Governance, Portfolio Management, Ethics and Compliance

Introduction

Information technology projects and products operate within systems of authority, accountability, risk, law and organisational strategy. A technically successful system may still be a managerial failure if it violates privacy, excludes users with disabilities, creates unacceptable environmental harm, or delivers benefits that do not support organisational objectives. Governance provides the structures through which such concerns are converted into decisions, controls and assurance.

Project governance concerns how a particular initiative is directed, monitored and controlled. Product governance extends this concern across the product life cycle, including discovery, development, release, operation, evolution and retirement. Portfolio management considers the collection of projects and products as an investment system rather than as isolated activities. Ethics and compliance establish boundaries and principles for responsible action. Together, these disciplines help organisations decide not only whether work can be done, but whether it should be done and under what conditions.

This chapter treats governance as an enabling capability rather than a bureaucratic approval layer. Effective governance makes decision rights explicit, aligns investments with strategy, exposes risk early, protects affected stakeholders and supports learning. Ineffective governance either becomes ceremonial—approving everything without meaningful challenge—or excessively centralised, slowing delivery and encouraging informal workarounds.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Distinguish corporate, IT, project, product and portfolio governance.
2. Design decision rights, escalation routes, stage gates and assurance mechanisms.
3. Prioritise portfolios using strategic value, risk, capacity, dependencies and benefits.
4. Explain benefits realisation, dependency management and portfolio balancing.
5. Apply privacy, accessibility, sustainability, responsible-innovation and compliance principles.
6. Analyse ethical dilemmas involving data, algorithms, suppliers and affected communities.
7. Evaluate governance arrangements in a complex IT project or product case.

1. Governance as a System of Direction and Control

Governance is the exercise of authority to set direction, make decisions, oversee performance and ensure accountability. Management, by contrast, is primarily concerned with planning and executing activities within the authority established by governance. The distinction is useful but not absolute: in small organisations one person may perform both roles, whereas in a large enterprise they are deliberately separated.

A governance system normally answers six questions:

• Purpose: What organisational or public value is being pursued?
• Authority: Who may decide, approve, spend, accept risk or stop work?
• Evidence: What information must support a decision?
• Control: What constraints, policies and tolerances apply?
• Assurance: How will the organisation know that claims are credible?
• Accountability: Who is answerable when outcomes differ from expectations?

Governance should be proportional. A low-risk internal application does not require the same approval structure as a medical, financial or national-security system. Proportionality does not mean ignoring controls; it means matching control intensity to potential harm, uncertainty, irreversibility and regulatory exposure.

Levels of governance

These levels should be connected. For example, a product team may choose a cloud service, but enterprise architecture may constrain data location; a product manager may prioritise a feature, but portfolio governance may defer it because another initiative has greater strategic value or consumes the same scarce specialists.

2. Decision Rights and Accountability

Decision rights specify who has authority to make a decision, who provides advice, who performs the work and who must be informed. Ambiguous decision rights produce delay, duplicated analysis and political escalation. Excessively fragmented rights produce local optimisation: every team improves its own result while the portfolio deteriorates.

A practical decision-rights model may classify decisions as follows:

• Strategic decisions: investment themes, risk appetite, major partnerships and termination of material initiatives.
• Portfolio decisions: prioritisation, funding allocation, sequencing and capacity balancing.
• Product decisions: customer outcomes, roadmap, release scope and product policies.
• Delivery decisions: design choices, iteration plans, work allocation and operational remediation.
• Control decisions: security exceptions, privacy risk acceptance, regulatory interpretation and audit responses.

A RACI matrix can clarify roles: Responsible performs the work; Accountable owns the outcome and decision; Consulted contributes expertise; Informed receives the result. RACI is useful for mapping responsibilities, but it does not by itself resolve conflicts, define competence or establish a valid approval. A single decision should normally have one clearly accountable role, even though several people may be responsible or consulted.

Governance bodies

A typical arrangement may include:

• Executive sponsor: owns the business case, provides organisational support and remains accountable for intended benefits.
• Steering committee: resolves escalated issues, approves major changes and tests continued viability.
• Portfolio board: compares initiatives and allocates scarce capital or specialist capacity.
• Product council: coordinates product strategy, customer evidence, architecture and lifecycle decisions.
• Design authority: reviews technical coherence, standards, interoperability and exceptions.
• Risk, privacy or ethics committee: scrutinises high-impact uses of data and automation.
• Independent assurance: evaluates whether plans, controls, forecasts and evidence are reliable.

Committees should have a defined mandate, quorum, decision calendar, escalation thresholds and recorded decisions. A meeting without decision rights, evidence requirements or follow-up ownership is an information exchange, not governance.

3. Stage Gates and Assurance

A stage gate is a deliberate decision point at which an initiative is assessed before progressing to the next level of commitment. Gates are not necessarily waterfall phases. They can be used with agile delivery, provided that evidence is reviewed incrementally and approval does not become a one-time prediction exercise.

A risk-sensitive life-cycle gate model might include:

1. Concept gate: Is the problem important, legitimate and sufficiently understood?
2. Discovery or feasibility gate: Is there credible evidence of user need, feasibility, affordability and compliance?
3. Investment gate: Is the expected value justified relative to alternatives and risk?
4. Build or minimum viable product gate: Is the solution safe enough for controlled validation?
5. Deployment gate: Are security, privacy, accessibility, operational readiness and support arrangements adequate?
6. Scale gate: Has evidence demonstrated that wider deployment will produce value without disproportionate harm?
7. Retirement gate: Can the product be withdrawn while preserving records, continuity and stakeholder rights?

Each gate should define entry evidence, decision options and exit conditions. The options should include proceed, proceed with conditions, defer for evidence, redirect, and stop. A gate that permits only approval encourages sunk-cost reasoning.

Assurance mechanisms

Assurance is confidence based on independent, competent and proportionate examination. It may include:

• peer review and architecture review;
• financial and commercial review;
• security testing and threat modelling;
• privacy impact assessment;
• accessibility testing with disabled users;
• model validation and bias evaluation for AI systems;
• operational readiness and resilience testing;
• supplier due diligence;
• audit, compliance review and post-implementation evaluation.

Assurance differs from quality control. Quality control is often performed by the delivery team to detect defects; assurance provides confidence to decision-makers that governance, controls and evidence are adequate. Independence should be calibrated: a reviewer need not be external, but should not be evaluating work for which they are personally accountable without safeguards.

4. Portfolio Management: From Projects to Investment Choices

A portfolio is a collection of projects, programmes, products and operational investments managed together to achieve strategic objectives. Portfolio management is not simply ranking projects by estimated return. It is a constrained optimisation problem involving value, risk, timing, dependencies, capacity, regulatory necessity and uncertainty.

Strategic alignment and investment categories

Organisations commonly divide investments into categories such as:

• Run: maintain reliable operations and meet mandatory obligations.
• Grow: improve existing products, customers or capabilities.
• Transform: create new business models or organisational capabilities.
• Protect: reduce cyber, legal, safety, continuity or reputational exposure.

A portfolio with only transformation initiatives may be strategically exciting but operationally fragile. A portfolio with only run investment may be stable in the short term but lose competitiveness. Portfolio balance therefore matters as much as the score of any individual proposal.

Prioritisation criteria

A transparent prioritisation model can score initiatives against weighted criteria. Let initiative i have criterion scores s_ij and criterion weights w_j. A weighted score is:

where m is the number of criteria, w_j ≥ 0, and the weights are commonly normalised so that ∑w_j = 1. Scores must use a defined scale, such as 0–5, and the same interpretation must be applied across initiatives. The score is a decision aid, not an objective truth. It can conceal political preferences, double-count related criteria or create false precision.

Typical criteria include strategic contribution, customer or public value, urgency, regulatory necessity, risk reduction, feasibility, cost, sustainability and dependency enablement. Mandatory compliance work should not be forced into a commercial-value ranking where failure to undertake it creates unacceptable exposure; it may require a separate mandatory track.

Risk-adjusted value

Where uncertainty is material, expected value can be used cautiously. If an initiative has possible outcomes V_k with probabilities p_k, its expected monetary value is:

with p_k ≥ 0 and ∑p_k = 1. The values and probabilities must refer to the same decision horizon and monetary basis. EMV is not a prediction of what will happen; it is a probability-weighted decision measure. It can be misleading when outcomes involve non-financial harms, deep uncertainty, or low-probability catastrophic events. Such cases require risk limits and scenario analysis in addition to EMV.

A simple value-to-cost ratio is:

where B_i is comparable expected benefit and C_i is total relevant cost for initiative i. This ratio is appropriate only when benefits and costs are measured consistently and when divisibility and dependencies do not distort the comparison. A low-cost initiative with a high ratio may still be less important than a strategically necessary initiative with a lower ratio.

Capacity and dependencies

Portfolio decisions must reflect scarce skills, supplier limits, technology platforms, data availability and organisational change capacity. Dependencies may be:

• Finish-to-start: one activity must finish before another begins.
• Shared-resource: initiatives require the same scarce team or specialist.
• Technical: one product requires an interface, platform or data service.
• Regulatory or external: delivery depends on legislation, certification or a partner.
• Outcome dependency: benefits from one initiative depend on adoption or process change enabled by another.

A dependency register should identify the owner, required date, affected initiatives, consequence of failure and mitigation. Portfolio boards should examine the dependency network, not merely each business case in isolation. Sequencing can reduce risk, but it can also create excessive waiting and encourage large batches. Incremental interfaces, temporary decoupling and explicit capacity reservations are often better solutions.

5. Benefits Management and Value Realisation

A deliverable is something produced; an outcome is a change in capability, behaviour or condition; a benefit is a measurable improvement resulting from that change. For example, a new case-management system is a deliverable, faster case handling is an outcome, and reduced waiting time or improved service quality is a benefit.

Benefits management should define:

1. the benefit and its relationship to strategic objectives;
2. the baseline and target measure;
3. the owner who can influence realisation;
4. the enabling changes required;
5. the measurement method and time horizon;
6. disbenefits, risks and distributional effects;
7. the review date and action if benefits do not emerge.

A benefits map links investment to capabilities, outcomes and strategic objectives. It prevents the common error of declaring success when a system is delivered even though users do not adopt it or the intended organisational change does not occur.

Benefits may be financial, operational, social, regulatory, environmental or reputational. They may also be unevenly distributed. A system that saves organisational cost by transferring effort to citizens, contractors or unpaid carers should not be described simply as beneficial. Distributional analysis is part of responsible portfolio management.

6. Ethics, Privacy and Responsible Innovation

Compliance establishes minimum obligations; ethics asks what responsible conduct requires even where the law is silent or ambiguous. Ethical governance is especially important where digital systems influence access to employment, credit, education, health care, public services or personal identity.

Ethical principles

Common principles include:

• Respect for autonomy: people should understand significant uses of their data and retain meaningful choice where possible.
• Beneficence: technology should contribute to legitimate benefit.
• Non-maleficence: foreseeable harm should be prevented or reduced.
• Justice and fairness: burdens and benefits should not be distributed arbitrarily or discriminatorily.
• Accountability: identifiable people and institutions must answer for decisions.
• Transparency and explainability: affected people should receive an understandable account of relevant processes and grounds for challenge.
• Proportionality: intrusion and control should be justified by the legitimate objective.

These principles may conflict. Complete transparency can expose security-sensitive information; personalisation may improve service but increase surveillance; fraud controls may reduce losses while producing unequal false positives. Ethical reasoning therefore requires documenting trade-offs, affected groups, alternatives and residual risks.

Privacy by design

Privacy should be addressed from conception rather than added after deployment. Important practices include purpose limitation, data minimisation, retention limits, access control, encryption, pseudonymisation where appropriate, secure deletion, data-quality management and rights handling. A privacy impact assessment should identify data flows, purposes, legal or policy bases, affected people, risks, mitigations and residual issues.

Consent is not a universal solution. It may be invalid where there is a power imbalance, where refusal is not realistic, or where people cannot reasonably understand downstream uses. Governance must also address secondary use, inference, re-identification and data sharing with suppliers.

Accessibility and inclusion

Accessibility means that people with diverse abilities can perceive, understand, navigate and use a product or service. It includes visual, auditory, motor, cognitive and speech-related needs, as well as temporary and situational limitations. Accessibility should be designed into requirements, procurement, interaction design, testing and support.

Conformance to a recognised accessibility standard is valuable but insufficient. Real users should participate in testing, and alternative service channels should exist where digital access cannot be assumed. Accessibility defects can become legal, operational and ethical failures, particularly when a service is essential.

Sustainability

IT sustainability includes energy and water use, carbon emissions, hardware manufacture, electronic waste, supply-chain labour, repairability and data-centre impacts. Portfolio governance should examine whole-life effects rather than only acquisition price. Relevant questions include whether computation or storage can be reduced, whether equipment can be reused, whether suppliers disclose environmental information, and whether a product creates unnecessary consumption.

7. Regulation, Compliance and Professional Ethics

Compliance management translates applicable law, regulation, contracts, standards and internal policy into obligations, controls and evidence. A compliance register should identify the requirement, responsible owner, affected process or system, control, evidence, review date and consequence of non-compliance.

Different jurisdictions regulate privacy, cybersecurity, records, intellectual property, accessibility, financial services, employment, health and AI differently. Project leaders must therefore avoid assuming that a generic checklist constitutes legal compliance. Legal and specialist advice is required where interpretation is uncertain.

A mature compliance approach follows a cycle:

1. identify applicable obligations and scope;
2. interpret obligations into specific controls;
3. assign accountable owners;
4. implement and test controls;
5. retain reliable evidence;
6. monitor changes and exceptions;
7. report, remediate and learn from incidents.

Professional ethics requires competence, honesty, confidentiality, avoidance of conflicts, respect for affected people and willingness to escalate unsafe or unlawful practices. A professional should not hide a material risk because disclosure may threaten a deadline. Nor should a governance process be used to shift responsibility: approval by a committee does not excuse knowingly misleading evidence.

8. AI and Automated Decision Governance

AI systems introduce distinctive governance concerns because performance may vary across populations and contexts, training data may encode historical inequity, outputs may be difficult to explain, and responsibility may be distributed across vendors and users.

An AI governance process should address:

• intended use and prohibited use;
• data provenance, quality, representativeness and lawful basis;
• performance by relevant subgroup, not only aggregate accuracy;
• human oversight, intervention and appeal;
• security, robustness, drift and monitoring;
• model and prompt documentation;
• supplier transparency and contractual rights;
• incident response and retirement criteria.

A model should not be deployed merely because it performs better on an average metric. False-positive and false-negative consequences may differ substantially. In high-impact contexts, a human reviewer must have adequate authority, time, training and information; nominal human involvement is not meaningful oversight if the reviewer simply accepts automated recommendations.

9. An Illustrative Case: A Public Benefits Eligibility Platform

Background

A fictional regional government proposes a platform that uses data integration and machine-learning risk scores to identify applications for additional review. The portfolio board expects reduced processing time, lower fraud and improved consistency.

Problem

The proposal has a strong financial case but presents risks. Historical data reflect unequal access to services. Some applicants have limited digital access. A supplier will host sensitive information, and the model’s output is difficult for caseworkers to interpret. The project team initially defines success as deployment within twelve months.

Analysis

The governance review separates deliverables, outcomes and benefits. Deployment is a deliverable; faster processing is an outcome; improved timeliness and appropriate fraud reduction are benefits. It also identifies potential disbenefits: wrongful delays, exclusion of people with disabilities, increased staff workload caused by unexplained alerts, and loss of trust.

A privacy and algorithmic-impact assessment maps data sources, retention, access, suppliers and decision points. The team discovers that several proposed variables are proxies for protected characteristics or socioeconomic disadvantage. Legal advisers require a lawful basis, strict purpose limitation and a route for human review and appeal. Accessibility specialists identify that the proposed application journey is incompatible with assistive technologies.

Approach and solution

The board refuses unrestricted deployment and approves a staged pilot with conditions:

• the model may prioritise cases for review but may not make the final eligibility decision;
• affected applicants receive notice and a route to challenge relevant decisions;
• subgroup performance and error patterns are monitored;
• sensitive variables and unjustified proxies are removed or controlled;
• the service provides accessible digital and non-digital channels;
• supplier contracts specify security, audit access, incident notification and deletion;
• an independent review occurs before scale-up;
• benefits are measured against a pre-deployment baseline, including distributional effects.

The portfolio board also funds process redesign and staff training, recognising that technology alone cannot produce the intended outcome.

Outcome

The pilot shows a modest reduction in processing time but no reliable reduction in fraud. One subgroup experiences higher false-positive referral rates. The board therefore pauses scale-up, changes the review threshold and investigates the data-quality problem. Although the initial schedule is missed, the organisation avoids embedding an unfair process at scale.

Learning points

The case demonstrates that governance is not an obstacle to innovation. It changes the innovation from an opaque automated decision system into a controlled decision-support service. It also shows why benefit ownership, independent assurance, accessibility, privacy and appeal mechanisms must be designed together rather than treated as separate compliance tasks.

10. Challenges and Limitations

Governance can fail in several ways. Ceremonial governance produces documents and meetings without challenge. Over-governance creates delays, excessive reporting and incentives to conceal problems. Metric fixation encourages teams to optimise measured indicators while harming unmeasured outcomes. Sunk-cost bias makes termination psychologically difficult. Power asymmetry may silence users, junior staff or affected communities. Vendor dependence can limit auditability and switching. Fragmented accountability allows each actor to claim that another actor owns the problem.

Scoring models also have limitations. Criteria may be correlated, uncertain estimates may be presented as precise, and strategic value may not be additive. Portfolio decisions should therefore combine quantitative analysis with expert judgement, scenario testing, sensitivity analysis and explicit ethical deliberation.

Governance should be treated as adaptive. Decisions should be revisited when assumptions change, evidence contradicts the business case, regulation changes, incidents occur or affected stakeholders report unexpected harm. A well-designed stop or redirect decision is evidence of control, not necessarily failure.

11. Contemporary Best Practices

Effective organisations increasingly adopt the following practices:

• establish a small number of clear decision rights and escalation thresholds;
• integrate privacy, security, accessibility, sustainability and ethics into discovery and procurement;
• use incremental gates with evidence rather than one large approval event;
• maintain a live portfolio view of value, risk, capacity, dependencies and benefits;
• assign benefit owners outside the delivery team when operational change is required;
• distinguish mandatory compliance investment from discretionary value ranking;
• require transparent assumptions and confidence levels in business cases;
• involve affected users and communities, especially those at risk of exclusion;
• maintain auditable decision records and exception registers;
• provide safe channels for professional dissent and whistleblowing;
• monitor products after release, including unintended effects and subgroup outcomes;
• retire products responsibly, preserving continuity, records and user rights.

Chapter Summary

Governance establishes authority, accountability, evidence and control across IT projects, products and portfolios. Project governance directs a defined initiative; product governance manages continuing value across a life cycle; portfolio governance selects and balances investments under constraints. Decision rights, RACI responsibilities, stage gates and independent assurance make governance actionable.

Portfolio management requires more than ranking business cases. It must consider strategic alignment, mandatory obligations, risk, uncertainty, capacity, dependencies, timing and portfolio balance. Benefits management connects deliverables to outcomes and measurable value, while recognising disbenefits and unequal effects.

Ethical and compliant technology requires privacy by design, accessibility, sustainability, responsible use of AI, professional integrity and evidence-based oversight. Compliance sets minimum obligations, whereas ethics guides responsible choices where rules are incomplete or competing. Effective governance is proportionate, adaptive and willing to defer, redirect or stop work when evidence or stakeholder impact warrants it.

Key Terms

Assurance: Independent or suitably objective examination that provides confidence in governance, controls and evidence.

Accessibility: Design that enables people with diverse abilities to use a product or service.

Benefits realisation: The structured process of achieving and measuring intended improvements from an investment.

Business case: Evidence-based justification for undertaking an investment.

Compliance register: A record linking obligations to owners, controls, evidence and review dates.

Decision rights: Explicit authority to make, approve, reject or escalate decisions.

Dependency: A relationship in which one initiative, activity or outcome relies on another.

Ethics: Principles concerning responsible conduct, harm, fairness and obligations to stakeholders.

Gate: A formal decision point at which evidence is reviewed before further commitment.

Governance: Direction, oversight, accountability and control of an organisation or initiative.

Portfolio: A coordinated collection of investments managed to achieve strategic objectives.

Privacy by design: Incorporating privacy protection into system conception, design and operation.

Product governance: Direction and oversight of a product throughout its life cycle.

RACI: A responsibility model identifying Responsible, Accountable, Consulted and Informed roles.

Responsible innovation: Innovation that anticipates consequences, includes affected stakeholders and addresses risks proactively.

Risk appetite: The level and type of risk an organisation is willing to accept in pursuit of objectives.

Stage gate: A structured review used to decide whether and how an initiative proceeds.

Sustainability: Management of environmental, social and economic effects across the technology life cycle.

Value realisation: Achievement of intended strategic, financial, operational or social value.

Review Questions

Short Answer Questions

1. What is the difference between governance and management?
2. Identify four typical decision levels in an IT portfolio.
3. What purposes do stage gates serve?
4. Why should benefits be distinguished from deliverables?
5. Explain the difference between compliance and ethics.

Long Answer Questions

1. Explain how decision rights, escalation thresholds and assurance mechanisms can be designed for a large digital product.
2. Discuss the advantages and limitations of weighted portfolio-scoring models.
3. Analyse how dependencies and scarce specialist capacity affect portfolio sequencing.
4. Explain how privacy, accessibility and sustainability can be integrated into the technology life cycle.
5. Discuss the governance requirements for high-impact AI-assisted decision systems.

Analytical / Application Questions

1. An organisation has funding for only three of eight proposed initiatives. Design a prioritisation approach that addresses strategic value, mandatory compliance, risk, capacity, dependencies and uncertainty.
2. A product has met its delivery schedule but adoption is low and one user group reports exclusion. Recommend a governance response, including evidence, decision rights, benefits review and possible gate outcomes.
3. Evaluate the public benefits eligibility case in this chapter. Identify two ethical tensions, two compliance or assurance requirements and three measures that should be monitored before scale-up.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes portfolio governance from project governance?

A. Portfolio governance focuses only on technical architecture.

B. Portfolio governance coordinates investment choices across initiatives, while project governance directs a specific initiative.

C. Portfolio governance replaces all project-level decision-making.

D. Portfolio governance applies only after projects have been completed.

Correct Answer: B. Portfolio governance coordinates investment choices across initiatives, while project governance directs a specific initiative.

Question 2

What is the principal purpose of a stage gate?

A. To guarantee that a project will succeed.

B. To prevent iterative delivery methods from being used.

C. To review evidence and decide whether and how an initiative should proceed.

D. To transfer accountability from the sponsor to the delivery team.

Correct Answer: C. To review evidence and decide whether and how an initiative should proceed.

Question 3

In a RACI model, which role is answerable for the outcome or decision?

A. Responsible

B. Accountable

C. Consulted

D. Informed

Correct Answer: B. Accountable

Question 4

If criterion weights sum to 1 and an initiative scores 4 on a criterion weighted 0.25, what is that criterion’s contribution to its weighted score?

A. 0.25

B. 1

C. 4.25

D. 16

Correct Answer: B. 1

Question 5

Which item is an outcome rather than a deliverable?

A. A newly deployed case-management system

B. A signed supplier contract

C. Reduced average case-processing time

D. A completed training manual

Correct Answer: C. Reduced average case-processing time

Question 6

Why can expected monetary value be insufficient for some technology decisions?

A. It cannot use probabilities.

B. It ignores all costs by definition.

C. It may inadequately represent non-financial harm, deep uncertainty or catastrophic outcomes.

D. It is valid only for projects with no risks.

Correct Answer: C. It may inadequately represent non-financial harm, deep uncertainty or catastrophic outcomes.

Question 7

Which practice most directly supports privacy by design?

A. Collecting all potentially useful data indefinitely

B. Deferring privacy assessment until after deployment

C. Applying purpose limitation, data minimisation and retention controls from conception

D. Treating consent as a substitute for every other privacy control

Correct Answer: C. Applying purpose limitation, data minimisation and retention controls from conception

Question 8

What is a major limitation of a portfolio scoring model?

A. It makes criteria explicit.

B. It can create false precision and conceal correlated or uncertain judgments.

C. It supports comparison among initiatives.

D. It can include strategic and risk criteria.

Correct Answer: B. It can create false precision and conceal correlated or uncertain judgments.

Question 9

In the illustrative AI case, why was unrestricted deployment rejected?

A. The system had no possible operational benefit.

B. The project exceeded its schedule before the pilot began.

C. The system created unresolved fairness, privacy, accessibility and accountability risks.

D. The supplier refused to provide any hosting service.

Correct Answer: C. The system created unresolved fairness, privacy, accessibility and accountability risks.

Question 10

Which statement best describes meaningful human oversight of a high-impact AI system?

A. A human is nominally present but must accept every model recommendation.

B. A human has authority, information, competence and time to review and challenge outputs.

C. The model is hidden from all users to prevent disagreement.

D. Human oversight is unnecessary when aggregate accuracy is high.

Correct Answer: B. A human has authority, information, competence and time to review and challenge outputs.