Week 9: Governing GenAI in Organizations

Module: Govern | Deliverable: GenAI governance memo (due before Week 10 begins) | See assignment →

Learning objectives

By the end of this week, you should be able to:

Explain why GenAI requires organizational governance, not just ethical principles
Apply the NIST AI Risk Management Framework (Govern, Map, Measure, Manage)
Compute a quantitative risk score using a likelihood × impact matrix
Draft governance rules with measurable thresholds tied to evaluation metrics from Weeks 7–8
Write an acceptable-use policy with quantitative triggers for review, escalation, and monitoring
Connect governance requirements to the specific tools you’ve built in this course

Sessions

Session 1 · Class 17

From principles to operating rules - with numbers

The governance gap between "use AI responsibly" and specific operating rules. NIST AI RMF mapped to the quantitative tools you've built (rubrics, kappa, disparity metrics, cost analysis). Then a governance checklist workshop with a quantitative risk scoring matrix: likelihood × impact for each domain.

Principles vs. operating rules NIST AI RMF + course tools Quantitative risk matrix Governance rules with thresholds

Session 2 · Class 18

Drafting policy and preparing to present

Draft an acceptable-use policy where every section includes at least one measurable threshold. Before finalizing a threshold, back-test it against your own Week 6-8 results (Python: does the rule actually fire at a plausible rate on your data?). Peer-critique another group's policy for measurability and realism. Then dedicated final project work time.

Acceptable-use policy with thresholds Python: threshold back-testing Policy critique for measurability Final project work session

Prepare before class

Before Session 1:

Review your Week 8 incident brief - the safeguard thresholds you wrote connect directly to this week
Skim the NIST AI RMF overview

Before Session 2:

Review your Session 1 risk matrix and governance rules
Have your final project workflow defined well enough to write governance rules for it
Bring your Week 6 and Week 8 results (classification confidence, subgroup error rates) - you’ll back-test your thresholds against them in class18-python-threshold-backtest.ipynb

Key concepts

Concept	What it means
Quantitative risk matrix	Likelihood (1–5) × Impact (1–5) for each governance domain, producing a risk score (1–25)
Governance threshold	A measurable trigger for action: “human review when confidence < 0.7” - not “review when needed”
Threshold back-testing	Checking a proposed threshold against your own Week 6-8 results before finalizing it - what fraction of real cases would it actually flag?
NIST AI RMF	Four functions (Govern, Map, Measure, Manage) mapped to the quantitative tools students have built
Acceptable-use policy	Operating document: approved, restricted, and prohibited uses with specific triggers and escalation

Readings and resources

NIST AI Risk Management Framework - overview and links to the full AI RMF 1.0 document; the four functions (Govern, Map, Measure, Manage) are detailed in the AI RMF 1.0 PDF and Playbook if you want more than the overview

Deliverable

GenAI Governance Memo

~2–3 pages | 30 points | Due before Week 10's first class | Submit via Canvas

Quantitative risk matrix, governance rules with measurable thresholds referencing course metrics, data and review rules, escalation process, and connection to your final project.

Full prompt and rubric →

Looking ahead

Next week: Final Project Presentations - demonstrate all four competencies (understand, use, evaluate, govern) in a 10-minute presentation.