AI Governance and Oversight Training Course

Participants can draft policy components and assign governance decision rights for AI systems.

• AI policy architecture: principles, mandatory controls, procedures and supporting standards
• OECD AI Principles interpreted as operational policy commitments
• RACI matrix defining accountable owners, approvers, reviewers and operators
• Decision-rights matrix for use-case intake, deployment, change and retirement
• Prohibited and restricted AI uses defined through policy criteria
• Exception management records compensating controls, expiry dates and executive approvals

Participants can classify AI use cases and route them through proportionate review processes.

• Use-case intake captures purpose, users, affected groups and decision consequences
• Risk tiering assesses autonomy, scale, sensitivity, reversibility and potential harm
• Impact assessment distinguishes decision support from fully automated decisions
• Materiality thresholds trigger specialist review, executive approval or prohibited status
• Risk register entries connect AI hazards, controls, owners and residual risk
• Approval gates align evidence requirements with assigned AI risk tiers

Participants can assess AI risks and select controls across the system lifecycle.

• NIST AI RMF functions: Govern, Map, Measure and Manage
• ISO/IEC 23894 risk process applied to AI-specific sources of harm
• Risk scenarios cover discrimination, misinformation, security, privacy and model failure
• Control mapping links preventive, detective and corrective measures to risks
• Residual-risk assessment documents assumptions, uncertainties and risk acceptance authority
• Control testing criteria define evidence, frequency, tolerances and remediation actions

Participants can specify governance controls for AI data, access and information security.

• Data lineage records source systems, transformations, labels and retention periods
• Datasheets for datasets document collection methods, consent and known limitations
• Data-quality dimensions assess completeness, accuracy, timeliness, consistency and representativeness
• Privacy impact assessments identify personal-data processing and lawful-use requirements
• Access controls separate development, testing, production and privileged administration duties
• Prompt and retrieval data controls protect confidential information in generative AI

Participants can review model evidence for performance, fairness, explainability and limitations.

• Model validation challenges conceptual soundness, assumptions, data and implementation
• Performance metrics selected for classification, regression, ranking and generative outputs
• Fairness metrics compare error rates, selection rates and calibration across groups
• Bias testing examines proxy variables, sampling gaps and historical decision patterns
• Explainability methods include feature importance, SHAP values and reason codes
• Model cards record intended use, limitations, metrics, risks and approvals

Participants can design human oversight arrangements that match AI decision risk and autonomy.

• Human-in-the-loop, human-on-the-loop and human-in-command models compared
• Override procedures define authority, rationale, recording and downstream correction
• Meaningful human review requires competence, time, information and intervention authority
• Decision notices communicate AI involvement, reasons, limitations and appeal routes
• Vulnerable-group assessments identify heightened risks and additional safeguards
• Red-team testing probes harmful outputs, misuse paths and control weaknesses

Participants can assess external AI providers and control generative AI procurement and use.

• Supplier due diligence reviews model purpose, training data and governance evidence
• Contract clauses address audit rights, incident notification, data use and change control
• Service-level measures define availability, accuracy, response times and support obligations
• Generative AI evaluation tests hallucination, toxicity, prompt injection and data leakage
• Retrieval-augmented generation controls govern source quality, citations and knowledge updates
• Open-source model assessments address licences, provenance, vulnerabilities and maintenance ownership

Participants can establish monitoring, incident response and assurance routines for deployed AI.

• Monitoring dashboards track performance, drift, bias, overrides and user complaints
• Data drift, concept drift and performance degradation distinguished through monitoring signals
• Threshold breaches trigger investigation, rollback, retraining or suspension decisions
• AI incident taxonomy categorises harms, near misses, security events and control failures
• Root-cause analysis uses five whys, fault trees and corrective action tracking
• Internal audit plans test governance design, operating effectiveness and evidence retention

Participants can plan a phased AI governance implementation aligned to ISO/IEC 42001.

• ISO/IEC 42001 management system requirements translated into implementation workstreams
• Current-state assessment identifies policy, process, capability and evidence gaps
• Governance roadmap sequences quick controls, foundational processes and assurance milestones
• Metrics measure inventory coverage, review timeliness, incidents and control completion
• Change management identifies stakeholder impacts, training needs and communications actions
• Ninety-day action plan assigns owners, deadlines, dependencies and success measures