Extending established governance to emerging digital responsibilities
Context
Artificial intelligence and digital accessibility introduce important responsibilities for organizations developing, purchasing or using digital technologies.
AI systems may affect privacy, security, intellectual property, fairness, transparency, decision-making and public trust. Digital accessibility affects whether people with different abilities can use websites, applications, documents, media and digital services.
Although these areas have specialist requirements, both depend on established governance capabilities: accountability, inventories, risk classification, assessment, procurement controls, monitoring, training and evidence.
Challenge
The challenge was to develop governance for AI and accessibility without creating two additional programmes disconnected from existing privacy, data and cybersecurity structures.
For Responsible AI, the organization needed a way to:
- Identify AI systems and use cases
- Distinguish levels and types of risk
- Establish acceptable-use boundaries
- Assign ownership and approval responsibility
- Assess effects on people and the organization
- Provide meaningful human oversight
- Govern third-party AI services
- Preserve appropriate documentation
- Monitor deployed systems and respond to problems
For digital accessibility, it needed to:
- Establish organizational accountability
- Define applicable accessibility expectations
- Integrate requirements into design and procurement
- Address websites, applications, documents and media
- Support testing and remediation
- Provide feedback and escalation routes
- Develop role-specific awareness
- Monitor performance over time
Approach
I approached both areas as extensions of the wider Data Trust operating model.
Responsible AI governance
The AI-governance approach connects the complete lifecycle:
- Proposed use or acquisition
- Initial identification and registration
- Risk classification
- Proportionate impact assessment
- Approval and conditions of use
- Development or configuration
- Validation and deployment
- Human oversight
- Monitoring and incident response
- Material change or retirement
The depth of governance should respond to potential impact. A low-risk productivity use should not necessarily receive the same review as an AI system affecting important decisions, public content, protected rights or vulnerable people.
The model also recognizes that effective human oversight requires competence, information, authority and sufficient opportunity to challenge an AI-supported result.
Digital accessibility governance
The accessibility approach integrates responsibility throughout the digital lifecycle:
- Strategy and policy
- Product and service planning
- Procurement and supplier selection
- Design
- Development
- Content creation
- Conformance testing
- Publication or release
- User feedback
- Remediation and continuous monitoring
This shifts accessibility from a late-stage technical test to an organizational responsibility shared by product owners, procurement teams, designers, developers, content creators and governance functions.
Shared Data Trust foundations
Both programmes draw on common capabilities:
- Governance bodies and escalation routes
- Policies and standards
- System and activity inventories
- Risk and impact assessments
- Third-party requirements
- Control ownership
- Evidence and documentation
- Training and competence
- Monitoring and reporting
- Incident and issue management
- Continuous improvement
Specialist requirements remain visible, while shared mechanisms reduce unnecessary duplication.
My contribution
My contribution has included:
- Defining the governance direction for Responsible AI and accessibility
- Connecting both areas with the existing Data GRC operating model
- Developing accountability and lifecycle principles
- Establishing risk-based assessment concepts
- Connecting AI with privacy, security, data governance and digital rights
- Integrating accessibility into procurement, design and content responsibilities
- Developing policy and operational requirements
- Identifying documentation and evidence expectations
- Supporting role-based training and awareness
- Promoting proportionate and human-centred governance
Outcome
The approach created a structured basis for addressing emerging digital responsibilities through established governance foundations.
It enabled:
- Clearer ownership of AI and accessibility responsibilities
- Earlier identification of risks and requirements
- More proportionate review of AI use cases
- Better integration of accessibility into the digital lifecycle
- Stronger connections with privacy, cybersecurity and procurement
- More consistent documentation and evidence
- A foundation for monitoring and continuous improvement
- Reduced dependence on disconnected policy-only responses
The programmes are designed to evolve as technology, standards, regulation and organizational practice develop.
Disciplines connected
- Responsible AI
- Digital Accessibility
- Data Protection and Privacy
- Data Governance
- Cybersecurity Compliance
- Digital Rights
- Third-Party Governance
Transferable lesson
Emerging governance responsibilities should build on mature organizational capabilities while preserving the specialist expertise each discipline requires.