From AI governance to practice: Three steps towards responsible AI

As we see more and more artificial intelligence is becoming part of everyday business operations. Organizations are increasingly using AI in advertising platforms, customer service, personalization, internal productivity tools and automated decision-making. While the opportunities continue to grow, so do the questions surrounding the responsible use of these technologies. The recent questions raised are becoming very relevant as the European Union continues implementing the EU AI Act.

Although the deadlines for certain high-risk AI systems have been extended to December 2027 and August 2028, other obligations still clearly apply, making this a good opportunity to prepare for the upcoming developments. A challenge organizations have is not to simply prepare for the future, but also to understand how AI is already being used and how to maintain control over the data, decisions and the risks involved.

At Cloud Nine Digital, we believe effective AI governance starts with understanding what actually happens within an organization's systems, rather than relying exclusively on policies and documentation.

To help organizations translate AI governance requirements into practice, we are introducing three services that address different stages of the AI lifecycle.

1. Understanding your AI data flows: AI Data Flow and Sharing Assessment

One of the first challenges in AI governance is visibility. AI solutions can appear relatively straightforward. An employee enters information into an AI assistant, a customer interacts with a chatbot, or a marketing platform uses algorithms to optimize a campaign. However, behind these interactions, information may travel through several systems, vendors and potentially different countries.

For example, consider a customer service chatbot connected to an organization's CRM system. The chatbot may need access to customer information and order history to provide relevant answers. But this immediately raises several questions, such as which customer information the chatbot can access, whether that information is shared with an external AI provider, and how long it is retained, to name a few. These are not just technical questions, they directly influence privacy, security, compliance and business operations.

From assumptions to actual data flows

Our AI Data Flow and Sharing Assessment helps organizations understand how information moves through their AI systems and how those systems produce or influence decisions. We describe this as creating a data in, decisions out map.

The assessment examines which information enters an AI system, where it originates, the purposes for which it is used, which parties receive it and what happens to the resulting output. It also considers relevant privacy requirements, including legal bases, consent where applicable, retention periods and international data transfers.

An important part of this process is comparing documented arrangements with the actual technical implementation. After all, an organization might have a privacy policy describing how it processes customer information, but that does not automatically mean every connected AI system follows those arrangements.

The result is a practical overview that lets business, IT, privacy, security, and management teams work from the same understanding of how an AI use case operates. It also provides the foundation for determining which regulatory requirements apply and where additional controls may be necessary.

2. Understanding your obligations: AI Act Classification, DPIA and Fundamental Rights Assessment

Once an organization understands how an AI system works, the next question is what responsibilities follow from its use. Not every AI application carries the same risks or regulatory obligations. The EU AI Act recognizes these differences through a risk-based regulatory framework.

However, determining where an AI system fits within that framework is not always straightforward. For example, an organization purchasing an existing AI solution may have different responsibilities from an organization developing its own system or significantly modifying an existing one. The distinction between acting as an AI provider or deployer can therefore be important.

Translating regulation into practical decisions

With our AI Act Classification, DPIA and Fundamental Rights Assessment service, we help organizations determine which requirements apply to their specific AI use cases. This starts with understanding the purpose of the system, how it is used and which individuals or groups may be affected.

Based on this information, we assess its classification under the EU AI Act, the organization's role and the resulting obligations. Where necessary, we also support a Data Protection Impact Assessment (DPIA) or Fundamental Rights Impact Assessment (FRIA).

These assessments help identify potential risks to individuals, such as inappropriate use of personal information, discriminatory outcomes, insufficient transparency or inadequate human oversight. This will help organizations have clear answers to three questions:

What type of AI use case are we dealing with?

What are our responsibilities?

What measures do we need to implement?

For lower-risk applications, this can mean confirming that existing governance arrangements are sufficient or identifying proportionate improvements. For higher-risk applications, it may involve additional assessments, documentation, oversight and technical or organizational controls.

Importantly, classification should not be treated as a one-time activity. AI systems change over time. New datasets may become available, suppliers may introduce different models and existing functionality may be expanded. A system originally introduced for a relatively limited purpose may eventually influence more consequential decisions.

Understanding the regulatory position of an AI use case therefore requires both an initial assessment and the ability to reassess it when circumstances change.

3. Preparing for unexpected outcomes: AI Incident Response and Communication Training

Even when an AI system has been properly assessed and appropriate controls are in place, incidents can still occur. However, AI incidents do not always resemble traditional cybersecurity incidents or personal data breaches.

An AI assistant might disclose confidential company information. A recommendation system might repeatedly produce discriminatory results or an AI agent connected to internal systems might perform an unintended action. In these situations, identifying the technical problem is only part of the challenge.

Organizations must also determine the potential impact, whether the system should remain operational, who needs to be involved, and whether affected individuals or authorities must be informed. Existing incident response procedures may not adequately address these AI-specific scenarios.

Knowing how to respond before something goes wrong

Our AI Incident Response and Communication Training helps organizations prepare employees and internal teams to recognize, escalate and respond to AI-related incidents.

The service combines practical incident response procedures with role-based training and scenario exercises. It focuses on establishing a common process for recognizing incidents, assessing their severity, investigating potential causes and determining appropriate actions.

An important aspect is identifying responsibilities across different teams. AI incidents may involve IT, information security, privacy, legal, communications and business operations. Without clear responsibilities, organizations risk having different teams investigate the same issue independently, potentially delaying decisions or creating inconsistent communication.

The training also addresses how organizations communicate about incidents. Depending on the circumstances, organizations may need to inform customers, affected individuals, business partners or regulators. Relevant obligations may arise under the GDPR, EU AI Act or other applicable legislation. For organizations operating or supplying high-risk AI systems, preparing for the AI Act's serious-incident reporting requirements is another important consideration.

The goal is to ensure that employees understand how to identify potential problems and when to escalate them and how to respond. An AI incident should not be the first moment an organization determines who is responsible for making decisions about its AI systems.

Bringing AI governance together

Although these three services address different challenges, they are interconnected. Understanding data flows establishes the factual foundation for governing an AI system. Regulatory classification and risk assessments help determine which obligations apply and what controls are necessary. Incident response training prepares organizations to act when an AI system behaves unexpectedly or when those controls prove insufficient.

Together, these activities create a more practical approach to AI governance, connecting the technical reality of AI systems with organizational responsibilities and regulatory requirements. The relevance of this is evident, because AI is increasingly introduced through technologies that organizations already use. These developments may not always be treated as separate AI projects, even though they can significantly change how data is processed and how decisions are made.

At Cloud Nine Digital, our experience with data collection, privacy, consent management and technical data integrations showcases a solid foundation for examining these developments from the data layer upwards. Rather than approaching AI governance exclusively as a policy or legal exercise, we focus on understanding how systems actually work and translating those findings into practical actions.

Good AI governance should not prevent organisations from using AI. It should provide the understanding and controls needed to use it responsibly and with confidence and we intend to help you reach that goal.

About the author

 Eliza Badescu is Lead Consultant Data Privacy & Compliance at Cloud Nine Digital. She joined the company to further strengthen and add value to its Privacy & Compliance pillar, helping organizations translate complex regulatory requirements into practical solutions.
She leads the development of Cloud Nine Digital’s privacy, compliance and governance expertise, with work spanning DPIAs, consent, privacy governance and the responsible and compliant use of AI.

Looking for support with AI governance, compliance or a DPIA for your AI use cases? Reach out to Cloud Nine Digital to see how Eliza and the team can support you.