Governance for responsible AI: The easy things and the hard ones