AI Governance as Code

Chapter 8 made risk classification executable and kept the risk register in version control. This chapter builds the management system that consumes them, turning AI governance from a sequence of committee meetings into controls that run in pipelines, produce evidence, and can be audited without a workshop. It treats the AI management system of ISO/IEC 42001 as an operating model expressed in a repository, codifies the three policy families that matter most, namely model approval, data use, and deployment, and describes the AI inventory that feeds both the internal register and the public algorithm registers that European authorities increasingly maintain. Architecture as Code introduced Policy as Code (Chapter 10) and Governance as Code (Chapter 11) with the principle of assuring once and complying many times (66, Nordqvist, 2025); this chapter extends that principle to models, prompts, and agents.

Most AI governance programmes begin with a steering group, published principles, and a review board that approves AI use cases. Within a year the board has a backlog, teams have learned to describe their work in terms that avoid the board, and the organisation runs systems nobody has looked at. The board is not at fault; the mechanism is. A committee can decide, but it cannot enforce, observe, or remember at the pace of a delivery organisation that ships weekly.

Governance as code inverts the mechanism. The committee decides the rules, approves the interpretation of regulation, and reviews the evidence the rules produce; the pipeline applies the rules identically to every change, refuses what does not comply, and records what it did. Architecture as Code showed this for infrastructure, with Rego policies, pull-request approvals, and evidence published to an audit portal (66, Nordqvist, 2025). For AI the same structure applies to new objects: model versions, prompt configurations, evaluation results, risk register entries from Chapter 8, and threat models, the structured analyses of how a system could be attacked or misused. The committee still exists, but it meets to look at dashboards generated from evidence rather than at slides written to obtain approval.

Primary topics explored

1. From committees to controls
2. ISO/IEC 42001 as a codified operating model
3. 1. Scope
4. 2. Principles
5. 3. Risk tiers and approval path
6. 4. Inventory