Human oversight during development: the Three Lines of Defense model, and decommissioning governance

The three lines of defense is risk management's standard answer to "who is responsible for oversight" — and the AIGP syllabus applies it directly to AI development.

Why this matters for the AIGP exam

Scenarios describe an oversight arrangement and ask what is missing or misplaced. Knowing which line owns which duty is the answer key.

The essentials

• First line: the people who build and operate. Product and engineering teams own the risks their systems create and run the day-to-day controls — reviews, tests, monitoring. Oversight starts inside the work, not outside it.
• Second line: risk and compliance functions. They set the policies and frameworks the first line works within, challenge its risk assessments, and track that controls actually operate.
• Third line: internal audit. Independent assurance to the board that the first two lines work as claimed. Independence is the defining property — a team cannot audit its own controls.
• The model's failure mode is blurring. When the second line starts doing the first line's control work, or audit gets drawn into design, independence quietly disappears; exam questions probe exactly this.
• Decommissioning belongs in the oversight scope: retiring a system needs sign-off, data disposition and user transition, with each line playing its usual part.

What the exam asks

Assign a described responsibility to its line, and spot arrangements that compromise independence.

Going deeper

This page is the condensed version. The full topic — with the detail above expanded and practice questions attached — is in the app, inside Domain III. Domain I, a quarter of the course, is free.

Start studying free

Back to the AIGP study guide.

AI Governance Study is an independent study aid. It does not represent a government entity: it is not affiliated with, endorsed by or authorised by any government, government agency or regulatory authority, and it does not provide government services or legal advice. Laws and frameworks are described in our own words — the official texts are listed at official sources. It is also not affiliated with, endorsed by, or sponsored by the IAPP. The AIGP name is used only to identify the exam this material helps you prepare for.