Part 3 — Mitigating by Category

Mitigation is not generic. Each category fails for its own reason, so each has its own controls — and applying the wrong one is how projects end up carefully managing the risk that wasn’t going to hurt them.

Strategic & business case

Tie the project to one measurable business outcome before funding it. Name a single accountable sponsor. Be willing to kill or pivot at the first stage gate if the business case doesn’t hold, because the earlier you stop, the cheaper it is.

Data

Run a data-readiness audit before the build starts. Assign a data owner per source. Document lineage, and the consent basis for any personal data the project uses.

Technical & model

Require human-in-the-loop review for high-stakes decisions until accuracy is proven. Set up drift monitoring and a rollback plan before go-live. Avoid single-vendor lock-in on core model infrastructure where you can.

Governance & compliance

Map the project against EU AI Act risk tiers and GDPR early, not during an audit. Keep a decision log — who approved what, and why. Assign an accountable owner for every model in production, not just for the project. This is where the AI Governance Playbook Series does the deeper work.

Organizational & change

Budget change management as its own workstream, not an afterthought bolted on at rollout. Involve end users in design, not only in testing. Redesign roles and communicate them before go-live, not after.

Vendor & third-party

Negotiate data-usage and exit clauses before signing. Keep a fallback vendor or an in-house option for anything mission-critical. Review a vendor’s AI-safety and security posture, not just their price.

Ethical & reputational

Test for biased or inconsistent outputs across user segments before launch. Publish a simple internal AI-use policy. Have a pre-approved response plan for a visible AI failure, so the first conversation about it isn’t improvised in public.

The controls that matter most are usually the ones nobody owns yet. Part 4 assigns them.