← Back to Concept Contrast

Concept Contrast Fable

Those who handle incidents and those who set the rules

Conclusion first:When a company wants to build an AI system, people often ask whether to find the security people or the compliance people. These two functions sound similar, but one manages how to remediate after something goes wrong, while the other manages how to set rules so fewer things go wrong. Get the direction wrong, and the team will find itself fighting fires every day, or the rules will be so rigid that no one wants to follow them.

When a company wants to build an AI system, people often ask whether to find the security people or the compliance people. These two functions sound similar, but one manages how to remediate after something goes wrong, while the other manages how to set rules so fewer things go wrong. Get the direction wrong, and the team will find itself fighting fires every day, or the rules will be so rigid that no one wants to follow them.

Fable

Safety officers and supervisors on a construction site

Outside the county town there was a large construction site, and an accident happened on the first day of work. A worker wasn't wearing a helmet and was hit in the head by a falling brick. The boss brought in safety officer Old Zhou, specifically responsible for reducing accidents. Old Zhou walked around the site every day, stopping anyone not wearing a helmet, having exposed wires repaired, and halting work when scaffolding was loose. The workers found him annoying, but minor accidents did indeed decrease.

But Old Zhou soon discovered that some dangers were hidden in the construction arrangements and could not all be blamed on a careless worker. To rush the schedule, the boss had people keep laying bricks while standing on a foundation that had not yet been reinforced. Old Zhou could call a halt once, but he could not decide the schedule and budget.

He was as busy as a firefighter. Today he patched a pillar, tomorrow he replaced a rope, the day after he treated the wounded. As long as the drawings, procurement, rewards and punishments, and acceptance checks remained chaotic, fires would keep breaking out in new places.

Later the boss brought in Supervisor Zhang. On his first day, Supervisor Zhang did not go scold the workers. Instead he sat down and set the rules: how deep the foundation must be, how much rebar, how scaffolding is erected, who can approve rush work, and how accidents are reported.

After the rules were set, Old Zhou still patrolled the site, but no longer carried all safety alone. If someone violated the rules, work could be stopped for rectification; when new materials were found, specifications were evaluated before being revised; when an incident occurred, it could be traced to which rule had failed to cover it.

But as the construction site grew larger, Old Zhou began to encounter things he could not control. Procurement bought thin wooden boards to save money, the schedule cut nighttime rest to rush for a festival, and the new contractor crew had not been trained. Old Zhou could stop people without helmets, but he could not stop the bookkeeper from cutting the safety rope budget.

The boss also hired a general manager who wrote safety into startup rules, procurement standards, contracting agreements, incident reviews and shutdown authority. Old Zhou still patrolled the site, handling the risks that emerged every day; the general manager ensured the whole site operated under one set of responsibilities and decisions. If only one of them remained, there would be either only firefighting or only rules on the wall.

The two still argued at times. Old Zhou watched current risks, Supervisor Zhang managed long-term order. The boss finally understood: one is responsible for identifying and handling risks, the other for setting rules, responsibilities and oversight structures; for the site to have fewer incidents, neither hand can be missing.

AI risk management

Identify, assess, and respond to risks that may arise in AI systems, and know how to handle them when something goes wrong

AI governance

Formulate rules, processes, and review mechanisms to ensure AI systems are safe and controllable at the institutional level

Story Mapping

  • Safety officer Lao Zhou → risk management, responsible for on-site risk identification and handling
  • Supervisor Master Zhang → governance, responsible for setting rules and overseeing execution
  • Chasing fires every day → the reactive state of risk management
  • A thick construction code book → governance policies and rules
  • New processes aren't in the spec → the rigidity problem of governance
  • Rush to the hospital after something happens → the after-the-fact remedy of risk management
  • Workers fined for violating rules → deterrence and constraints of governance

In the project

If your team is currently dealing with all kinds of AI problems every day—the model acting up, data leaking, users complaining—what you need is stronger risk management, and you should first establish emergency response mechanisms. If your AI system is not yet live, or has just launched and is relatively stable but needs a long-term reliable operating framework, then governance is the higher priority. Ideally you have both: governance sets the rules and reviews, while risk management handles what to do when something goes wrong during execution.

京ICP备2026014272号