Decide how an organisation may use AI, manage its risks, and prove it meets the law and standards such as the EU AI Act, ISO/IEC 42001 and the NIST AI RMF.
Estimated time: 14–26 months · At about 10 hours a week.
Learning path
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Explain the NIST AI RMF functions and the EU AI Act risk levels.
Build an AI inventory with owners and risk levels.
Write a clear acceptable use policy for generative AI.
Hands-on projects and labs
Build an AI inventory for a real or fictional organisation, including AI features in common SaaS tools.
Classify ten example AI uses under the EU AI Act risk levels and explain each choice.
Write a one-page AI acceptable use policy and test it on a non-technical reader.
Done when you can…
Explain which EU AI Act duties apply to a given AI system, and why.
Present an AI inventory and its top risks to a manager.
Beginner
What makes AI risk different
AI systems can be wrong in ways that are hard to predict, can treat groups unfairly, can be attacked through their data and can change as they learn. Traditional IT risk methods need extending.
The Act sorts AI by risk: banned uses, high-risk systems with strict duties, transparency duties for chatbots and deepfakes, and rules for general-purpose AI models.
The management system standard for AI, built like ISO/IEC 27001: policy, roles, risk assessment, controls, monitoring and improvement. Organisations can be certified against it.
Fairness, transparency, accountability, privacy, safety and robustness appear in almost every framework. Learn what each means in practice, not just as a word.
You cannot govern what you cannot see. List every AI system built or bought, its owner, purpose, data, model provider and risk level, including AI features inside SaaS tools.
Tell staff which AI tools they may use, which data they must never paste in, and how to get a new tool approved. Keep it short enough that people read it.
Run an AI risk assessment and an impact assessment.
Assess an AI vendor with a structured questionnaire.
Map AI risks to controls and to ISO/IEC 42001.
Write transparency documentation for an AI system.
Hands-on projects and labs
Assess a real public AI product (from its published documentation) against the NIST Generative AI Profile.
Write a vendor questionnaire for a generative AI tool and fill it in from the vendor's public documents.
Write a model card for a model you trained or downloaded.
Done when you can…
Deliver a risk assessment with treatment decisions that an engineering team accepts.
Explain a system's limits and oversight design to a non-technical committee.
Intermediate
AI risk assessment
Identify what can go wrong for the organisation, for users and for affected people, rate likelihood and impact, and decide on treatment. ISO/IEC 23894 gives the method.
Look at effects on people's rights, safety and access to services. The AI Act requires a fundamental rights impact assessment for some deployers of high-risk systems.
Confabulation, data leakage, harmful content, intellectual property, information security and more. NIST's Generative AI Profile lists them with suggested actions.
Most AI is bought. Ask vendors how models are trained, whether your data is used for training, where it is processed, how they test and how they handle incidents.
Training and using AI on personal data needs a lawful basis, transparency and data protection impact assessments under laws such as GDPR. Work closely with the privacy team.
Turn risks into controls: data governance, testing, human oversight, logging, access control and security. Map them to ISO/IEC 42001 Annex A and your security framework.
Model cards, system cards and user notices explain what a system does, its limits and how it was tested. The AI Act requires some of this documentation.
Risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness and cybersecurity, plus conformity assessment and registration.
Providers of general-purpose models must document them, respect copyright and publish a training data summary. Models with systemic risk need evaluations, incident reporting and cybersecurity.
Test whether controls exist and work: sample risk assessments, check that tests ran, look at monitoring and oversight records. Evidence beats policy documents.
Report the size of the AI inventory, risk levels, open findings, incidents and compliance status. Keep it short and tied to decisions the board must make.
Beyond the EU, follow national laws, sector rules (finance, health, employment) and voluntary codes. Map them to one set of controls instead of a separate programme for each.
Represent the organisation with regulators and standards bodies.
Hands-on projects and labs
Write an AI governance charter and risk appetite statement for a fictional company.
Respond to a public consultation on AI regulation or a code of practice.
Done when you can…
Run AI governance for a whole organisation.
Be the person the board asks before approving a major AI project.
Expert
AI risk appetite and strategy
Agree with the board which AI uses are welcome, which need extra care and which are off limits. Governance should help good projects move faster, not only block bad ones.
Respond to consultations, join standards work and follow codes of practice as they are written. Early involvement helps you prepare and shapes better rules.
AI governance is the set of rules, roles and processes that decide which AI systems an organisation builds or buys, how their risks are assessed, and who is accountable when something goes wrong. Risk management finds and treats those risks; compliance shows that the law and the chosen standards are met.
The field is young but now has firm anchors: the EU AI Act, the ISO/IEC 42001 management system standard and the NIST AI Risk Management Framework. The work combines policy writing, risk assessment, working with engineers and auditors, and explaining technical risks in plain language.
Why it matters
The EU AI Act applies in stages from 2025, and customers, regulators and boards now ask how AI is controlled. Most organisations are still building this capability, so there is strong demand for people who understand both the rules and the technology.
Typical job roles
EntryAI governance analystKeeps the AI inventory, runs intake questionnaires and tracks risk assessments.
Mid-levelAI risk and compliance specialistAssesses AI systems against the AI Act, ISO/IEC 42001 and internal policy.
Mid-levelAI auditorTests whether AI controls exist and work, and reports to management or clients.
SeniorResponsible AI leadRuns the governance programme and works with legal, product and engineering.
LeadChief AI officer or head of AI governanceOwns AI strategy and risk appetite at board level.
Prerequisites
A basic understanding of how AI and machine learning systems are built and used.
Security or privacy GRC basics: risk registers, controls, policies and audits.
Clear writing, for policies and reports that non-specialists can follow.