,"type":42,"tunes":3373},{"text":924,"level":247},{},{"id":927,"data":3375,"type":218,"tunes":3376},{"text":929},{},{"id":932,"data":3378,"type":218,"tunes":3379},{"text":934},{},{"id":937,"data":3381,"type":218,"tunes":3382},{"text":939},{},{"id":942,"data":3384,"type":42,"tunes":3385},{"text":944,"level":247},{},{"id":947,"data":3387,"type":218,"tunes":3388},{"text":949},{},{"id":952,"data":3390,"type":218,"tunes":3391},{"text":954},{},{"id":957,"data":3393,"type":218,"tunes":3394},{"text":959},{},{"id":962,"data":3396,"type":42,"tunes":3397},{"text":964,"level":247},{},{"id":967,"data":3399,"type":218,"tunes":3400},{"text":969},{},{"id":972,"data":3402,"type":218,"tunes":3403},{"text":974},{},{"id":977,"data":3405,"type":218,"tunes":3406},{"text":979},{},{"id":982,"data":3408,"type":42,"tunes":3409},{"text":984,"level":247},{},{"id":987,"data":3411,"type":385,"tunes":3424},{"rows":3412,"title":1006,"layout":377,"columns":3421},[3413,3415,3417,3419],{"id":991,"label":992,"values":3414},[355,355],{"id":995,"label":996,"values":3416},[355,355],{"id":999,"label":1000,"values":3418},[355,355],{"id":1003,"label":1004,"values":3420},[355,355],[3422,3423],{"id":1009,"label":1010},{"id":1012,"label":1013},{},{"id":1016,"data":3426,"type":218,"tunes":3427},{"text":1018},{},{"id":1021,"data":3429,"type":42,"tunes":3430},{"text":1023,"level":247},{},{"id":1026,"data":3432,"type":218,"tunes":3433},{"text":1028},{},{"id":1031,"data":3435,"type":218,"tunes":3436},{"text":1033},{},{"id":1036,"data":3438,"type":218,"tunes":3439},{"text":1038},{},{"id":1041,"data":3441,"type":42,"tunes":3442},{"text":1043,"level":247},{},{"id":1046,"data":3444,"type":42,"tunes":3445},{"text":1048,"level":246},{},{"id":1051,"data":3447,"type":226,"tunes":3448},{"body":1053,"title":1054,"variant":240},{},{"id":1057,"data":3450,"type":218,"tunes":3451},{"text":1059},{},{"id":1062,"data":3453,"type":218,"tunes":3454},{"text":1064},{},{"id":1067,"data":3456,"type":218,"tunes":3457},{"text":1069},{},{"id":1072,"data":3459,"type":42,"tunes":3460},{"text":1074,"level":246},{},{"id":1077,"data":3462,"type":218,"tunes":3463},{"text":1079},{},{"id":1082,"data":3465,"type":218,"tunes":3466},{"text":1084},{},{"id":1087,"data":3468,"type":42,"tunes":3469},{"text":1089,"level":246},{},{"id":1092,"data":3471,"type":218,"tunes":3472},{"text":1094},{},{"id":1097,"data":3474,"type":218,"tunes":3475},{"text":1099},{},{"id":1102,"data":3477,"type":218,"tunes":3478},{"text":1104},{},{"id":1107,"data":3480,"type":377,"tunes":3490},{"content":3481,"stretched":43,"withHeadings":14},[3482,3483,3484,3485,3486,3487,3488,3489],[1111,1112],[1114,1115],[1117,1118],[1120,1121],[1123,1124],[1126,1127],[1129,1130],[1132,1133],{},{"id":1136,"data":3492,"type":42,"tunes":3493},{"text":1138,"level":247},{},{"id":1141,"data":3495,"type":377,"tunes":3511},{"content":3496,"stretched":43,"withHeadings":14},[3497,3498,3499,3500,3501,3502,3503,3504,3505,3506,3507,3508,3509,3510],[1145,1146],[1148,1149],[1151,1152],[1154,1155],[1157,1158],[1160,1161],[1163,1164],[1166,1167],[1169,1170],[1172,1173],[1175,1176],[1178,1179],[1181,1182],[1184,1185],{},{"id":1188,"data":3513,"type":42,"tunes":3514},{"text":1190,"level":247},{},{"id":1193,"data":3516,"type":218,"tunes":3517},{"text":1195},{},{"id":1198,"data":3519,"type":218,"tunes":3520},{"text":1200},{},{"id":1203,"data":3522,"type":218,"tunes":3523},{"text":1205},{},{"id":1208,"data":3525,"type":42,"tunes":3526},{"text":1210,"level":247},{},{"id":1213,"data":3528,"type":218,"tunes":3529},{"text":1215},{},{"id":1218,"data":3531,"type":377,"tunes":3543},{"content":3532,"stretched":43,"withHeadings":14},[3533,3534,3535,3536,3537,3538,3539,3540,3541,3542],[1222,1223],[1225,1226],[1228,1229],[1231,1232],[1234,1235],[1237,1238],[1240,1241],[1243,1244],[1246,1247],[1249,1250],{},{"id":1253,"data":3545,"type":218,"tunes":3546},{"text":1255},{},{"id":1258,"data":3548,"type":42,"tunes":3549},{"text":1260,"level":247},{},{"id":1263,"data":3551,"type":320,"tunes":3565},{"steps":3552,"title":1302,"orientation":319},[3553,3554,3555,3556,3557,3558,3559,3560,3561,3562,3563,3564],{"label":1267,"description":1268},{"label":1270,"description":1271},{"label":1273,"description":1274},{"label":1276,"description":1277},{"label":1279,"description":1280},{"label":1282,"description":1283},{"label":1285,"description":1286},{"label":1288,"description":1289},{"label":1291,"description":1292},{"label":1294,"description":1295},{"label":1297,"description":1298},{"label":1300,"description":1301},{},{"id":1305,"data":3567,"type":42,"tunes":3568},{"text":1307,"level":247},{},{"id":1310,"data":3570,"type":377,"tunes":3588},{"content":3571,"stretched":43,"withHeadings":14},[3572,3573,3574,3575,3576,3577,3578,3579,3580,3581,3582,3583,3584,3585,3586,3587],[1314,1315],[1317,1318],[1320,1321],[1323,1324],[1326,1327],[1329,1330],[1332,1333],[1335,1336],[1338,1339],[1341,1342],[1344,1345],[1347,1348],[1350,1351],[1353,1354],[1356,1357],[1359,1360],{},{"id":1363,"data":3590,"type":42,"tunes":3591},{"text":1365,"level":247},{},{"id":1368,"data":3593,"type":377,"tunes":3606},{"content":3594,"stretched":43,"withHeadings":14},[3595,3596,3597,3598,3599,3600,3601,3602,3603,3604,3605],[1372,1373],[1375,1376],[1378,1379],[1381,1382],[1384,1385],[1387,1388],[1390,1391],[1393,1394],[1396,1397],[1399,1400],[1402,1403],{},{"id":1406,"data":3608,"type":42,"tunes":3609},{"text":1408,"level":247},{},{"id":1411,"data":3611,"type":218,"tunes":3612},{"text":1413},{},{"id":1416,"data":3614,"type":218,"tunes":3615},{"text":1418},{},{"id":1421,"data":3617,"type":218,"tunes":3618},{"text":1423},{},{"id":1426,"data":3620,"type":218,"tunes":3621},{"text":1428},{},{"id":1431,"data":3623,"type":218,"tunes":3624},{"text":1433},{},{"id":1436,"data":3626,"type":42,"tunes":3627},{"text":1438,"level":247},{},{"id":1441,"data":3629,"type":218,"tunes":3630},{"text":1443},{},{"id":1446,"data":3632,"type":218,"tunes":3633},{"text":1448},{},{"id":1451,"data":3635,"type":218,"tunes":3636},{"text":1453},{},{"id":1456,"data":3638,"type":42,"tunes":3639},{"text":1458,"level":247},{},{"id":1461,"data":3641,"type":218,"tunes":3642},{"text":1463},{},{"id":1466,"data":3644,"type":218,"tunes":3645},{"text":1468},{},{"id":1471,"data":3647,"type":218,"tunes":3648},{"text":1473},{},{"id":1476,"data":3650,"type":1482,"tunes":3651},{"url":1478,"title":1479,"excerpt":1480,"ctaLabel":1481},{},{"id":1485,"data":3653,"type":1482,"tunes":3654},{"url":1487,"title":1488,"excerpt":1489,"ctaLabel":1490},{},{"id":1493,"data":3656,"type":1482,"tunes":3657},{"url":1495,"title":1496,"excerpt":1497,"ctaLabel":1498},{},{"id":1501,"data":3659,"type":42,"tunes":3660},{"text":1503,"level":247},{},{"id":1506,"data":3662,"type":1506,"tunes":3673},{"items":3663,"title":1545},[3664,3665,3666,3667,3668,3669,3670,3671,3672],{"id":1510,"answer":1511,"question":1512},{"id":1514,"answer":1515,"question":1516},{"id":1518,"answer":1519,"question":1520},{"id":1522,"answer":1523,"question":1524},{"id":1526,"answer":1527,"question":1528},{"id":1530,"answer":1531,"question":1532},{"id":1534,"answer":1535,"question":1536},{"id":1538,"answer":1539,"question":1540},{"id":1542,"answer":1543,"question":1544},{},{"id":1548,"data":3675,"type":42,"tunes":3676},{"text":1550,"level":247},{},{"id":1553,"data":3678,"type":1553,"tunes":3692},{"title":1555,"entries":3679},[3680,3681,3682,3683,3684,3685,3686,3687,3688,3689,3690,3691],{"term":1558,"anchor":1559,"definition":1560},{"term":1562,"anchor":1563,"definition":1564},{"term":1566,"anchor":1567,"definition":1568},{"term":1570,"anchor":1571,"definition":1572},{"term":1574,"anchor":1575,"definition":1576},{"term":1578,"anchor":1579,"definition":1580},{"term":1582,"anchor":1583,"definition":1584},{"term":1586,"anchor":1587,"definition":1588},{"term":1590,"anchor":1591,"definition":1592},{"term":1594,"anchor":1595,"definition":1596},{"term":1598,"anchor":1599,"definition":1600},{"term":1602,"anchor":1603,"definition":1604},{},{"id":1607,"data":3694,"type":42,"tunes":3695},{"text":1609,"level":247},{},{"id":1612,"data":3697,"type":218,"tunes":3698},{"text":1614},{},{"id":1617,"data":3700,"type":218,"tunes":3701},{"text":1619},{},{"id":1622,"data":3703,"type":218,"tunes":3704},{"text":1624},{},{"id":1627,"data":3706,"type":42,"tunes":3707},{"text":1629,"level":247},{},{"id":1632,"data":3709,"type":218,"tunes":3710},{"text":1634},{},{"id":1637,"data":3712,"type":1644,"tunes":3715},{"link":1639,"meta":3713},{"image":3714,"title":1642,"description":1643},{"url":355},{},{"id":1647,"data":3717,"type":1644,"tunes":3720},{"link":1649,"meta":3718},{"image":3719,"title":1652,"description":1653},{"url":355},{},{"id":1656,"data":3722,"type":1644,"tunes":3725},{"link":1658,"meta":3723},{"image":3724,"title":1661,"description":1662},{"url":355},{},{"id":1665,"data":3727,"type":1644,"tunes":3730},{"link":1667,"meta":3728},{"image":3729,"title":1670,"description":1671},{"url":355},{},{"id":1674,"data":3732,"type":1644,"tunes":3735},{"link":1676,"meta":3733},{"image":3734,"title":1679,"description":1680},{"url":355},{},{"id":1683,"data":3737,"type":1644,"tunes":3740},{"link":1685,"meta":3738},{"image":3739,"title":1688,"description":1689},{"url":355},{},{"id":1692,"data":3742,"type":1644,"tunes":3745},{"link":1694,"meta":3743},{"image":3744,"title":1697,"description":1698},{"url":355},{},{"id":1701,"data":3747,"type":1644,"tunes":3750},{"link":1703,"meta":3748},{"image":3749,"title":1706,"description":1707},{"url":355},{},{"id":1710,"data":3752,"type":1644,"tunes":3755},{"link":1712,"meta":3753},{"image":3754,"title":1715,"description":1716},{"url":355},{},"Post erfolgreich abgerufen",{"items":3758,"source":3843,"manualIds":3844,"manualMatchedIds":3845},[3759,3766,3773,3780,3787,3794,3801,3808,3815,3822,3829,3836],{"id":3760,"slug":3761,"title":3762,"excerpt":3763,"featuredImage":3764,"publishedAt":3765},"380","streamlining-code-quality-testing-with-eslint-and-prettier","Optimizacija kvaliteta koda: Testiranje sa ESLint-om i Prettier-om","U modernom razvoju softvera, održavanje doslednog kvaliteta i stila koda je od suštinskog značaja. ESLint i Prettier nude moćnu kombinaciju za automatizaciju ovih ključnih aspekata, obezbeđujući da su kodne baze čiste, čitljive i da se pridržavaju definisanih standarda. Ovaj članak se bavi time kako se ovi alati besprekorno integrišu u tokove rada testiranja, poboljšavajući produktivnost programera i održivost projekta.","\u002Fuploads\u002F2026\u002F01\u002Ftesting-with-eslint-and-prettier-1769204102989-ezczs0-1769376472926-hwqqkt.webp","2026-01-25T10:26:00.000Z",{"id":3767,"slug":3768,"title":3769,"excerpt":3770,"featuredImage":3771,"publishedAt":3772},"449","google-io-2026-agentic-products-search-workspace-and-shopping","Google I\u002FO 2026: Agentski proizvodi širom Pretrage, Workspace-a i Kupovine","Google I\u002FO 2026 je pokazao da agentska veštačka inteligencija prevazilazi demonstracije modela i razvojne alate i ulazi u svakodnevne površine proizvoda. Ovaj članak detaljno objašnjava kako Search, Workspace, Gemini Spark i Universal Cart ukazuju na novi model proizvoda u kojem Google agenti pomažu korisnicima da istražuju, rade, kupuju i deluju kroz povezane usluge.","\u002Fuploads\u002F2026\u002F05\u002Fgoogle-io-2026-agentic-products-search-workspace-and-shopping-1779228004340-9mqs07.webp","2026-05-21T11:09:00.000Z",{"id":3774,"slug":3775,"title":3776,"excerpt":3777,"featuredImage":3778,"publishedAt":3779},"488","what-is-context-engineering-what-the-model-receives-before-it-answers","Šta je kontekstualno inženjerstvo? Šta model prima pre nego što odgovori","Inženjering konteksta osmišljava koje informacije AI model prima pre inferencije, uključujući promptove, pretragu, memoriju, stanje aplikacije, rezultate alata i istoriju konverzacije.","\u002Fuploads\u002F2026\u002F10\u002Fwhat-is-context-engineering-what-the-model-receives-before-it-answers-1791480653258-018kcv.webp","2026-10-08T13:29:00.000Z",{"id":3781,"slug":3782,"title":3783,"excerpt":3784,"featuredImage":3785,"publishedAt":3786},"452","zbt-z8102ax-5g-openwrt-router-review-dual-sim-rm500u-ea-and-an-honest-assessment","Recenzija ZBT Z8102AX 5G OpenWrt rutera: Dual SIM, RM500U-EA i iskrena ocena","ZBT Z8102AX je neobičan 5G ruter sa OpenWrt osnovom, dual-SIM konceptom i Quectel RM500U-EA modemom. Na testiranju pokazuje jasne prednosti u fleksibilnosti, interfejsima i mobilnoj povezivosti, ali i tipične slabosti OpenWrt verzije koju je modifikovao proizvođač.","\u002Fuploads\u002F2026\u002F06\u002Fopenwrt-router-review-dual-sim-01-1781620588908-fwmzj7.webp","2026-06-16T07:34:00.000Z",{"id":3788,"slug":3789,"title":3790,"excerpt":3791,"featuredImage":3792,"publishedAt":3793},"462","the-prompt-is-part-of-the-bias-how-ai-framing-shapes-reasoning","Prompt je deo pristrasnosti: Kako AI uokviravanje oblikuje rezonovanje","Formulacija prompta nije neutralna. Istražite kako uokvirivanje, pretpostavke, praćenje uputstava i podilaženje mogu oblikovati rasuđivanje veštačke inteligencije—i zašto pouzdani zaključci zahtevaju testiranje izvan originalnog prompta.","\u002Fuploads\u002F2026\u002F09\u002Fthe-prompt-is-part-of-the-bias-how-ai-framing-shapes-reasoning-1789804884054-u278vc.webp","2026-09-19T01:04:00.000Z",{"id":3795,"slug":3796,"title":3797,"excerpt":3798,"featuredImage":3799,"publishedAt":3800},"451","test-dev-enterprise","Sveobuhvatni vodič za Test DEv Enterprise Stajic.de: Arhitektura i najbolje prakse","Istražite arhitektonske principe, prednosti i tehničke detalje upravljanja okruženjem za razvoj i testiranje nivoa preduzeća pomoću Test DEv Enterprise Stajic.de.","\u002Fuploads\u002F2026\u002F05\u002Ftest-dev-enterprise-1779534260081-r4dvxn.webp","2026-05-22T23:01:00.000Z",{"id":3802,"slug":3803,"title":3804,"excerpt":3805,"featuredImage":3806,"publishedAt":3807},"460","ai-agent-reliability-why-the-final-answer-is-not-enough","Pouzdanost AI agenata: Zašto konačni odgovor nije dovoljan","Tačan rezultat ne dokazuje ispravno razmišljanje, bezbedno izvršavanje ili pouzdan sistem.","\u002Fuploads\u002F2026\u002F09\u002Fai-agent-reliability-why-the-final-answer-is-not-enough-1788955466306-pl0qhz.webp","2026-09-09T04:01:00.000Z",{"id":3809,"slug":3810,"title":3811,"excerpt":3812,"featuredImage":3813,"publishedAt":3814},"467","the-answer-validity-boundary-the-missing-layer-between-relevance-and-reliable-ai-answers","Granica valjanosti odgovora: Nedostajući sloj između relevantnosti i pouzdanih AI odgovora","Izvor može biti relevantan, autoritativan i ipak pogrešan za pitanje koje se postavlja. Sloj koji nedostaje je primenljivost: uslovi pod kojima odgovor važi i promene koje ga primoravaju na preispitivanje. Ovaj članak predstavlja Granicu važenja odgovora kao obrazac za dizajn izvora za ljude, AI pretragu i RAG sisteme.","\u002Fuploads\u002F2026\u002F09\u002Fthe-answer-validity-boundary-the-missing-layer-between-relevance-and-reliable-ai-answers-1790272901306-1g5jly.webp","2026-09-24T11:59:00.000Z",{"id":3816,"slug":3817,"title":3818,"excerpt":3819,"featuredImage":3820,"publishedAt":3821},"489","agentic-ai-explained-when-an-ai-system-can-plan-use-tools-and-act","Agentna AI objašnjena: Kada AI sistem može da planira, koristi alate i deluje","Agentna AI koristi modele unutar višekoračnih izvršnih petlji gde mogu da biraju alate, posmatraju rezultate, ažuriraju stanje i prilagode svoju sledeću akciju unutar eksplicitnih granica izvršavanja i dozvola.","\u002Fuploads\u002F2026\u002F10\u002Fagentic-ai-explained-when-an-ai-system-can-plan-use-tools-and-act-1791481499084-wnji2a.webp","2026-10-08T11:43:00.000Z",{"id":3823,"slug":3824,"title":3825,"excerpt":3826,"featuredImage":3827,"publishedAt":3828},"454","zbt-z8102ax-rm500u-ea-5g-modem-test","Quectel RM500U-EA u ZBT Z8102AX: 5G opsezi, o2 Nemačka i ponašanje signala u stvarnom svetu","ZBT Z8102AX koristi Quectel RM500U-EA modem za 4G i 5G povezivost. U prvom praktičnom testu, ruter se uspešno povezao na o2 Germany sa LTE Band 3 i NR n28. Modem radi, ali dublja dijagnostika poput RSRP, RSRQ, SINR, zaključavanja opsega i ponašanja ćelije još uvek zahteva odgovarajuće testiranje.","\u002Fuploads\u002F2026\u002F06\u002Fopenwrt-router-review-dual-sim-06-1781620597879-qay2sx.webp","2026-06-16T08:39:00.000Z",{"id":3830,"slug":3831,"title":3832,"excerpt":3833,"featuredImage":3834,"publishedAt":3835},"459","ollama-is-not-the-product-building-production-ready-open-llm-applications","Ollama nije proizvod: Izgradnja aplikacija spremnih za produkciju sa otvorenim LLM-ovima","Pokretanje lokalnog modela pomoću Ollama-e je jednostavno. Izgradnja Open-LLM aplikacije spremne za produkciju je teža: zahteva RAG, kontrolu pristupa, apstrakciju provajdera, evaluaciju, logovanje, disciplinu puštanja u rad i kontrolisani aplikativni sloj oko modela.","\u002Fuploads\u002F2026\u002F06\u002Follama-is-not-the-product-building-production-ready-open-llm-applications-1782679361640-h0usqf.webp","2026-06-28T16:39:00.000Z",{"id":3837,"slug":3838,"title":3839,"excerpt":3840,"featuredImage":3841,"publishedAt":3842},"483","what-is-an-ai-solution-architect-system-boundaries-responsibilities-and-trade-offs","Šta je AI rešenje arhitekta? Granice sistema, odgovornosti i kompromisi","AI Solution Architect pretvara poslovne zahteve u AI sistem spreman za produkciju, obuhvatajući podatke, modele, alate, bezbednost, izvršno okruženje, evaluaciju i operacije.","\u002Fuploads\u002F2026\u002F10\u002Fwhat-is-an-ai-solution-architect-system-boundaries-responsibilities-and-trade-offs-1791476643267-1st5xz.webp","2026-10-08T12:23:00.000Z","fallback",[],[]]