Building Defensible AI Systems Security and Compliance How to Assess Risks and Operationalize AI Controls (AI Governance)

AI is moving into business-critical decisions faster than most organizations can assign ownership, set controls, and prove what they did.Policies sit in folders. Risk scores rely on color-coded heat maps. Vendors promise privacy that no one has verified. Then a regulator, auditor, or board member asks for evidence.Building Defensible AI Systems: Security and Compliance is a practical technical reference for professionals who must make AI governance work. It turns frameworks and regulations into controls, decision rights, and documentation you can defend.Who this book is forChief AI officers and AI governance leadersGovernance, risk, and compliance (GRC), internal audit, and legal teamsChief information security officers, risk officers, and privacy leadersAI architects, machine learning (ML) engineers, and product ownersWhat you will be able to doQuantify AI risk in dollars. Replace subjective heat maps with Factor Analysis of Information Risk (FAIR) and Monte Carlo simulation, with working Python and R examples.Apply the main frameworks. Use ISO/IEC 42001, ISO/IEC 23894, ISO/IEC 42005, and the NIST AI Risk Management Framework as working methods, not shelf documents.Prepare for the EU AI Act. Build technical documentation, fundamental rights impact assessments, transparency measures, logging, and post-market monitoring evidence.Find threats and vulnerabilities. Run AI threat assessments and red team exercises, mapped to MITRE ATLAS and the OWASP lists for large language models (LLMs).Govern AI agents. Set identity, authority limits, and runtime control gates for autonomous systems.Control shadow AI and vendors. Test "e;we don't train on your data"e; claims, negotiate contract clauses, and write service levels you can enforce.Run the operating model. Define roles, accountability, approval and escalation workflows, and monitoring after deployment.Connect controls to value. Link governance to cost discipline, return on investment, and project delivery.What is insideEighty-six chapters in eleven parts cover the full AI lifecycle, from risk taxonomies and impact assessments to procurement, architecture, and continuous monitoring. Each chapter stands alone, so you can start with the problem in front of you. The book includes implementation tips, control and RACI-style role guidance, checklists, model card and risk register field guides, and code examples you can adapt to your own environment.About the authorHernan Huwyler is an AI governance and quantitative risk practitioner with more than two decades of experience across multinational organizations. He teaches AI governance and compliance as an executive professor at IE Business School and has trained more than 1,500 compliance, privacy, audit, and risk professionals.The outcomeGovernance should enable adoption, not slow it. Use this book to give your teams clear ownership, measurable risk, and audit-ready evidence, so AI can move into production with confidence.This book offers technical and operational guidance, not legal advice. Standards and regulations change, so check current official sources before making compliance decisions.