r/AIgovernance

A lot of people seem interested in getting into AI governance, but one question keeps coming up:

How do you get experience when every job seems to ask for it?

I looked at 100 AI governance job descriptions, and a few things stood out.

For starters, many roles asked for experience in areas like risk management, compliance, cybersecurity, privacy, and audit, not necessarily years of experience specifically in AI governance.

Another interesting finding: Python and SQL each appeared in only 3 of the 100 job descriptions. Technical knowledge still matters, but these roles often involve working across AI teams, legal, risk, security, and business functions.

NIST, ISO/IEC 42001, and the EU AI Act also showed up frequently.

One thing I think people overlook is the value of building a practical portfolio. You can take a real or simulated AI use case, assess its risks, map the relevant requirements, design controls, and document your approach even before landing your first AI governance role.

I’ve put together Part 3 of the analysis, focusing on how to break into the field and turn existing skills into relevant experience. Check out the latest video @ Latha-ai-governance to watch it. I aim to educate industry professionals regarding AI Governance.

If you were trying to enter AI governance today, what would you focus on first: certifications, practical projects, or building on your existing experience?

Beginning January 1, 2027, California’s AB 1883 will prohibit employers from using workplace surveillance tools that use AI to recognize, infer, or predict employees’ emotional states or collect their neural data. The law includes a safety exception and specified federal exceptions. It does not prohibit every workplace camera or productivity measure.

Applying that boundary requires an account of what the system actually does. An employer should be able to explain its inputs, outputs, and operational use. Calling a product a fatigue or safety tool cannot replace that examination. Emotion scoring for performance management presents a different question from a genuine safety function.

Workers’ alternatives also belong in the governance discussion. In a separate competition dispute, New Jersey’s Attorney General alleges that restrictions affecting Amazon’s delivery-service partners suppress driver mobility and compensation. That allegation concerns the ability to leave for other work. It does not establish a violation of California’s new surveillance law.

In my article on Amazon, worker surveillance, and monopsony, I argue that oversight should examine both the information extracted from workers and their realistic alternatives. A privacy control offers limited practical protection if exercising it costs someone access to work.

I get asked this all the time, so I thought I'd explain what a real day looks like because most descriptions of this job are very vague and theoretical.

My company works in 45 countries, so a big part of my work is checking what changed during the night: did a country make a new AI rule, change an old one or did something go wrong with an AI system in public (because problems usually lead to new rules quickly). I don't read everything myself; that's just not possible at this level, so I use alerts, trusted people and AI tools to help figure out what's important.

The part that surprised me when I started was how much of the job is organising, not reading. Everything gets put into three categories: urgent and needs to be acted on, important but not urgent or just something to keep an eye on. Most people think every new AI rule is an emergency. It's not; most of it stays in the third category for a while.

I also didn't expect how much of the job is translating, not law. No one in a meeting wants "per Article 9 paragraph 2". They want "here's what you need to do this week." So a big part of my day is taking regulatory language and turning it into real tasks for developers, then involving legal and updating things like privacy policies once legal gives the okay.

Then there's the not-fun part. Writing things down. If a decision isn't recorded, in governance it's like it never happened. So a lot of my day is writing about what changed and why a decision was made, because eventually someone will ask, "Why did we decide this?" and you need the records.

Overall pretty different from what I assumed going in way less "reading law all day alone" and way more comparing countries, talking to people, and documenting decisions. I have posted a YouTube video to tell more about it. Check out the latest video at @ Latha-ai-governance

Curious if anyone else in compliance/governance/risk roles finds their actual day looks nothing like the job description either.

As AI systems become capable of acting autonomously, I think there is a question that deserves more attention:

What makes the evidence behind an agents decision sufficient to authorize the action?

An agent may have permission to perform an action.

The action may comply with a policy.

The system may even record everything correctly.

But the decision itself can still be based on evidence that was never properly qualified.

For example:

A variable exists, but does it actually represent what the system thinks it represents?

A keyword matches, but does the underlying meaning actually align with the decision?

Data exists, but is it sufficient for this specific decision?

Information is missing, but should it be treated as zero, unknown, or simply unresolved?

A score can be calculated, but does computability establish validity?

And if the required evidence cannot be established, should the system make an assumption and continue, or should it stop?

This is the problem I am studying through the Organic Intelligence Protocol (OIP).

The principle is simple:

Evidence → Qualification → Measurement → Authorization → Action

The goal is not to make autonomous systems less capable.

The goal is to establish a boundary where consequential action does not proceed merely because the system has permission, confidence, or a plausible interpretation.

If the evidence cannot be established, the system should fail closed rather than silently complete the gap.

I am interested in how others are approaching this problem in autonomous agents, AI governance, and AI safety.

Where should evidence qualification happen in an autonomous system?