Controls do not always fit every AI use case exactly as designed. A team may need a temporary exception while replacing a model, correcting a monitoring gap, or completing a planned control. The governance problem begins when that deviation is approved informally and then becomes invisible.
Record the exception as a decision
Capture the affected use case and control, the requested deviation, rationale, risk owner, approver, start date, expiration or review date, and any conditions attached to approval. Link the record to the underlying AI inventory entry so reviewers can understand the exception in context.
Require compensating safeguards where appropriate
An exception should explain how risk will be managed while the normal control is unavailable or unsuitable. Safeguards might narrow the user population, reduce system permissions, add human review, increase monitoring, limit data, or restrict the use case to a defined environment.
Make expiration meaningful
A date is useful only if someone owns the decision when it arrives. Route approaching expirations to the responsible owner and require an explicit close, replacement, or renewed approval. Avoid silent extensions that turn temporary deviations into an undocumented operating model.
Use the register as governance evidence
NIST AI RMF describes Govern as a cross-cutting function and calls for risk management throughout the AI lifecycle. A maintained exception register can support that work by making deviations, ownership, and follow-up visible, but it does not by itself establish compliance with any law, regulation, contract, or professional standard.
Related knowledge
Use this with AI Governance Change Triggers, AI Use-Case Exit Criteria, AI Governance Control Owners, and AI Governance Operating Reviews.
References
This resource supports operational governance. It does not establish legal compliance or replace qualified legal, regulatory, clinical, financial, employment, safety, privacy, accessibility, or other professional review.