AI Compliance and Governance Training Course

Participants can identify applicable AI, privacy and sector obligations for a proposed system.

• EU AI Act risk categories, operator roles and compliance duties
• GDPR automated decision-making rules, lawful basis and data protection impact assessments
• Sector obligations affecting credit, insurance, employment, healthcare and public services
• ISO/IEC 42001 AI management system requirements and documented information
• NIST AI RMF functions: Govern, Map, Measure and Manage
• Regulatory horizon scanning using obligation registers and accountable action owners

Participants can build an AI inventory and define a controlled intake process for new use cases.

• AI inventory fields: purpose, owner, vendor, data, model and status
• Intake questionnaires capturing intended users, decisions, affected persons and jurisdictions
• System boundary diagrams separating model, application, data pipeline and human process
• Shadow AI discovery through procurement records, software registers and user surveys
• Unique identifiers linking inventories to risk registers, contracts and audit evidence
• Portfolio reporting metrics for proposed, approved, deployed, suspended and retired systems

Participants can classify AI use cases and determine whether escalation or prohibition is required.

• Risk classification criteria based on intended purpose, affected persons and decision consequences
• EU AI Act prohibited practices and unacceptable-risk screening questions
• High-risk system identification using Annex III categories and sector-specific triggers
• General-purpose AI obligations distinguished from downstream deployer responsibilities
• Decision trees documenting classification rationale, uncertainty and legal review points
• Risk acceptance thresholds linked to executive authority and escalation requirements

Participants can assess AI risks using structured scenarios, controls and residual-risk decisions.

• ISO/IEC 23894 risk process applied to AI system objectives
• Risk scenarios covering discrimination, error, misuse, opacity and automation bias
• Likelihood and impact scoring calibrated with defined rating criteria
• Inherent and residual risk ratings recorded within enterprise risk registers
• Bow-tie analysis connecting causes, preventive controls, impacts and recovery controls
• Risk treatment options: avoid, reduce, transfer, accept or terminate

Participants can complete an impact assessment for people, organisations and affected communities.

• Impact assessment scope defining purpose, context, users and affected groups
• Rights impact analysis for fairness, privacy, dignity, access and contestability
• Stakeholder mapping for customers, employees, citizens, representatives and vulnerable groups
• Foreseeable misuse analysis using threat scenarios and abuse-case techniques
• Proportionality assessment comparing AI intervention against less intrusive alternatives
• Mitigation plans assigning control owners, deadlines, evidence and approval criteria

Participants can specify data governance controls that support lawful and reliable AI operation.

• Data lineage mapping from collection through training, inference and retention
• Purpose limitation and data minimisation applied to AI training datasets
• Data quality dimensions: accuracy, completeness, timeliness, consistency and representativeness
• Dataset documentation using datasheets for datasets and provenance records
• Sensitive attribute handling for fairness testing and access-controlled analysis
• Retention schedules for prompts, outputs, training data and decision records

Participants can select proportionate fairness testing and explanation controls for an AI use case.

• Bias sources across problem framing, data collection, labels and deployment
• Group fairness measures: demographic parity, equal opportunity and disparate impact
• Representative sampling checks for protected groups and underserved populations
• Explainability methods: feature importance, SHAP values and reason codes
• Adverse action notices linked to decision logic, review routes and evidence
• Fairness exceptions documented through legal review, risk acceptance and monitoring

Participants can design human oversight that is meaningful, competent and evidenced.

• Human-in-the-loop, human-on-the-loop and human-in-command operating models
• Override authority defined through decision rights, thresholds and escalation paths
• Reviewer competence requirements covering domain knowledge, bias awareness and authority
• Meaningful review criteria preventing rubber-stamping of automated recommendations
• Contestability routes for affected persons, frontline staff and account holders
• Workload and alert-volume analysis for sustainable human review capacity

Participants can govern generative AI tools through use restrictions, safeguards and monitoring.

• Generative AI risk taxonomy: hallucination, prompt injection, disclosure and harmful content
• Acceptable-use rules for public tools, enterprise assistants and embedded copilots
• Prompt and output controls using content filters, grounding and retrieval constraints
• Intellectual property checks for training content, generated material and licensing
• Human review thresholds for legal, financial, medical and public communications
• Logging requirements for prompts, outputs, tool calls and user feedback

Participants can specify documentation required to explain, approve and audit an AI system.

• Model cards documenting intended use, limitations, performance and ethical considerations
• Technical documentation covering architecture, inputs, outputs, interfaces and dependencies
• Training and validation records supporting reproducibility and performance claims
• Version control for models, prompts, datasets, code and configuration settings
• Decision logs recording approvals, assumptions, exceptions and material changes
• Evidence traceability from control requirement to test result and owner

Participants can create a risk-based validation plan for AI systems before and after release.

• Validation independence matched to system risk, materiality and model complexity
• Test plans covering performance, reliability, fairness, security and safety
• Acceptance criteria defined before testing, release approval and production deployment
• Red-team methods for harmful outputs, jailbreaks, abuse and prompt injection
• Scenario testing with edge cases, vulnerable users and degraded data
• Assurance reports documenting findings, remediation deadlines and residual risks

Participants can integrate AI-specific security and incident controls into operational response processes.

• AI threat modelling using assets, adversaries, attack paths and mitigations
• Threats including data poisoning, model inversion, extraction and adversarial examples
• Privacy controls for personal data, sensitive prompts and generated outputs
• Incident severity criteria for harmful decisions, data exposure and model failures
• AI incident playbooks covering containment, investigation, notification and recovery
• Post-incident reviews feeding root-cause analysis, control changes and governance reporting

Participants can conduct due diligence and contract for appropriate AI supplier accountability.

• Supplier segmentation based on AI criticality, data access and decision impact
• Due diligence questionnaires covering training data, testing, security and model updates
• Contract clauses for audit rights, incident notification and change notification
• Service-level measures for availability, accuracy, support and remediation response
• Subprocessor and subcontractor controls for data access and model hosting
• Exit plans addressing data return, model replacement and continuity risks

Participants can design an AI management system aligned with ISO/IEC 42001 requirements.

• ISO/IEC 42001 context analysis defining interested parties and governance scope
• AI policy objectives linked to measurable controls, owners and review cycles
• Roles, competence and awareness requirements within an AI management system
• Documented information controls for approvals, assessments, tests and monitoring records
• Internal audit programmes testing conformance, effectiveness and corrective actions
• Management review agendas covering risks, incidents, metrics and improvement priorities

Participants can establish monitoring thresholds and change controls for deployed AI systems.

• Key risk indicators for performance drift, bias drift and control failure
• Monitoring dashboards combining model metrics, user feedback, complaints and incidents
• Data drift and concept drift detection with defined investigation thresholds
• Change classification for retraining, prompt updates, vendor releases and scope changes
• Reapproval triggers based on material performance, population or purpose changes
• Periodic review schedules matched to risk tier, usage volume and impact

Participants can prepare governance evidence and reporting for audit committees, regulators and senior management.

• Audit trails linking use-case decisions, controls, evidence and accountable owners
• Control testing methods: inquiry, observation, inspection and reperformance
• Evidence packs for regulators, customers, internal audit and assurance providers
• Board reporting dashboards showing portfolio risk, incidents, exceptions and remediation
• Regulatory enquiry protocols assigning legal review, facts validation and response ownership
• Findings management using root cause, corrective action and closure evidence

Participants can plan a phased AI governance implementation with priorities, resources and measurable milestones.

• Current-state assessment across policy, inventory, risk, controls and assurance
• Maturity model scoring from ad hoc controls to managed governance
• Prioritisation matrix using regulatory exposure, business value and implementation effort
• Target operating model defining committees, decision rights and reporting lines
• Ninety-day implementation plan with milestones, dependencies and accountable owners
• Change management actions for training, communications, adoption and resistance handling

Participants can build, review and present a complete AI governance assessment and control plan for a selected AI use case.

• Use-case dossier defining purpose, stakeholders, system boundaries and deployment context
• Risk classification supported by regulatory mapping and documented decision rationale
• Impact assessment covering rights, privacy, fairness, safety and operational consequences
• Control plan specifying owners, tests, evidence, thresholds and escalation routes
• Approval pack including supplier assurance, human oversight and monitoring requirements
• Management presentation defending residual-risk decisions, implementation priorities and next steps