Módulo 7: Building a Responsible AI Framework
Governance light: realistic for small teams
Descripción
Frameworks come from corporates. Startups have 5-50 people. Governance enterprise in startup = bottleneck, abandonment, frustration.
Esta cápsula te enseña governance light: mínimo viable que funciona realmente en team chico.
Al terminar vas a poder:
- Diseñar estructura de governance proporcionada a tu team size
- Evitar enterprise overhead que mata startups
- Escalar governance gradualmente con company growth
El problema con enterprise governance
Standard governance models asumen:
- 200+ employees
- Multiple roles (CISO, Chief AI Officer, dedicated compliance team)
- Months-long approval cycles
- Multiple committees
Para startup: literally imposible. Hasta dañino:
- Slows shipping critical
- Creates "compliance theater" (process, no substance)
- Demotivates team
- Misses point: governance debe enable, no block
Tres principios de governance light
Principio 1: Concentration of responsibility
En team de 5-15, una persona asume "AI Steward" role. Generalmente Tech Lead.
Sus responsabilidades:
- Owns the Responsible AI Framework
- Triggers review processes
- Final sign-off on ethics decisions (with escalation if uncertain)
- Liaison con DPO/legal counsel
Beneficio: clarity de quién decide. Risk: bottleneck si overloaded. Mitigación: escalation paths claros.
Principio 2: Embed in existing processes
Don't create new meetings. Add ethics to existing processes:
- Sprint planning → reserve 1 hour quarterly para ethics review
- Code review → include ethics checklist verification
- Release planning → ethics review is a release gate
- Post-mortems → include ethics implications question
Beneficio: no extra calendar burden.
Principio 3: Documentation as code
Reviews, ADRs, risk acceptances viven en Git alongside code. Cambios via PR. Visible. Versioned.
Beneficio: developers ya saben use Git. No new tool to learn.
Implementación: 3-tier model
Tier 1: Solo Tech Lead (team < 10 personas)
Tech Lead = AI Steward (everything)
├── Drives framework
├── Reviews checklists
├── Signs off
└── Escalates to founder/CEO if material decision
Pro: minimal overhead. Con: single point of failure.
Tier 2: Tech Lead + Junior steward (team 10-30)
Tech Lead = AI Steward
├── Strategic ownership
└── Final sign-off
Senior Engineer = Co-steward
├── Day-to-day execution
├── Coordinates reviews
└── Escalates to Tech Lead
Pro: distributed work. Con: still concentrates power.
Tier 3: Light committee (team 30-100)
AI Ethics Council (3-5 people, meets quarterly)
├── Tech Lead (chair)
├── Senior ML Engineer
├── DPO or Legal Counsel
├── Product Lead
└── External advisor (optional, for diverse perspective)
Day-to-day: AI Steward (Tech Lead)
Strategic: Council quarterly
Pro: more perspectives, diverse input. Con: scheduling overhead (manage with discipline).
Approval flows: keep simple
For different decisions, different approval levels:
| Decision type | Approval needed | Time |
|---|---|---|
| Bug fix (no ethical implications) | None (PR review only) | minutes |
| New AI feature | Tech Lead review | 1 day |
| Significant model change | Tech Lead + checklist | 1 day |
| New use case (existing AI) | Tech Lead + ethics review | 1-3 days |
| New AI system | Council review (or equivalent) | 1 week |
| Significant compliance change | DPO + Legal + Tech Lead | 1-2 weeks |
| Strategic ethics direction | CEO/founder | as needed |
Flow es proportional to risk.
Escalation paths
Cuando algo es ambiguous:
Engineer
↓ (concern)
Tech Lead / AI Steward
↓ (if not resolved)
CTO or CEO
↓ (if external implications)
Board / legal counsel
Key: each level has 24-48 hours to respond. Si lleva 2 weeks, broken.
Meeting cadence (realistic)
| Meeting | Frequency | Duration | Audience | Purpose |
|---|---|---|---|---|
| AI Steward office hours | Weekly | 30 min | Engineers | Ad hoc questions |
| Sprint review (ethics agenda item) | Sprint cadence | 5-10 min | Team | Quick ethics check on sprint |
| Quarterly governance review | Quarterly | 2 hours | Council or stakeholders | Comprehensive review |
| Annual deep audit | Annually | 1-2 days | All | Full M8 audit |
Para startup de 10 personas: only weekly + quarterly are needed.
Training y onboarding
For new hires:
Onboarding (week 1):
- 1-hour intro: ethics framework
- Read AI Use Policy
- Awareness of escalation paths
Quarterly refresher (30 min):
- Updates to framework
- Discussion of recent decisions
- Q&A
Ad-hoc: when significant changes (new regulation, new feature with implications)
Trampas comunes
Trampa 1 — Coping enterprise structure. "Microsoft has Chief AI Officer; we need one too." For 10-person team, no. Tech Lead suffices.
Trampa 2 — Process for process's sake. "Let's have monthly ethics meetings." Without agenda, becomes ceremony nobody attends.
Trampa 3 — Hiring "Chief Ethics Officer" too early. Expensive, role unclear in small team, often becomes blocker rather than enabler.
Trampa 4 — Governance que slow everything. Each PR requires ethics review meeting? No. Code reviews check ethics during normal PR flow.
Trampa 5 — Sin escalation paths claros. Engineer encounters issue, doesn't know who to ask. Reports nothing.
Trampa 6 — Owner overload. AI Steward gets every question. Burns out. Distribute via co-stewards or training.
Cuándo escalar governance
Signals to expand governance structure:
- Hit 30+ engineers → consider Tier 3 council
- New regulated market (healthcare, finance) → dedicated DPO needed
- Major incident → strengthen IR + governance
- Multiple clients with audit requirements → consider ISO certification (M6)
- Public regulator inquiry → formal structure needed
Ejercicio
Para tu organization:
- ¿Qué tier (1, 2, or 3)?
- Define AI Steward role + responsibilities
- Define approval flows for 5 typical decisions
- Define escalation path (3 levels)
- Meeting cadence (be realistic)
Ver solución (ejemplo team de 15)
Tier: 2 (between solo and committee)
AI Steward: Tech Lead (Mike)
- Owns framework
- Triggers reviews
- Final signoff for routine decisions
- Escalates significant decisions to CTO
Co-steward: Senior ML Engineer (TBD hire)
- Conducts checklist reviews
- Tracks risk register
- Escalates to Tech Lead
Approval flows:
- Bug fix: PR review (no special process)
- New AI feature: Tech Lead review + checklist (Item-by-item)
- New use case: Tech Lead + ethics review
- New AI system: CTO + Tech Lead (treat as significant)
- Compliance change: + Legal Counsel
Escalation path:
- Tech Lead (engineering)
- CTO (technical/strategic)
- CEO + Legal Counsel (external implications)
Meeting cadence:
- AI Steward office hours: weekly 30 min
- Sprint planning ethics check-in: 5 min in regular planning
- Quarterly review: 2 hours
- Annual ethics audit: 1 day
Resumen
Aprendiste:
- ✅ 3 principles: concentration, embed, doc as code
- ✅ 3-tier model según team size
- ✅ Approval flows proportional to risk
- ✅ Escalation paths con 24-48h SLAs
- ✅ Meeting cadence realista (weekly + quarterly suficiente para small)
- ✅ Trampas: enterprise copy, process theater, premature hires
Checkpoint: si tu governance puede ejecutarse sin matar shipping speed, estás listo.
Siguiente cápsula
08 — Proyecto: Responsible AI Framework completo consolida M7 entero en un Framework deliverable.
Recursos
- Microsoft Responsible AI Council.
- SaaStr — startup operations — for scaling lessons.
- Holacracy — alternative organizational model.
- GitLab handbook — example transparent governance.