Privacy governance for AI systems that works — a risk-based operating model covering AI registers, assessments, vendor controls, monitoring and accountability.