AAISM Domain Three: Managerial Judgment & Controls

Network firewall protecting the subnet

Encrypting model weights at rest

Zero trust for every request

Traditional network segmentation

From planning through decommissioning with security gates

Only during final production verification

After decommissioning to confirm sanitization

During functional unit tests only

End-user acceptance testing only

TEVV: testing, evaluation, verification, validation including adversarial, bias, robustness

Unit tests plus model serialization checks

Only load and performance testing

Notify affected employees only

Rely on anonymization to resolve transfer issues

Delete the model trained with that data

Suspend use of the affected dataset immediately

Continuous bias monitoring in production

Differential privacy for training data

Anonymization as a complete compliance solution

Data provenance and lineage tracking

HITL guarantees elimination of model bias

HITL means humans must be trained data scientists

HITL is required by GDPR for all AI systems

HITL does not always mean a human decides every outcome

Signing model artifacts and provenance verification

Applying standard IT change request forms

Storing models on encrypted NAS only

Periodic manual reviews of model folders

Continuous bias detection in production

One-time anonymization during training

Archiving training datasets offline

Manual spot checks every two years

A Data Protection Impact Assessment (DPIA)

Rely on anonymized employee identifiers

Deploy the model in a pilot to gather usage data

Only implement human override controls

Match control type to risk type (technical vs governance)

Always prefer governance controls over technical ones

Select the cheapest control that reduces risk slightly

Apply encryption for all identified risks