Soribel Feliz & Farida Khalaf: Author Interview #19, AI Everywhere, Volume 1
AI Everywhere, Vol. 1, Ch.20: Why AI governance is an evolution of privacy and cybersecurity, and how to build operational infrastructure that replaces "ethics vibes" with real accountability.
Welcome back to the She Writes AI interview series, where we talk with the authors behind AI Everywhere, Volume 1,, exploring their personal journeys and professional expertise to understand how we can build a future for AI that is truly ethical, responsible, and human-centered.
This is the 19th episode in our series, and today I am joined by Soribel Feliz. Representing the How-to section of the book, Soribel’s work provides a necessary reality check for an industry often lost in high-level theory. Her contribution, Chapter 20: From Privacy and Cybersecurity to AI Governance, argues that many organizations are currently confusing “having a policy” with “having governance”.
Soribel Feliz brings a pragmatic, battle-tested perspective from the worlds of privacy and cybersecurity to this conversation. She moves the discussion away from 20-page mission statements and into the unglamorous but vital work of system ownership, monitoring, and incident response. She reveals that the “accountability gap” in AI doesn’t exist because we lack principles, but because we lack the operational infrastructure to back them up.
In this conversation, Soribel Feliz explores why governance must be involved at the architectural stage rather than as a late-stage compliance checkbox, how to build a governance board that actually has the power to stop something, and why the very first step for any leader is a simple system inventory. Whether you are a tech leader trying to avoid innovation bottlenecks or a compliance professional looking for a disciplined framework, Soribel’s insights offer a roadmap for building systems that are safe by design, rather than by accident.
Below is Soribel Feliz’s full interview response to Farida Khalaf’s questions on her chapter: From Privacy and Cybersecurity to AI Governance from AI Everywhere, Volume 1.
Topic: From Privacy and Cybersecurity to AI Governance (Chapter 20)
Intended Audience: For tech leaders, engineers, and compliance professionals seeking to move beyond “ethics as a philosophical exercise” toward a disciplined, operational framework that treats AI governance as a direct evolution of proven privacy and cybersecurity practices.
Part 1: The Professional Path & The Global Tribe
The Expert Perspective: Why was it important to frame AI Governance as a direct evolution of privacy and cybersecurity rather than a completely new, separate discipline?
Soribel: Because when you treat AI Governance as something that is brand new, you end up starting from scratch when you don’t have to. Or you end up not starting at all.
A lot of companies go out and hire AI ethicists, form committees, write principles documents. And while all of that is happening, nobody is actually building anything. The real work of governance, who owns this system, how do we monitor it, what happens when it breaks, is sitting undone while 20-page mission statements and values papers are written but nobody’s reading them.
Privacy and cybersecurity professionals already know how to do that work. They’ve spent careers asking exactly those questions. The tools are different with AI. The mindset is not.
Framing this as an evolution means you can take what already works and apply it. That’s not cutting corners. That’s not reinventing the wheel when you don’t have to.
Governance: How does having governance experts involved at the architectural stage, rather than just at the compliance stage, change the safety of the systems we build?
Soribel: Late-stage governance is damage control. Architectural stage governance is prevention, insurance, risk management, wisdom, foresight, prudence.
When compliance professionals come in after a system is already built, they can document the risks and write the incident response plan. What they cannot do is undo the design decisions that created the problem in the first place.
When governance is at the table early, the questions are different. Not “How do we manage the liability this system creates?” but “Should we build it this way at all?” That conversation produces different systems.
Privacy professionals lived this with data. The organizations that built data protection into their architecture from the start are not the ones paying GDPR fines. The ones that treated privacy as a late-stage checkbox are.
AI is the same story. You cannot bolt on accountability after the fact and expect it to work. It has to be designed in. That only happens when governance is in the room early.
Part 2: The Interconnected AI Stack
The Stack: How does your governance framework help organizations close the accountability gap?
Soribel: The accountability gap exists because organizations confuse having policies with having governance. Those are not the same thing.
A policy document nobody follows does not close anything. It creates the appearance of accountability while the gap stays wide open. What actually closes it is operational infrastructure. Clear system ownership. Documented processes. Continuous monitoring. Incident response plans with real names attached, not just job titles.
The first question in my framework is always: who owns this system? Not the team. One person. Because when something fails, you need to know immediately who picks up the phone.
The second question is: how do we know it’s working correctly? That means monitoring after deployment, not just at launch. Models drift. Data changes. Bias can show up months after a system goes live. A governance program that checks a system once and moves on is not governance.
This is the same work privacy and cybersecurity professionals have always done. Clear owners. Documented processes. Regular audits. Fast response when something breaks. It’s not complicated. It’s just not glamorous either, and that’s why a lot of organizations skip it.
Protection: How do you build an AI Governance board that actually protects the human signal?
Soribel: You staff it with people who have to answer for things.
The boards that fail are full of people whose job is to think about ethics. They write thoughtful documents and hold thoughtful meetings as part of the AI Governance committee or working group. Meanwhile real systems are running with real consequences, and nobody with operational authority is watching.
The boards that work have people on them who own something. Legal. Compliance. Engineering. Operations. People whose job descriptions include the word “responsible.” Because governance without accountability is just vibes.
And protecting the human signal should not be a philosophical exercise. It means tracking whether the system is producing fair outcomes for actual people, not just performing well on technical benchmarks. That requires metrics. Time to detection. Time to resolution. Whose complaints are getting heard and whose aren’t.
The clearest stress-test of whether a governance board is real: can it stop something? Can it refuse a deployment? Can it pull a system that’s causing harm? If the answer is no, if it can only advise, it’s a committee. Committees don’t protect anyone.
A governance program that checks a system once and moves on is not governance. Models drift. Data changes. Bias can show up months after a system goes live.
Part 3: Strategy & The Human Signal
Innovation: How do we ensure AI governance doesn’t become a bottleneck for innovation?
Soribel: It becomes a bottleneck when you bring it in too late.
If governance only shows up when a system is already built and ready to ship, then every question it raises feels like an obstacle. Because at that point, reversing course is expensive. Nobody wants to hear it.
When governance is embedded from the start, that dynamic changes. Engineers know the constraints they’re working within. Risk assessments happen in parallel with development. By the time something is ready to deploy, most of the governance work is already done.
I’ve seen teams get this right by treating governance the way good engineering teams treat security. You don’t build first and secure later. You build with it in mind because fixing it retroactively costs ten times more.
Proactive governance is not a slowdown. It’s the thing that keeps a regulatory investigation or a discrimination lawsuit from stopping innovation cold. That’s the actual bottleneck nobody talks about.
Governance without accountability is just vibes.
The boards that work have people on them who own something.
People whose job descriptions include the word 'responsible’.
Part 4: Actionable Awareness & Future Vision
Roadmap: What is the very first control a tech leader should put in place?
Soribel: A system inventory.
Before you can govern anything, you have to know what you have. And most organizations are already using more AI than their leadership realizes. Vendors have embedded it into tools procured years ago. Teams have adopted AI products without formal approval. Engineers have integrated models into workflows that nobody documented.
You cannot build accountability structures for systems you don’t know exist.
Start by asking every department two questions: what AI systems are you using, and who owns them? The answers will surprise you. And they will tell you exactly where to focus first.
Everything else — risk assessments, monitoring programs, incident response plans — builds on that inventory. You cannot skip it and expect the rest to hold.
Late-stage governance is damage control.
Architectural stage governance is prevention, insurance, risk management, wisdom, foresight, prudence
Why This Matters
Soribel Feliz’s perspective is essential because she strips away the “glamour” of AI ethics to focus on what actually keeps people safe: accountability and operational discipline.
Evolution, Not Reinvention: Soribel argues that we don’t need to start from scratch. By framing AI governance as an evolution of privacy and cybersecurity, organizations can use existing mindsets and proven tools to manage risk without “reinventing the wheel”.
Proactive Architecture: She highlights that late-stage governance is just damage control. When governance is involved early, it moves from being a “bottleneck” to a form of insurance and foresight, ensuring accountability is designed into the system’s DNA from the start.
Closing the Accountability Gap: Soribel’s framework demands clear system ownership. She insists that one person, not a team, must own a system so that when something fails, the organization knows exactly who “picks up the phone”.
Governance with Teeth: She offers a stress-test for real governance: Can the board stop a deployment or pull a harmful system?. If a board can only advise, she warns, it is just a committee, and “committees don’t protect anyone”.
The Power of the Inventory: She provides the ultimate starting point for leaders: The System Inventory. You cannot govern what you don’t know exists, and most organizations are already using more “shadow AI” than leadership realizes.
Thank you, Soribel Feliz, for your clear-eyed and deeply practical contribution to the How-to section of our book. For leaders and teams looking to move from “mission statements” to “monitoring,” her chapter in AI Everywhere, Volume 1, is the definitive guide for building AI that is as robust as it is responsible.
Don’t miss her newsletter and community, Algorithms are Personal, for more sharp takes on navigating systems that weren't built for you. Soribel reminds us that the most important work of AI safety isn't always the most glamorous; it’s the regular audits, documented processes, and clear ownership that ensure technology remains a tool we can trust. I personally highly recommend her "system inventory" approach as the very first control every tech leader should put in place this week to move from "shadow AI" to true operational sovereignty
And if you’re interested in more conversations like this, consider subscribing to She Writes AI. I’ll continue sharing insights from the voices shaping the future of AI, including contributors from AI Everywhere, Volume 1, where 26 women from across five continents explore how artificial intelligence is changing the world we live in, and how we can change it for the better.
References
Book purchasing information
Buy the book (now on Amazon, Gumroad, Lulu, Ingram Spark, and many ebook platforms). Look for our upcoming abridged audiobook edition in July!
Tips from our publisher on how to buy an Amazon ebook from a non-KDP-marketplace country, and how to read it without a Kindle device (free)
Review links (we’re on Amazon, Goodreads, and Storygraph)
For more insights on the book, see aiEverywhereBooks.com - our beautiful book series website created by Blessing Okpala, PhD:
Thanks for reading She Writes AI Community! Subscribe (free) to receive new interviews, weekly digests, & book news and to support our work:
 | A guest post by
|