⚡ Quick Summary
Published by the Cloud Security Alliance, this white paper from its AI Governance & Compliance Working Group argues that governing AI is less novel than it looks. Its lead author is Dan Stocker. Because useful AI systems implement human judgment, and non-determinism is what makes that possible, established risk management norms can be applied, with a narrowly tailored minimum of new controls added — "as simple as possible, but no simpler."
The paper states three objectives: to frame AI governance and compliance as a question of maturity, to analyse the key challenges from diverse viewpoints, and to recommend an approach grounded in broad best practices. It surveys inherent and near-term challenges — explainability, testing, evaluation, validation and verification (TEVV), continuous training and multi-agent systems, privacy, and third-party risk — and reviews technology trends that can help manage AI risk, including Zero Trust, confidential computing and quantum computing.
It recommends adopting a risk-based approach and measuring progress on a maturity scale, described as a "crawl, walk, run" progression from descriptive to normative. The NIST AI Risk Management Framework (AI RMF) — Govern, Map, Measure and Manage across nineteen categories and seventy-two subcategories — is mapped to an AI operations pipeline of Data, Training and Inference, and maturity options such as CMMI, the MITRE AI Maturity Model and a NIST-aligned calibrated model are compared.
🧩 What’s Covered
The white paper moves from framing to recommendations across seven main parts.
- Executive summary, introduction and objectives: positions AI as the latest disruptive technology after the GDPR-era privacy wave, notes that the EU AI Act became effective in August 2024, and sets out three objectives for the paper.
- Background and drivers: defines governance as risk management pursued out of self-interest and compliance as the follow-up with third parties; argues AI should be treated differently because non-determinism lets it implement human judgment; compares humans and AI on reliability (context window, hallucination) and ethics (guardrails), concluding that the governance model holds with targeted additions.
- Challenges: lists inherent challenges (rapid expansion of abstractions, non-determinism, the rebuttable assumption that complex models are understood, demand for data, rate of change, culture-bound responsible AI concepts) and topical ones (privacy, explainability, TEVV, self and continuous training, multi-agent planner and executor patterns), then covers Zero Trust, confidential computing, quantum computing and value-chain risk, including Model Cards, AIBOMs and signed assertions.
- Key factors for AI adoption: separates small and medium-sized businesses and early experiments, growing companies, and mature enterprises, and lists shared challenges such as cost versus third-party risk, scarce AI talent, harmonising AI with existing risk programmes, and preparing for third-party audits.
- Recommendations and the NIST AI RMF: gives two recommendations and the "crawl, walk, run" progression, then describes the AI RMF's four functions, nineteen categories and seventy-two subcategories, the Playbook, the Generative AI Profile and adversarial machine learning guidance, and maps Trustworthy AI characteristics onto Data, Training and Inference.
- AI maturity models: contrasts Gartner's five levels (Awareness to Transformational) with CMMI levels 0–5, presents the MITRE AI Maturity Model with its six pillars, and describes a NIST-calibrated maturity model whose top tier is "adaptive" and which includes a questionnaire.
- Conclusion: states that AI's non-deterministic implementation of human judgment raises the bar for governance, that regulatory mandates will accelerate, and that mature risk management is a journey.
💡 Why it matters?
The paper gives risk, security and compliance functions a way to place AI inside existing governance rather than building a parallel regime, and it shows where new work is genuinely needed. Mapping Trustworthy AI characteristics across Data, Training and Inference turns the NIST AI RMF into something teams can act on and evidence. It situates AI obligations alongside GDPR and sector frameworks such as PCI DSS and NERC CIP, treats third-party model provenance and lineage as a priority, and offers maturity levels as a way to report progress instead of asserting compliance.
❓ What’s Missing
The paper is deliberately directional. It names no control catalogue, implementation steps or templates, and describes compliance for AI as "a very immature space in 2024" whose stakeholder alignment has not reached critical mass. Explainability, alignment and TEVV are presented as unsettled, with explainability called both an "ultimate necessity" and "frustratingly out of reach". Regulatory detail stays high level: the EU AI Act and US activity are noted without obligations or dates beyond the August 2024 effective date. Works such as Explainable AI (2021), a 2024 review, and the NIST-calibrated maturity paper are cited by title without links.
👥 Best For
Useful for AI governance and compliance leads deciding how much new structure AI actually needs; for security and risk teams mapping controls to the NIST AI RMF across data, training and inference; and for organisations selecting a maturity model to baseline current practice ahead of regulatory deadlines such as the EU AI Act.
📄 Source Details
Don’t Panic! Getting Real About AI Governance is a white paper from the Cloud Security Alliance's AI Governance & Compliance Working Group, with Dan Stocker as lead author and separately listed contributors and reviewers. Copyright notices carry 2024; it runs to 20 pages in English and belongs to the CSA AI Safety Initiative series of outputs. The page 2 reuse notice refers repeatedly to "the draft". The full 20-page text extraction was available. The only URL printed is the working group page, https://cloudsecurityalliance.org/research/working-groups/ai-governance-compliance.
