Enterprise AI Governance Architecture: Integrating Security, Risk, Compliance, and Human Oversight

Abstract

Large Language Models (LLMs) and other generative forms of artificial intelligence are rapidly moving into enterprise environments. Challenges surround ensuring the security of such models, managing risks associated with their use, ensuring that all use meets organizational and external compliance requirements, and ensuring adequate human oversight and accountability of the resulting automated decision making. Work to develop AI governance in the enterprise environment has generally taken a variety of approaches (technical, organizational, and in the form of compliance) and has not formed part of a unified and integrated system. As such, while a large amount of work exists addressing various aspects of the challenges above, considerable opportunity remains to address many of the issues that arise across the entirety of the AI system lifecycle. This paper presents an architecture for an Enterprise AI Governance framework that integrates AI security, risk management, compliance, and human oversight. The proposed architecture presents a unified view for the governance of all forms of AI, across all phases of the AI system lifecycle (use cases, data and prompts, models, deployment and operationalization, access control, monitoring and audit, model updates and retirement). The architecture encompasses identity and access management, data security and protection, AI-specific security controls, risk assessment and management, compliance, explainability, human-in-the-loop decision making, and ongoing monitoring of AI systems in production. A corresponding reference enterprise architecture is presented, detailing how such a governance framework integrates with a cloud-based platform supporting enterprise applications, data stores, cybersecurity operations, and business processes. The proposed architecture is illustrated and evaluated using a number of AI-related scenarios with differing levels of inherent risk. The work ultimately aims to present a unified and sufficiently flexible Enterprise AI Governance Architecture that enables the secure, responsible, accountable, and continuously auditable use of LLMs and other forms of AI in the enterprise, as well as providing a foundation for future work addressing the additional challenges of autonomous systems.