Lumen AI Governance

Effective July 15, 2026



Lumen has established a comprehensive, enterprise-wide AI governance program designed to foster responsible innovation while meeting the demands of highly regulated environments, including federal and public sector clients. The program is built on a risk-based, lifecycle-driven framework, aligned with recognized standards such as the NIST AI Risk Management Framework (AI RMF) and ISO/IEC 42001.

 

Program Structure and Oversight

Lumen’s AI governance operates through centralized oversight paired with cross-functional execution. Every AI use case is subject to a formal intake and review process that evaluates its purpose, data usage, risk profile, and regulatory requirements prior to deployment. This process involves collaboration with legal, privacy, security, and technical stakeholders, ensuring solutions are compliant and meet enterprise expectations from the outset. AI Governance key principles include:

 

  1. Risk-Based Governance Aligned with Federal Standards
    • Lumen applies risk-based governance to AI use cases, particularly those serving federal and public sector needs. Use cases are evaluated based on their potential impact, data sensitivity, and intended use. Higher-risk applications, such as those involving sensitive data or decision support, receive enhanced scrutiny, documentation, and oversight. The governance approach is tightly aligned with industry frameworks and NIST AI RMF and ISO/IEC 42001, ensuring accountability and consistency.
  2. Operationalizing AI Governance
    • In practice, Lumen ensures each AI use case is clearly defined and thoroughly documented, including its purpose, expected outcomes, stakeholders, and constraints. This prevents purpose drift and maintains approved boundaries. Comprehensive risk assessments and continuous oversight are integral, with risks documented and mitigation tracked over time. Governance reviews incorporate privacy, legal, and security perspectives, with shared accountability across functions. Ongoing monitoring ensures that significant changes or updates are evaluated before impacting production systems. 
    • Contractual and data-handling requirements are foundational in solution design and governance. Public sector engagements often require additional legal and compliance measures, identity and access management controls, and data/environment segregation. As part of the intake assessment, Lumen also asks whether an AI project requires knowledge of or access to any government customers or government data, helping ensure the appropriate review, controls, and handling requirements are identified early in the process. AI Governance further emphasizes proper separation of development, testing, and production environments, along with access constraints aligned to contractual commitments.
    • For federal agency cloud solutions, Lumen supports FedRAMP authorization and NIST SP 800-53 security controls through documented controls, auditability, and risk tracking.
  3. Transparency, Explainability, and Responsible AI
    • Lumen maintains transparency by documenting system purposes and limitations and preserving records for audits and compliance reviews. Internal governance artifacts - such as intake records, risk logs, and decision trails - support accountability and facilitate customer and regulatory inquiries. The program also enforces fairness and bias monitoring throughout the AI lifecycle, identifying and mitigating unintended bias, and monitoring performance and compliance post-deployment.
  4. Data Governance and Customer Data Protection
    • Customer data use is strictly governed by contractual and governance requirements, ensuring data is used only for approved purposes. As of June 2026, Lumen does not utilize customer data for generalized AI model training beyond what has been explicitly agreed upon.
  5. Controlled Use of Third-Party Components
    •  When handling sensitive or customer-related data, Lumen requires the use of approved internal AI platforms that are governed through our enterprise AI governance framework. These platforms are evaluated and authorized based on legal, security, privacy, and compliance requirements before being made available for use.
    • Access to external or third-party AI tools is restricted for sensitive use cases unless they have gone through a formal review and approval process. This includes validation of data handling practices, licensing terms, and security controls.
    • To ensure adherence, Lumen enforces several controls:
      • Users are required to follow defined usage policies that prohibit the input of sensitive or customer data into unapproved tools.
      • Governance intake and assessment processes validate how data is used within AI solutions before deployment.
      • Security and monitoring controls are in place to detect and mitigate unauthorized usage.
      • Ongoing oversight is performed through AI governance reviews and collaboration with Legal, Security, and Privacy teams.
    • This approach ensures that sensitive data is only processed within approved environments, and that appropriate safeguards are consistently applied.