AI governance obligations