Your company is deploying twelve AI features. Compliance wants one governance process for all of them. What do you propose?
Show the full answer Hide the answer
What the interviewer is testing
Whether you can make governance proportionate, which is the difference between a process that works and one that is evaded.
Why one process fails
A single heavy process applied to everything does two things: it stops low-risk experimentation, and it drives high-risk work into the shadows because teams avoid the process. Both outcomes are worse than proportionate governance.
The proposal: tier by use, not by technology
The same model can be minimal risk in one application and high risk in another. It is the application that determines the obligations, so tiering must be per feature.
The dimensions that determine the tier: consequence of a wrong output; autonomy — is a human reviewing each decision, only exceptions, or none; population affected including vulnerable groups; regulatory exposure of the domain; and reversibility of the resulting action.
What each tier requires
| Tier | Examples | Requirements |
|---|---|---|
| Minimal | Internal search, code assistance, draft generation | Register it, basic logging, acceptable use guidance |
| Limited | Customer-facing chat, content generation | Above plus transparency to users, guardrails, evaluation set, red teaming |
| High | Credit decisions, hiring screening, clinical support, eligibility | Above plus independent validation, disaggregated fairness evaluation, decision logging sufficient to explain an individual outcome, a working human override, drift monitoring, documented fallback |
| Prohibited | Practices banned under applicable law | Not deployed |
The EU AI Act's structure is worth aligning to regardless of jurisdiction, because it is shaping expectations broadly and a tiering scheme that maps to it saves rework.
The architectural point to insist on
The tier drives design requirements, not just paperwork. Decision logging, override paths, drift monitoring and fallback behaviour are architecture, and deciding the tier late means retrofitting all of it. Tiering should happen at the design stage, not before launch.
What a strong answer adds
A fast path for the minimal tier — self-registration with automated checks, no committee — which is what makes teams willing to declare their AI use rather than hide it. Governance that is easy to comply with for low-risk work earns the credibility to be demanding about high-risk work.
Common weak answers
One process for everything. Tiering by model capability rather than by application.