AI治理：从原则到落地 Governing AI: From Principles to Practice

Let me get technical, because the risk is technical. Modern AI doesn't fail like software. A large language model that's wrong doesn't crash — it answers fluently, confidently, and wrong. Hallucination isn't a bug you patch; it's a property you manage: retrieval grounding so answers cite real sources, evaluation sets so you notice regressions, and regression testing every time the model or the prompt changes. And once you give a model tools and autonomy — agents, workflows — you multiply the value and the blast radius.

So the boundary between "AI-assisted" and "AI-decided" is not a philosophy question. It's a consequence question. Three lines I'd draw. One: tier by consequence. Drafting and summarizing flow free. Anything that moves money, touches health, or carries legal weight gets a named human owner. Two: checkpoints live inside the workflow, not inside a memo. Every AI output should carry three fields — who owns it, what data fed it, which human reviewed it. Three: the signature transfers liability to a person. That's not overhead; that's the feature.

Full disclosure: your host from Tongwei handed me an AIPM demo account at dinner last night and said, "Try to break the governance layer." Three hours later I gave up — every output has an owner, a status, an audit trail. I came here for a quiet conference and got peer-reviewed by a workflow engine. That's the most backhanded product pitch I have ever enjoyed — and it worked.

US and China, briefly — two laboratories, two philosophies. In the US, governance is market-driven: NIST's AI Risk Management Framework is voluntary, but procurement makes it mandatory in practice — no red-team report, no enterprise deal. In China, it's license-driven: under the 2023 interim measures for generative AI, services pass security assessment and file for record before launch — assessment first, go-live second. "Ship and show me" versus "file and then ship." Different roads, same destination: both systems make one person indispensable — the one who signs.

In PMBOK terms, AI governance is not a new knowledge area — it's a new risk register page inside the old one. Treat AI outputs like deliverables that face a quality gate, and add the three fields Bruce named before the gate opens. Review after the gate is archaeology; review before it is governance.

Private deployment is necessary, not sufficient — I'll keep saying it, because brochures keep forgetting. Here's the technical reality: your data leaves through three doors people forget. Door one: the prompt — employees paste secrets in, and prompt logs quietly become the most sensitive database you own. Door two: the retrieval layer — a RAG index remembers everything you feed it and shows it to whoever asks the right question. Door three: the model's memory — extraction attacks have pulled verbatim training data back out of models; researchers proved this with canary strings years ago.

So real AI security governance is a stack: classify what enters the corpus, filter at the prompt door, red-team the retrieval path, log who asked what — and retain those logs like evidence, because one day they will be.

US and China treat this as infrastructure now — differently. In the US: NIST's AI RMF sets the vocabulary, the FTC brings enforcement, state privacy laws like CCPA draw lines, and SOC 2 audits do the quiet work — governance by procurement. In China: the Data Security Law and PIPL define classification duties, generative-AI services go through security assessment and filing, and an entire industry has grown around model security — companies like 360 have turned large-model security into a core business line. Two systems, one conclusion: "private deployment" is a marketing term. Governance maturity is an engineering term.

And since we're being honest tonight: last month Tongwei asked me to review their AI security governance checklist. I said, "Sure, send me a page or two." Forty pages arrived. Categorized, audited, versioned. I have never been so happy to be wrong.

Two defenses most teams skip. Data minimization — if you can't afford to leak it, don't train on it. And adversarial testing — red-team your own model before strangers do. The quiet risk is memorization: models regurgitate what they saw. AI security governance has to reach inside the model, not just around it.

Technically, the rubber stamp has a favorite habitat: aggregate metrics. A model with 95% overall accuracy can be failing a subgroup at 60% — overall accuracy hides exactly the people ethics is about. So first fix: measure fairness per subgroup — and know your metric, because demographic parity and equalized odds are different promises, and you can't keep both at once. Second: "fairness through unawareness" — deleting the sensitive attribute — doesn't work; proxies reconstruct it from the leftovers. This is why model cards and datasheets exist: write down what the model was fed and where it fails, in the open.

The human-decision question, I answer with three tests. Could the reviewer explain the recommendation in their own words? Could they say no without pressure? Would the same decision stand without the model? Any "no" — the human in the loop is decorative.

US and China handle this differently. The US runs on litigation: biased hiring algorithms get sued, the FTC calls discriminatory models unfair business, NIST publishes bias guidance — justice after deployment. China legislates upstream: algorithm recommendation rules from 2022 require filing and give users an opt-out, and since 2025 AI-generated content must carry labels — society knows when it's talking to a model. One corrects in court, the other regulates at the source. Both are answering the same question: who carries the weight when the model is wrong? My answer: AI can inform a judgment. It cannot carry one.

From the founder's seat: ethics done early is a design constraint; ethics done late is a recall notice. Small teams can't afford an ethics board — but they can afford a one-page checklist and the discipline to stop at it. And a confession: the prep pack for this panel weighs more than my first neural network.

Policies fail when they're written for auditors instead of the people doing the work. Two fixes, one boring, one expensive — take both.

Boring one: certify competence. A team improvising AI without a shared method is gambling with someone else's data. CPMAI — now part of the PMI certification family — gives everyone the same six-phase language, from business understanding to operationalization, so "who signs" stops being a debate. Certifications don't make people smart; they make them compatible.

Expensive one: put the controls inside the tools. I asked your host from Tongwei how they manage AI projects — expecting, honestly, eighty slides. Instead they opened AIPM and said, "The checkpoints are already in the workflow — go find them." Review gates, ownership fields, audit trails, embedded in every phase. As a project manager, I felt insulted — and then employed. That's what management-direction AI governance looks like: the system remembers the rules so humans can remember the judgment.

US and China, from where I stand. The US institutionalizes through the market: certification bodies, enterprise academies, customer audits — trust is built contract by contract. China institutionalizes through standards fast: national AI standardization committees, third-party evaluation institutes, filing regimes — trust is built standard by standard. Different engines, similar trajectory: in both countries, "we trained our people" is becoming a procurement question, not a slogan.

Convergence is real but slow: EU AI Act by risk class, NIST by framework, and ISO/IEC 42001 turns AI security governance into a certifiable management system. Multinationals: anchor on the international standard, map locally. One scaffold, many walls.

The gap compounds. Companies that only use AI get a one-time productivity bump. Companies that govern AI get interest on it — clean data, passing audits, reusable patterns. Governance is not a tax on innovation; it's the compounding mechanism.

Watch the tooling market too: it's shifting from "AI that does tasks" to "AI that manages work under rules" — management-oriented AI governance. Agents that assign, track, verify — workflow engines with governance built in, like the AIPM system your host keeps (not so secretly) demoing to every guest tonight. Tongwei bet its methodology on that shift before it was fashionable — which makes them either very early or very lucky. Their competitors can hope for lucky.

US and China, market view. In the US, governance became a sales weapon: enterprise buyers demand governance questionnaires, insurers are starting to price AI risk, model vendors ship "enterprise tiers" that are mostly governance features wearing a tie. In China, the game is scale and speed: a massive application market, brutal iteration cycles, and filing-ready platforms winning procurement precisely because assessment comes standard. Three years out, in both markets, the winners won't be whoever adopted AI first — they'll be whoever's AI survives an audit.

From the projects I've seen: governance-mature AI projects deliver twice — once when they ship, again at review, because there's nothing to hide. Discipline is the cheapest acceleration you can buy.