Learn
These terms get used interchangeably, but they're genuinely different disciplines with different questions, different laws, and often different people responsible for them. Knowing which one you actually need matters — and honestly, no single tool (including this one) covers all of them.
Free video series
Prefer to watch? Start the video series →
AI governance and privacy, covered episode by episode.
Asks: "What's happening because of the AI's decisions?"
Managing an AI system's behavior and risk across its whole lifecycle — is it safe and accurate enough to deploy, does it discriminate, does a human review its decisions, should this kind of system even be allowed to exist. Broader than any single data-handling question.
Governed by: The EU AI Act, South Korea's AI Basic Act, and internal governance processes (approval workflows, model risk committees).
Asks: "What's happening to people's data?"
Narrower and more specific: what data trained the model, what it processes at inference, whether someone can request deletion, whether there was a lawful basis to use their data at all.
Governed by: GDPR, CCPA/CPRA, LGPD (Brazil), DPDP (India), APPI (Japan) — mostly general privacy laws extended to cover AI, not written for it from scratch.
Asks: "Can this AI system be attacked, manipulated, or stolen?"
A technical discipline, not a legal-compliance one: adversarial inputs, prompt injection and jailbreaking, model theft, data poisoning, and supply-chain security of training data and dependencies. This is red-team and penetration-testing territory.
Governed by: Mostly voluntary technical standards today (e.g. NIST's AI security guidance) rather than binding statutes.
Asks: "Could this AI fail in a way that causes serious harm — without anyone attacking it?"
Distinct from security: safety is about accidental failure (a system that's unreliable, poorly tested, or misaligned with what it's meant to do), not deliberate attack. Matters most for very large, general-purpose models operating at scale.
Governed by: The EU AI Act's systemic-risk tier for the largest general-purpose models touches this; genuine large-scale safety testing is still mostly voluntary and outside what a regulatory-classification tool like this one does.
Asks: "Should this AI behave this way, regardless of whether it's currently legal?"
The broader, values-based layer underneath governance — fairness, dignity, autonomy, transparency as principles, not (yet) binding rules. Often the reasoning that later hardens into law: "AI shouldn't manipulate people" was an ethical position before it became the EU AI Act's Article 5.
Governed by: No single law — expressed through professional codes, corporate AI-ethics principles, and eventually absorbed into governance statutes once consensus forms.
Asks: "Given everything above, what does the law actually require of this specific system?"
The practical, applied layer that ties governance and privacy together into a checkable answer for one real product — which is what this whole toolkit does.
Governed by: Whichever of the above regimes actually apply to your system, based on what it does and where its users are.
Where they actually overlap
Most real findings sit at the intersection of two or more of these — not neatly in one box. One of our own worked examples ran an AI hiring tool through this rubric and found both a governance problem (an EU AI Act Article 5 violation — banned outright, with nothing to do with data handling) and three separate privacy problems (GDPR rights around automated decisions, deletion, and international data transfers) — in the same system, at the same time. That's normal, not an edge case.
This toolkit focuses on AI governance and AI privacy, as actual regulatory compliance questions. Try the free check →