Q115 - Why_is_GenAI_harder_to_govern_than_traditional_systems

Q115 — Why is GenAI harder to govern than traditional systems?

← RAIDT · Star S1 - Origins, Background and History · primary item: S1.09 · Runtime configuration

Appears in sources
Answer

GenAI is harder to govern than traditional systems because the main governance problem sits at the level of configured use, not only at the level of the approved model, policy, or lifecycle control. The papers argue that GenAI behaviour is materially shaped at run time through prompts, retrieved context, tools, adapters, alignment layers, safety settings, and review actions. As a result, two uses of the same model can produce different outputs, different risk exposures, and different accountability questions even when the organisation?s formal policy is unchanged. Traditional governance artefacts are therefore necessary but insufficient: they describe what should happen in general, but often cannot reconstruct what did happen in one contested output.

RAIDT responds by treating the run as the unit of governance and by requiring a run-level evidence pack for each material use. This matters because GenAI is unusually sensitive to micro-level configuration changes, and those changes are governance-relevant. In RAIDT terms, prompts, retrieval, tool use, PEFT or LoRA adapters, and preference-based alignment are not merely engineering choices; they operate as influence methods as governance interventions because they shape both behaviour and the evidence available for later review. Governance must therefore move from narrative assurance towards reconstructable proof.

This is also why GenAI governance is broader than explainability alone. The five pillars (Responsibility, Auditability, Interpretability, Dependability, Traceability) require organisations to show not only what the system output meant, but whether the output was appropriate, reviewable, stable across runs, and traceable to sources, versions, and checks. The run-level evidence pack supports this, and the resulting score profile makes governance readiness inspectable through anchors 1=missing / 3=partial / 5=audit-ready. In short, GenAI is harder to govern because its risk is dynamic, socio-technical, and configuration-dependent at the moment of use.

Practical example

Consider a public-service eligibility assistant that drafts advice for a benefits officer. A traditional rules system would usually be governed through approved logic, documented rules, and audit. A GenAI assistant is harder to govern because one answer may depend on the exact prompt template, which policy passages were retrieved, whether a search tool was enabled, what safety setting was active, and whether a supervisor reviewed the draft before it was sent. If a claimant later challenges the advice, a general AI policy or model card will not explain the outcome.

Under RAIDT, the organisation would preserve a run-level evidence pack containing the prompt version, retrieval snapshot, tool outputs, model and adapter identifiers, output, and reviewer decision. That run can then be assessed across the five pillars (Responsibility, Auditability, Interpretability, Dependability, Traceability) and given a score profile. If the retrieval record is absent or the review step is unclear, the run will fall short of anchors 1=missing / 3=partial / 5=audit-ready. The example shows why governance depends on the run as the unit of governance, rather than on abstract policy alone.

Sources in RAIDT papers
Powered by Forestry.md