Judging AI governance
What can you see while your AI is running?
Short answerLive usage, cost, and rule triggers, on a screen your own people can open without asking the vendor. A quarterly report is the past, described by the party being evaluated. Observability is live, and independent of them.
Reporting and observability are routinely sold as the same thing. A report is retrospective and self-authored: the party being evaluated chooses the period, the metrics, and the framing. Observability shows what is happening now, and nobody under evaluation gets to choose what it shows.
| Reporting | Observability | |
|---|---|---|
| When | After the period ends | While it happens |
| Who chooses what is shown | The party being evaluated | Your organization |
| What it tells you | What happened, as described | What is happening |
Who holds the instrument
The question also settles who holds the instrument. If the only view into a system is the vendor's dashboard, oversight exists at the vendor's discretion. That is a commercial arrangement, and it lasts as long as the contract says it does. A control is something your own people can use when they decide to.
Three things worth seeing live
- Usage. Who is using which AI, and how much.
- Cost. What that use costs. Running a model is the permanent cost, so the view has to keep pace with use.
- Rule triggers. Where a rule fired and what it caught. A rule that never shows up here has either never been tested or is only written down.
Watching a running system matters more than it first appears. Some properties of AI can be guaranteed in advance and some never can, and for the second kind, watching what the system actually does is the only verification there is.
How to ask it
- A good answer
- Live visibility into who is using what, at what cost, and where rules were triggered, on a screen the organization can open itself.
- An evasion
- "We provide quarterly reports." A report is a description of the past, delivered by the party being evaluated.
- The follow-up
- Can my own people see that without asking you?
What to check
- Find out who in your organization can open a live view of AI use today without filing a request.
- Check whether that view shows all three of usage, cost, and rule triggers.
- If the view belongs to the vendor, read what the contract says about your access to it, and what happens to it at renewal.
Sources
- National Institute of Standards and Technology, AI Risk Management Framework 1.0. The Measure and Manage functions call for ongoing monitoring of deployed systems.
Reviewed