JC AIGP Quick Pass Guide

Modern AI governance is built on a risk-based model: the obligations imposed on an AI system are proportional to the potential harm it could cause. KP-I-A-1-003

The NIST AI Risk Management Framework (AI RMF) organizes governance into four core functions that apply throughout the AI lifecycle: KP-I-A-1-008

GOVERN · MAP · MEASURE · MANAGE

GOVERN establishes policies, culture, and roles. MAP identifies and categorizes AI risks in context. MEASURE analyzes and prioritizes those risks. MANAGE addresses, monitors, and responds to risks on an ongoing basis.

The framework was published in January 2023 and revised (AI RMF 1.0) the same month. It is designed to be used alongside sector-specific guidance — it does not replace existing regulations.

The EU AI Act classifies AI systems into four risk tiers, each with distinct obligations: KP-I-A-1-001

Unacceptable Risk (Prohibited)

Systems that pose an unacceptable threat to people's safety, livelihoods, or rights. Examples: subliminal manipulation below conscious awareness causing harm; real-time biometric surveillance in public spaces (narrow exceptions apply); social scoring by public authorities.

High Risk

Systems used in critical areas listed in Annex III: biometric identification, critical infrastructure, education, employment, essential services, law enforcement, migration, and administration of justice. These must undergo conformity assessment, maintain technical documentation, and enable human oversight.

Limited Risk

Systems with specific transparency obligations — for example, chatbots must disclose they are AI; deepfake content must be labeled as AI-generated.

Minimal Risk

All other AI systems: spam filters, AI in video games, recommendation systems. No specific obligations under the Act, though voluntary codes of practice apply.