\cleardoublepage \part{Risk, Governance, Trust and Assurance} \setbookpart{Risk, Governance, Trust and Assurance}

Part III: Risk, Governance, Trust and Assurance

This part is the core of the book. It turns the obligations and dependencies of Parts I and II into controls that run in the same pipelines as the systems they govern. A control that exists only in a policy document is a hope; a control that is codified, versioned, tested and produces its own evidence is a fact an auditor can verify.

Chapter 8 makes risk classification executable: Articles 5, 6 and 50 and Annex III become rules that every proposed system passes before it receives resources, and again whenever it changes. Chapter 9 builds AI governance as code on that foundation: policies in a policy language, approvals as merged changes, exceptions with owners and expiry dates, and a control loop that detects drift. Chapter 10 addresses transparency, measured fairness and effective human oversight. Chapter 11 assembles documentation, logs and test results continuously into evidence that serves conformity assessment, supervision and internal audit alike.

What you will learn in this part:

• How to express AI risk classification as code, triggered by change
• How to codify policies, approvals and exceptions and keep them in step with the systems they govern
• How to satisfy Articles 13, 14 and 50 of the AI Act in practice
• How to build an evidence chain without a documentation sprint before each review

Security engineering for AI systems lies outside the scope of this book; this part summarises it only where a governance decision depends on a security control.