In AI governance, how do policies differ from procedures?

In AI governance, how do policies differ from procedures?

• A. Procedures provide high-level direction; policies detail step-by-step implementation.
• B. Policies provide high-level direction; procedures detail step-by-step implementation.
• C. Procedures and policies are the same.
• D. Procedures are for technical specs; policies are for governance structure.

Answer: (B)

The main idea here is that policies set the big-picture direction in AI governance, while procedures spell out the exact steps to put that direction into action. A policy articulates the organization's principles and intent—what it aims to achieve and how it will approach issues like ethics, risk, and privacy. It’s typically broad and relatively stable. Procedures, in contrast, turn those principles into concrete, step-by-step instructions: who does what, in what order, what tools or forms to use, where to document things, and when to escalate or review. For example, a policy might require that every AI system undergo an ethical risk assessment before deployment. The procedure would detail the specific workflow: which people fill out the assessment, which criteria to score, how to record results, where to file the documentation, who approves the release, and the timeline for each step. That separation—policy as direction, procedure as implementation—is exactly what the correct choice expresses. The other options mix up this relationship or describe it inaccurately: reversing the direction (procedures guide high-level policy), saying they are the same, or defining procedures as only technical specs while policies govern structure.

The main idea here is that policies set the big-picture direction in AI governance, while procedures spell out the exact steps to put that direction into action. A policy articulates the organization's principles and intent—what it aims to achieve and how it will approach issues like ethics, risk, and privacy. It’s typically broad and relatively stable. Procedures, in contrast, turn those principles into concrete, step-by-step instructions: who does what, in what order, what tools or forms to use, where to document things, and when to escalate or review.

For example, a policy might require that every AI system undergo an ethical risk assessment before deployment. The procedure would detail the specific workflow: which people fill out the assessment, which criteria to score, how to record results, where to file the documentation, who approves the release, and the timeline for each step. That separation—policy as direction, procedure as implementation—is exactly what the correct choice expresses.

The other options mix up this relationship or describe it inaccurately: reversing the direction (procedures guide high-level policy), saying they are the same, or defining procedures as only technical specs while policies govern structure.