Governance Policies and Standards for Deployed Models

Overview
In the PMI Cognitive Project Management for AI (CPMAI) methodology, the final phase is Operationalization. In this phase a validated model moves into production and must keep delivering value safely, ethically and reliably. Governance Policies and Standards for Deployed Models are the rules, roles, processes and controls that guide how an AI model behaves after it goes live. They cover how the model is monitored, who is accountable for it, how changes are approved, how risks are handled, and how compliance is shown.

Deployment is not the finish line. In CPMAI, AI projects are iterative and data-centric, so governance must continue across the whole lifecycle.

Why It Is Important

1. Models degrade over time. Unlike traditional software, AI models depend on data. Data drift (input data changes) and concept drift (the relationship between inputs and outputs changes) cause performance to decay. Governance makes sure someone is watching and acts when thresholds are crossed.

2. Accountability and trust. Stakeholders, regulators and end users need to know who owns the model, who approves changes, and who answers when things go wrong. Without clear ownership, AI failures become organizational blind spots.

3. Regulatory and legal compliance. Some laws and rules expect organizations to document, explain, audit and control their AI systems. Examples include the EU AI Act, GDPR, sector rules in finance and healthcare, and anti-discrimination laws.

4. Ethical and responsible AI. Governance puts trustworthy AI principles into practice after launch. These principles include fairness, transparency, explainability, privacy, safety and human oversight.

5. Risk management. Deployed models can cause financial, reputational, safety or legal harm. Governance gives you ways to spot, escalate, reduce and recover from these risks.

6. Sustained business value. Governance links model performance back to the business KPIs defined in Phase I (Business Understanding). This keeps the solution worth its operating cost.

What It Is
Governance for deployed models is a framework with several connected parts.

Policies: High-level statements of intent and rules. For example, "All production models must be reviewed for bias quarterly" or "High-risk decisions require human-in-the-loop review."

Standards: Specific, measurable requirements that put policies into practice. Examples include minimum accuracy thresholds, required documentation formats (model cards, datasheets), logging requirements, retraining frequency and security controls.

Procedures: Step-by-step instructions for operational tasks. Examples include incident response, rollback, model retirement and change approval.

Roles and responsibilities: Common roles include the following.
- Model owner: business accountability.
- Model steward or MLOps engineer: technical operation.
- Data steward: data quality and lineage.
- AI ethics or governance board: oversight.
- Compliance and legal: regulatory alignment.
- Project or product manager: coordination.
A RACI matrix is often used to make these roles explicit.

Controls and artifacts: Typical items include the following.
- Model inventory or registry
- Version control
- Audit trails
- Model cards
- Performance dashboards
- Monitoring alerts
- Access controls
- Documentation of training data provenance

Key Components in Detail

1. Model Inventory and Registry
A central catalog of every production model. For each one it records the version, owner, purpose, risk tier, training data, deployment date and current status. You cannot govern what you do not know exists.

2. Risk Classification (Tiering)
Models are classified by impact. A high-risk credit decision model needs stricter controls than a low-risk product recommendation model. Governance intensity should match the risk level.

3. Monitoring Standards
Define what is monitored and how often. Common targets include accuracy, precision and recall, latency, data drift, concept drift, fairness metrics, and input data quality. Each metric has thresholds that trigger alerts.

4. Change Management and Version Control
Retraining, re-tuning or replacing a model goes through a controlled approval process. That process includes validation against benchmarks, documentation and sign-off. Rollback plans must exist.

5. Retraining and Lifecycle Policies
Define when retraining happens. It can be scheduled, triggered by drift, or event-driven. The policy also states who approves retraining and how the new model is validated before promotion. It includes retirement and decommissioning criteria too.

6. Explainability and Transparency Standards
Set requirements for explaining model decisions to users, regulators and affected individuals. The level required depends on use case and risk.

7. Fairness and Bias Monitoring
Check outcomes across demographic or protected groups on an ongoing basis. The policy also states what remediation steps are taken when disparities appear.

8. Human Oversight
Specify where humans must stay in the decision loop. Options include human-in-the-loop, human-on-the-loop, or human-over-the-loop. The policy also covers escalation paths and override authority.

9. Security and Privacy Controls
Protect against adversarial attacks, model theft, data leakage and unauthorized access. Ensure compliance with data protection rules, including consent, retention and anonymization.

10. Incident Management
A defined process for detecting, reporting, investigating and resolving model failures or harmful outcomes. It ends with root cause analysis and lessons learned.

11. Auditability and Documentation
Keep logs of predictions, inputs, model versions and decisions. This allows internal and external audits and supports traceability.

How It Works in Practice

Step 1: Establish governance early. CPMAI stresses that governance needs are identified in Phase I (Business Understanding) and refined through every phase. Trustworthy AI considerations are not left until deployment.

Step 2: Register the model at deployment. When the model passes Phase V (Model Evaluation) and is promoted, add it to the model registry with full metadata and documentation.

Step 3: Assign ownership. Name a model owner and operational stewards. Confirm the RACI.

Step 4: Activate monitoring. Configure dashboards and alerts for technical, business and ethical metrics against the agreed thresholds.

Step 5: Run periodic reviews. The governance board or model owner reviews performance, fairness, compliance status and business value on a regular schedule.

Step 6: Respond to triggers. When drift or an incident occurs, follow the defined procedure. The options are to investigate, retrain, roll back, escalate or retire. The trigger then feeds back into a new CPMAI iteration.

Step 7: Document and audit. Record every change, decision and incident to keep traceability.

Step 8: Retire responsibly. When a model is no longer valuable or compliant, decommission it under policy. This includes data retention and stakeholder communication.

Connection to the CPMAI Iterative Approach
CPMAI has six phases.
1. Business Understanding
2. Data Understanding
3. Data Preparation
4. Model Development
5. Model Evaluation
6. Model Operationalization

Governance in Phase VI closes the loop. Insights from monitoring often send the team back to earlier phases. For example, new data issues lead back to Data Understanding, and changed business goals lead back to Business Understanding. Governance is the mechanism that decides when and how those iterations happen.

Exam Tips: Answering Questions on Governance Policies and Standards for Deployed Models

Tip 1: Deployment is not the end. If an answer suggests the project is complete once the model is deployed, it is almost certainly wrong. CPMAI views AI as a continuous lifecycle needing ongoing monitoring and governance.

Tip 2: Prioritize clear accountability. In questions about confusion, failures or nobody responding to issues, the best answer usually sets up a named model owner or clear roles and responsibilities, often through a RACI.

Tip 3: Match governance to risk. When a scenario involves high-impact decisions, such as healthcare, lending, hiring or criminal justice, pick answers with stronger controls. Look for human oversight, explainability, bias audits and stricter approval processes. Avoid one-size-fits-all answers.

Tip 4: Monitoring comes before reaction. If a model's performance is declining, the best first step is usually to investigate using monitoring data. That means checking for data or concept drift. Do not jump straight to building a new model or abandoning the project.

Tip 5: Follow the defined process. Exam answers favor following established change management, incident response or approval procedures over ad hoc fixes. Watch out for "quickly retrain and push to production without validation." That breaks governance.

Tip 6: Know the difference between policies, standards and procedures.
- Policies state what and why.
- Standards define measurable requirements.
- Procedures describe how, step by step.

Tip 7: Trustworthy AI principles are recurring themes. Expect questions on fairness, transparency, explainability, privacy, accountability and safety. The correct answer usually protects affected stakeholders and keeps human oversight in place.

Tip 8: Documentation and traceability matter. Answers that include a model registry, version control, audit logs or model cards are often correct for compliance and audit scenarios.

Tip 9: Link back to business objectives. Governance includes checking that the model still delivers the business value defined in Phase I. If a scenario shows the model is technically accurate but no longer meets business needs, the right answer is to reassess the business understanding.

Tip 10: Involve the right stakeholders. Ethical, legal or regulatory concerns should be escalated to the appropriate body, such as an AI ethics board, compliance or legal. The project manager or data scientist should not decide these alone.

Tip 11: Expect iteration. When a governance trigger fires, the correct answer often goes back to an earlier CPMAI phase rather than patching the model in production.

Tip 12: Eliminate extreme answers. Options such as "shut down all AI immediately" or "ignore minor drift indefinitely" are rarely correct. Choose balanced, process-driven, risk-proportionate responses.

Sample Question Walkthrough
Scenario: A deployed loan-approval model shows a gradual decline in approval rates for one demographic group over three months. What should the project manager do FIRST?

Approach:
1. Spot the issues: possible bias and drift in a high-risk domain.
2. Rule out answers that ignore the problem or immediately replace the model without analysis.
3. The best answer is to start the defined governance or incident process. That means investigating the cause (data drift, concept drift or bias) through monitoring data and escalating to the model owner or ethics/compliance body as policy requires.
4. Follow-up steps might include retraining, adding human review, or rolling back. These come after investigation and approval.

Key Takeaways
- Governance keeps deployed AI accountable, compliant, ethical and valuable over time.
- Core elements are policies, standards, procedures, roles, monitoring, change control, documentation and incident management.
- Governance strength should match the model's risk level.
- In exams, choose answers that are proactive, process-driven, risk-proportionate and stakeholder-aware, and that reflect CPMAI's iterative lifecycle.