AI Governance Training Course

Participants can describe AI systems in terms suitable for governance and risk review.

• AI system components: data, model, interface, users, outputs and decisions
• Intended purpose statements separating approved use from foreseeable misuse
• Decision impact mapped across customers, employees, citizens and service users
• Generative AI patterns: retrieval augmentation, copilots, agents and content generation
• Human decision roles: informed, assisted, reviewed and fully automated
• Use-case boundaries documented through process maps and decision inventories

Participants can create an AI inventory and intake process for proposed systems.

• AI system inventory fields: owner, purpose, data, model, deployment status
• Intake questionnaires capturing business value, affected parties and deployment context
• System identifiers connecting procurement, model records and operational applications
• Shadow AI discovery through software inventories, surveys and procurement records
• Portfolio segmentation by business function, criticality and decision impact
• Inventory refresh triggers following material model, data or purpose changes

Participants can interpret major AI governance sources and identify applicable obligations.

• EU AI Act risk categories and operator responsibilities
• NIST AI RMF functions: Govern, Map, Measure and Manage
• ISO/IEC 42001 management system requirements for artificial intelligence
• ISO/IEC 23894 guidance for AI risk management processes
• Data protection principles affecting automated decision-making and profiling
• Sector rules influencing credit, health, employment and public-sector AI

Participants can design decision rights, committees and escalation paths for AI governance.

• RACI matrices for business owners, data teams, risk and legal
• AI governance committee mandates, membership, quorum and delegated authority
• Decision gates from use-case proposal through retirement
• Risk acceptance authorities aligned with residual risk thresholds
• Escalation routes for prohibited uses, incidents and unresolved control failures
• Control ownership separated from independent challenge and assurance

Participants can classify AI systems and assign governance intensity using defined criteria.

• Risk taxonomy covering fairness, privacy, safety, security and accountability
• Impact criteria based on rights, safety, financial loss and service access
• Inherent risk scoring using likelihood, severity, scale and reversibility
• Risk tiers linked to approval depth, testing and monitoring requirements
• Materiality thresholds for model changes, retraining and prompt updates
• Risk registers connecting controls, owners, due dates and residual ratings

Participants can conduct an AI impact assessment that identifies harms and treatment actions.

• Problem framing tests whether AI is necessary and proportionate
• Affected-party mapping identifies direct, indirect and vulnerable populations
• Impact assessment questions cover rights, safety, equity and contestability
• Foreseeable misuse analysis identifies harmful user behaviours and system failures
• Mitigation options compared through effectiveness, feasibility and residual harm
• Assessment sign-off records assumptions, dissenting views and approval conditions

Participants can specify data controls needed for responsible AI development and operation.

• Data lineage traces sources, transformations, labels and downstream model use
• Purpose limitation controls prevent incompatible reuse of personal data
• Dataset quality dimensions: completeness, accuracy, timeliness, consistency and representativeness
• Sampling bias assessed through population coverage and missing-data analysis
• Sensitive attributes governed for fairness testing and access control
• Data retention schedules cover training data, prompts, outputs and logs

Participants can define control requirements for developing, testing and approving AI models.

• Model development standards define objectives, features, assumptions and acceptance criteria
• Training-validation-test splits prevent data leakage and overstated performance
• Performance metrics selected for accuracy, calibration, precision and recall
• Independent validation challenges design choices, results and documented limitations
• Model cards record intended use, performance, risks and usage constraints
• Approval evidence links test outcomes to deployment decisions

Participants can select fairness, explainability and human oversight controls for high-impact AI.

• Fairness definitions compared: demographic parity, equalised odds and calibration
• Subgroup testing identifies performance disparities across relevant protected characteristics
• Explainability methods include feature importance, SHAP values and reason codes
• Human oversight design specifies intervention authority, competence and response time
• Override logging captures reasons, patterns and possible automation bias
• Contestability processes provide notices, review routes and correction mechanisms

Participants can govern generative AI use cases through purpose, content and access controls.

• Generative AI risk patterns: hallucination, prompt injection, leakage and harmful content
• Prompt libraries governed through ownership, review, versioning and approved use
• Retrieval-augmented generation controls source quality, permissions and citation requirements
• Content filtering combines policy rules, classifiers and human review
• Output verification requirements vary by decision impact and user reliance
• Agent permissions constrained through least privilege, tool allowlists and transaction limits

Participants can assess third-party AI providers and define contractual governance requirements.

• Vendor due diligence evaluates model provenance, data handling and security controls
• Supplier questionnaires request testing evidence, incident records and subcontractor details
• Contract clauses define audit rights, notification duties and data-use limits
• Service-level measures cover availability, support, change notice and output quality
• Provider model changes assessed before deployment into controlled business processes
• Exit plans address data return, model replacement and continuity risks

Participants can integrate AI-specific security and privacy threats into governance controls.

• Threat modelling identifies assets, adversaries, attack paths and mitigations
• Prompt injection defences separate trusted instructions from untrusted retrieved content
• Model extraction and inversion risks addressed through access and output controls
• Privacy impact assessment links processing purposes, lawful bases and safeguards
• Secrets management protects API keys, credentials and system prompts
• Red teaming tests harmful outputs, bypass attempts and misuse scenarios

Participants can establish documentation standards and evidence repositories for AI assurance.

• Documentation hierarchy links policy, standard, procedure, record and evidence
• Technical files assemble system descriptions, risk assessments and test results
• Version control preserves model, dataset, prompt and policy change history
• Evidence registers assign custodians, retention periods and retrieval locations
• Decision logs record approvals, conditions, exceptions and accountable executives
• Traceability matrices connect obligations, controls, tests and supporting artefacts

Participants can control AI releases and changes through defined approvals and evidence.

• Release checklists confirm approvals, testing, documentation and operational readiness
• Change classification distinguishes minor updates from material model changes
• Approval gates address new data, retraining, model replacement and expanded use
• Pilot controls limit users, decisions, duration and exposure before scale-up
• Rollback plans specify triggers, authority, fallback process and communications
• Configuration baselines record approved models, prompts, thresholds and integrations

Participants can design monitoring plans that identify declining performance and emerging harms.

• Key risk indicators track errors, disparities, overrides, complaints and incidents
• Data drift detection compares live distributions against approved reference datasets
• Concept drift monitoring tests changing relationships between inputs and outcomes
• Generative AI quality sampling evaluates factuality, relevance, safety and citations
• Threshold breaches trigger investigation, restrictions, retraining or system suspension
• Monitoring dashboards assign audiences, frequency, ownership and escalation actions

Participants can prepare incident response procedures for AI failures and harmful outcomes.

• AI incident taxonomy covers safety, fairness, privacy, security and performance
• Triage criteria assess affected populations, severity, urgency and regulatory notification
• Containment actions include access restriction, output suppression and service suspension
• Root-cause analysis examines data, model, process, users and third parties
• Corrective action plans assign owners, deadlines, validation and closure evidence
• Post-incident reviews update risk assessments, controls and training materials

Participants can plan assurance activities that test AI governance design and operating effectiveness.

• Assurance plans prioritise systems by risk tier, materiality and control maturity
• Control testing evaluates design adequacy, operating effectiveness and evidence quality
• Audit trails reconstruct decisions from intake through deployment and monitoring
• Sampling approaches select model changes, approvals, incidents and user interactions
• Findings reports distinguish deficiencies, observations, root causes and agreed actions
• Management reporting tracks remediation status, overdue actions and recurring weaknesses

Participants can prepare policy, training and communication measures that support accountable AI use.

• AI policy statements define permitted, prohibited and restricted uses
• Role-based training covers users, approvers, developers, reviewers and executives
• Acceptable-use rules address public tools, confidential information and generated content
• Communication plans explain governance requirements without obstructing legitimate innovation
• Exception processes document rationale, compensating controls and expiry dates
• Maturity assessments sequence governance improvements by risk and implementation effort

Participants can build, review and present a complete AI governance pack for a priority use case.

• Use-case dossier defines purpose, stakeholders, decision impact and system boundaries
• AI inventory record captures ownership, classification, dependencies and deployment details
• Risk assessment documents harms, controls, residual risk and treatment decisions
• Governance workflow assigns approvals, evidence requirements and escalation points
• Monitoring and incident plan specifies indicators, triggers, responsibilities and responses
• Peer review tests traceability, proportionality, feasibility and regulatory alignment