Artificial Intelligence Risk and Compliance Training Course

Participants can design an AI governance structure with clear decision rights and escalation routes.

• Governance operating model aligned with enterprise risk management
• Board, executive and committee responsibilities documented through charters
• RACI matrices assign approval, challenge and monitoring responsibilities
• Risk appetite statements translated into AI decision boundaries
• Policy hierarchy connects principles, standards, procedures and records
• Escalation routes defined for material AI risks and incidents

Participants can create an AI inventory and structured intake process for proposed systems.

• AI inventory fields capture purpose, owner, model and data
• Use-case intake screens intended users, decisions and affected populations
• System boundaries identify interfaces, vendors and downstream dependencies
• Business value hypotheses separated from control and risk assumptions
• Data flows recorded from collection through retention and deletion
• Unique identifiers support traceability across governance records

Participants can identify and prioritise AI risks using a documented taxonomy and materiality method.

• Risk taxonomy covers fairness, privacy, security, safety and conduct
• Model risk distinguishes conceptual error from implementation error
• Inherent risk scoring considers impact, likelihood and exposure
• Materiality criteria identify customer, financial and regulatory consequences
• Causal analysis links AI failure modes to business harms
• Risk registers record causes, events, impacts and owners

Participants can apply NIST AI RMF functions to structure AI risk management activities.

• GOVERN function establishes policies, roles and accountability mechanisms
• MAP function identifies context, impacts and affected stakeholders
• MEASURE function selects metrics, tests and evaluation evidence
• MANAGE function prioritises treatment, monitoring and risk acceptance
• AI RMF profiles tailor controls to specific use cases
• Crosswalks connect AI RMF activities with existing risk processes

Participants can classify AI use cases and determine applicable legal, regulatory and policy obligations.

• Risk tiering distinguishes prohibited, high-impact and routine AI uses
• EU AI Act categories assessed against intended purpose
• Automated decision rules examined under data protection requirements
• Consumer protection duties applied to explainability and fair treatment
• Sector obligations mapped for banking, insurance and public services
• Regulatory applicability logs record rationale, sources and owners

Participants can specify data governance and privacy controls for AI development and use.

• Data lineage traces training, validation and production data sources
• Purpose limitation tested against proposed model inputs and outputs
• Data protection impact assessments identify high-risk processing activities
• Data quality dimensions measure completeness, accuracy, timeliness and representativeness
• Retention schedules govern prompts, outputs, labels and training records
• Access controls restrict sensitive datasets through role-based permissions

Participants can assess fairness risks and define proportionate testing and remediation controls.

• Protected characteristics identified through legal and policy definitions
• Disparate impact analysis compares outcome rates across relevant groups
• Selection rate ratios tested against documented fairness thresholds
• Representative sampling reduces bias in training and validation datasets
• Proxy variables assessed for indirect discrimination risk
• Customer impact assessments document harms, remedies and review routes

Participants can adapt model risk management disciplines to machine-learning and AI systems.

• Model inventory attributes identify methodology, purpose and materiality
• Conceptual soundness reviews challenge assumptions and model design
• Independent validation tests performance, limitations and implementation accuracy
• Benchmark models compare outcomes against alternative methodologies
• Outcomes analysis detects unexpected results after deployment
• Model limitations statements define permitted use and exclusions

Participants can plan validation tests and monitoring thresholds for deployed AI systems.

• Test plans define objectives, datasets, acceptance criteria and evidence
• Accuracy, precision, recall and calibration matched to use cases
• Sensitivity analysis tests performance under changed input conditions
• Data drift monitored through population stability index measures
• Concept drift triggers review when outcome relationships change
• Threshold breaches initiate investigation, remediation and documented approval

Participants can assess generative AI risks and establish controls for organisational use.

• Prompt injection threats assessed for external content and retrieval systems
• Hallucination controls require source checking and human verification
• Retrieval-augmented generation evaluated for access and citation accuracy
• Prompt libraries governed through approval, versioning and restricted content
• Output filters detect prohibited, confidential and harmful generated content
• Human-in-the-loop controls define review points and override authority

Participants can identify AI-specific security threats and specify resilience controls.

• Threat modelling identifies assets, adversaries, attack paths and mitigations
• Adversarial examples tested against model input validation controls
• Model extraction risks addressed through rate limits and authentication
• Training data poisoning detected through provenance and anomaly checks
• Secure development lifecycle includes AI code, models and dependencies
• Business continuity plans address model failure and manual fallback

Participants can perform due diligence and define contractual controls for external AI providers.

• Vendor due diligence assesses governance, security, privacy and model controls
• Evidence requests cover validation reports, incident records and certifications
• Contract clauses define audit rights, data use and notification
• Subprocessor registers identify downstream access to organisational information
• Service-level measures cover availability, response times and support obligations
• Exit plans preserve records, data portability and operational continuity

Participants can design preventative, detective and corrective controls for AI risk treatment.

• Control objectives link identified risks to required outcomes
• Risk and control matrices assign owners, frequency and evidence
• Preventative controls restrict unapproved models, data and deployment pathways
• Detective controls identify threshold breaches, unauthorised access and exceptions
• Corrective actions specify remediation, retesting and closure evidence
• Compliance monitoring plans test control operation against defined criteria

Participants can assemble documentation and evidence that supports effective challenge and audit review.

• Model cards document purpose, performance, limitations and ethical considerations
• Datasheets record dataset origin, composition, collection and known limitations
• Decision logs capture approvals, exceptions, overrides and risk acceptances
• Explainability methods selected according to audience and decision impact
• SHAP values interpreted carefully for feature contribution explanations
• Audit trails preserve reproducible evidence of system changes

Participants can manage AI incidents through detection, investigation, remediation and stakeholder communication.

• Incident classification distinguishes operational, privacy, conduct and security events
• Triage procedures establish severity, containment and notification decisions
• Root cause analysis uses five whys and fault trees
• Complaint handling identifies automated decision concerns and customer remedies
• Regulatory notifications assessed against applicable reporting timelines
• Post-incident reviews track corrective actions and control improvements

Participants can plan assurance work that tests AI governance design and operating effectiveness.

• Audit universe identifies material AI systems and governance processes
• Risk-based audit planning prioritises high-impact systems and control gaps
• Walkthroughs trace approvals, data flows, decisions and evidence
• Design effectiveness testing assesses whether controls address stated risks
• Operating effectiveness testing samples evidence across defined review periods
• Audit findings distinguish root cause, risk rating and management action

Participants can prepare decision-ready AI risk reports and conduct informed management challenge.

• Key risk indicators track performance, fairness, incidents and control exceptions
• Management information separates operational detail from board-level decisions
• Risk dashboards show trends, thresholds, owners and overdue actions
• Risk acceptance papers document rationale, duration and approval authority
• Challenge questions test assumptions, evidence, alternatives and residual risk
• Committee packs present decisions required and escalation recommendations

Participants can create a phased implementation roadmap for an AI governance programme.

• Maturity assessments benchmark current governance against target capabilities
• Gap analysis prioritises policy, process, technology and skills actions
• Implementation roadmaps sequence quick wins, dependencies and milestones
• Change impact assessments identify affected teams, roles and procedures
• Training plans address developers, users, approvers and control owners
• Success measures track adoption, control coverage and issue reduction

Participants can build, review and present a complete AI governance and control pack for a defined use case.

• Selected use case scoped with decision, users, data and boundaries
• AI inventory record completed with accountable owners and dependencies
• Risk assessment documents inherent risk, controls and residual exposure
• Control matrix specifies testing, evidence, frequency and action owners
• Monitoring plan defines metrics, thresholds, reporting and escalation routes
• Governance pack presented for peer challenge and management approval