AI Governance and Risk Management

What AI governance decides and how this course teaches it: the five questions asked of every AI system, the standards the course uses, reading the course for your organization, how practice works, and a first inventory entry. Start here.

The three questions AI governance asks of every system: is it an AI system, what role does the organization hold, and who answers for it. Definitions, the lifecycle, roles, how AI risk differs from IT risk, and accountability.

Building an AI inventory and tiering it: finding AI already in use, shadow AI and AI inside licensed software, use cases against models, tiering criteria and legal overlays, what each tier decides, and a worked inventory for a regional insurer.

The NIST AI RMF as a working method: how it is built, the Govern, Map, Measure and Manage functions outcome by outcome, the generative AI profile NIST AI 600-1, and a current and target profile for a software company.

ISO/IEC 42001 clause by clause: context and scope, leadership and AI policy, planning, support and operation, Annex A by control area, evaluation and improvement, and a Statement of Applicability for a hospital group.

Assessing an AI system for risk and impact: harms and affected parties, likelihood from probabilistic outputs, severity and a grid tied to approvers, treatment and residual risk, the ISO/IEC 42005 record, and a full assessment of a city council's benefit fraud model.

Governing AI across its life: the stages and their gates, data provenance and quality, bias testing, model documentation, change control, drift monitoring and retirement, and a motor insurer's pricing model from design to retirement.

Governing generative AI and agents: prompt injection, data leakage, unreliable output, excessive agency, human oversight and an acceptable-use policy, with permission sheets for each assistant, and a law firm assessing a document assistant and an email agent.

Governing AI from suppliers: the chain behind a product, due-diligence questions and ratings, contract terms, AI switched on inside existing software, ongoing assurance, and a school district assessing a tutoring platform and new learning system features.

Turning AI law into obligation lines mapped to controls: reading a law, mapping and gaps, the EU AI Act and US state and local law as dated examples, overlaps and conflicts, and keeping registers current. Not legal advice.

Assurance on an AI management system: the three lines, metrics, internal audit, writing an audit test, ISO/IEC 42001 certification readiness, management review and the board paper, and a finding followed from test to closure.

One sheet per area of AI governance work: the question, the instrument that settles it, how to use it and what it does not prove.

Nine runbooks for the recurring work of AI governance, from the inventory to the board paper, and the eight templates they fill.

Build a governance workspace from the course templates, wire the registers together, seed it with a practice system and verify it.

Four governance cases worked end to end across the modules, including the wrong turns, each ending in a decision, a report card and the point that transfers.

Eight playbooks, one per thing that fires in AI governance, each a procedure to execute from the moment it lands to a recorded disposition.

Every practice-tool scenario and predict block in the course, by module, and the exam.

The sources the course opened, by area, with what each was used for, and the ones that could not be opened.

AI Governance and Risk Management end-of-course exam: 40 questions in four parts, from scope and inventory to assurance and the board, ending on a case study.