Why is Governance important?
Artificial Intelligence has moved from being a technological promise to becoming the efficiency engine of companies. However, implementing AI without governance is like driving a race car without brakes: disaster is only a matter of time. Without a well-defined structure, data security, compliance terms, and reputation are at risk.
According to a study by SAP in partnership with Oxford Economics, 8 out of 10 leaders are concerned about the use of external AI tools, causing Shadow AI, and 66% of Brazilian companies admit that the use of Shadow AI occurs with some frequency. (source)
In another survey, Abiacom - Brazilian Association of Artificial Intelligence and E-commerce, reports that 59.1% of companies have not yet established formal guidelines for the use of AI. (source)
How to mitigate these problems?
With the maturity of the LGPD (General Data Protection Law) and the evolution of AI regulations, organizations need a clear framework to manage this technology. The best market practice points to the creation of a governance ecosystem.
Hcode studied frameworks from large companies and created a step-by-step guide for establishing robust AI Governance.
Hcode Framework
Step 1: The Executive Committee (C-Level)
The Strategic Vision
The Executive Committee is the highest leadership of AI governance. They do not get into the lines of code, but dictate the scope and direction of the business, define the budget, and assume final responsibility before the market and regulatory bodies (such as ANPD).
- Who participates: CEO, CTO, CIO, CFO, Legal Director (CLO), and the DPO (Data Protection Officer).
- What they do:
- Risk Appetite Definition: Determines which areas of the company can adopt AI and which ethical and regulatory limits cannot be exceeded.
- Sponsorship and Resource Allocation: Approves the budget for AI initiatives and ensures that governance aligns with business objectives.
- Legal Accountability: Strategically responds for any privacy incidents or discriminatory biases generated by AI tools.
The Executive Committee ensures that corporate use of AI respects the principle of accountability, as required by the LGPD, endorsing investments to mitigate risks before putting systems into production.
Step 2: The Center of Excellence in AI (CoE of AI)
The Line of Defense
If the C-Level defines the destination, the Center of Excellence (CoE) designs the map and traffic rules. This is the tactical layer of governance. The CoE does not develop the models, but creates the framework for development to happen safely, ethically, and legally.
- Who participates: Privacy/LGPD Specialists, Senior Data Engineers, Compliance Professionals, Information Security Specialists, and Risk Managers.
- What they do:
- Creation of Policies and Guidelines: Drafts the acceptable use guide for Generative AI (e.g., what can or cannot be included in the corporate ChatGPT).
- Impact Assessment (RIPD/AIA): Structures the Data Protection Impact Report (RIPD) and the AI Impact Assessment (AIA), analyzing risks of bias, discrimination, and data leakage.
- Supplier Approval: Evaluates the privacy policies of third-party LLMs (OpenAI, Google, AWS) before allowing integration with the company's systems.
- Data Management: Centralizes and monitors corporate data.
The CoE is the guardian of the principles of transparency, security, and non-discrimination. It ensures that the databases used to train or feed AI systems are properly sanitized and backed by a valid legal basis.
Step 3: The AI Excellence Committee (CEIA)
The Front Line
The CEIA is the executing arm, the technical “hands-on” team. They receive the guidelines and limits established by the CoE and transform them into real technological solutions. This is where AI comes to life within the governance limits.
- Who participates: Data Scientists, Machine Learning Engineers, Prompt Engineers, Software Developers, and Automation Specialists (RPA).
- What they do:
- Technical Development: Creates and implements autonomous agents, integrates APIs of large language models (LLMs), and builds automation flows.
- Fine-Tuning and RAG (Retrieval-Augmented Generation): Customizes AI models with the company’s internal data, ensuring that responses are accurate and contextualized.
- Metrics and Monitoring: Monitors the technical performance of the models to avoid the drift phenomenon (loss of model calibration over time) and mitigate hallucinations.
CEIA applies the concept of Privacy by Design and AI by Design. They ensure at the code level that personal data is anonymized or pseudonymized before being processed by language models, preventing the leakage of sensitive information via prompts.
| Layer | Main Role | Base Focus | Main Deliverable |
|---|---|---|---|
| Executive Committee | Strategic | Business and Risk | Vision, Budget, and Limits |
| CoE of AI | Tactical | Governance and Compliance | Policies, Frameworks, and Audit |
| CEIA | Operational | Technology and Execution | Code, Agents, LLMs, and Solutions |
References
Below are the references on which we based our AI Governance structure:
McKinsey & Company (source)
McKinsey & Company is a globally renowned company in strategic and operational consulting. In its guide, team selection can be done in two ways: expanding a Data or IT team, or building a team from scratch.
The guide also identifies critical data management, as without this management AI projects cannot retrieve and process the necessary information. According to McKinsey & Company, this management should be done by the Center of Excellence (CoE)IBM (source)
IBM, the giant, suggests that AI Governance is designed to provide answers regarding:
Whether AI models are making fair decisions
Whether AI outcomes can be explained and trusted
How AI systems are supervised
How to ensure supervision in production
All these answers form Responsible AI for IBM, and from this idea, AI Governance develops.
The next steps are granular, from establishing purpose and scope to creating the AI Ethics Board and even Risk Analyst in AI.
Microsoft (source)
Microsoft has a guide called the AI Agents Maturity Model. Although the focus is not on Governance, this guide is basically the function of the Center of Excellence (CoE). It measures the maturity that your company currently has and what resources are needed to evolve in AI. It’s a very dense and detailed guide.
Google (source)
Google has a map called SAIF (Secure AI Framework), this map guides both the CoE area and the CEIA. The CoE can use the map to determine WHAT needs to be protected. Meanwhile, the CEIA uses the map to determine HOW to protect it.
The map is divided into four development areas: Data, Infrastructure, Model, and Application. Each of these areas has its peculiarities and direction.