IAPP AI Governance Professional

Risk in AI reaches individuals, groups, organizations and society. You catalog the harms that matter, from discrimination and privacy loss to security failure and misinformation, and learn to tell who is exposed when a system goes wrong.

• Harms to individuals and groups
• Bias, discrimination and unequal error rates
• Privacy, security and safety harms
• Misinformation, manipulation and intellectual property harm
• Harms to the organization and to society
• Tracing a harm back to a design choice

You build A harm register for one AI use case, with the people affected named.

Principles only matter when they change decisions. You work through fairness, transparency, explainability, accountability, safety and human oversight, plus the OECD principles, and turn each into a question a project team can answer.

• Fairness and non-discrimination
• Transparency and explainability
• Accountability and human oversight
• Safety, reliability and security
• Privacy and data protection as design principles
• The OECD AI principles
• Turning principles into design requirements

You build A principles checklist that a project team can apply at a design review.

An AI program needs owners. You design the committees, roles and reporting lines that bring legal, privacy, security, data science and the business together, and plan the training that gives each group what it needs.

• Executive sponsorship and an AI governance committee
• Roles: product owner, model owner, reviewer, approver
• Working with privacy, security and legal teams
• AI literacy and role-based training
• Building a culture that reports problems
• Escalation paths for AI concerns

You build A governance charter with roles, decision rights and an escalation path.

Policies make governance repeatable. You inventory the AI in use, tier systems by risk, write an acceptable-use policy and standards for each stage from idea to retirement, and bring third-party AI under the same rules.

• Taking an inventory of AI systems
• Risk tiering and what each tier requires
• Acceptable-use policies for employees
• Standards across the life cycle: plan, build, deploy, retire
• Third-party and procurement risk
• Exceptions and policy review

You build An AI inventory and a risk-tiering policy applied to ten example systems.

Much of AI is already regulated by laws written for other things. You apply data protection, anti-discrimination, consumer protection, product liability and intellectual property law to AI systems, including the rules on automated decisions.

• Data protection rules and automated decision-making
• Anti-discrimination law and algorithmic bias
• Consumer protection and misleading AI claims
• Product liability for AI-enabled products
• Copyright, training data and generated output
• Trade secrets, confidentiality and contracts

You build A legal issues memo for an AI product, mapped to the laws that apply.

The EU AI Act is the first broad law written for AI. You learn its risk-based structure, who counts as a provider or a deployer, what prohibited and high-risk systems require, the rules for general-purpose models, and how it is enforced.

• The risk-based structure and its tiers
• Scope, providers, deployers and other roles
• Prohibited practices
• High-risk systems and their requirements
• Transparency duties and general-purpose models
• Conformity, documentation and enforcement

You build A classification of five example systems under the Act, with the reasons for each.

Frameworks give a program its shape. You compare the NIST AI Risk Management Framework, ISO/IEC 42001 and OECD guidance, and learn to combine them into one approach that also satisfies the laws you operate under.

• The NIST AI RMF: govern, map, measure, manage
• ISO/IEC 42001 and an AI management system
• OECD guidance and other international instruments
• Comparing frameworks and choosing a primary one
• Mapping law and standards into one control set
• Using certification and audit evidence

You build A crosswalk that maps laws and frameworks to one set of AI controls.

Controls are cheapest during design. You plan a project with a clear purpose, run impact assessments, govern training data and its lineage, test for bias and safety, and decide when a system is ready to release.

• Defining purpose, scope and success before building
• AI impact assessments
• Data governance, quality and lineage
• Rights to use data for training
• Testing, red teaming and bias evaluation
• Model cards and documentation
• Release readiness and sign-off

You build An impact assessment and a release checklist for a model in development.

Deployment is where risk meets people. You decide whether to deploy and how, review vendor and license terms, monitor systems in use, handle incidents, communicate externally, and know how to switch a system off.

• Deciding whether to deploy: build, buy or adapt
• Model types and deployment options
• Vendor due diligence and license terms
• Continuous monitoring and performance thresholds
• Incident records and response
• External disclosure and communication
• Deactivation and decommissioning

You build A deployment review for a purchased AI tool, with contract points and a shutdown plan.

One system carries the whole course. You assess a proposed AI use case against law, framework and policy, set the controls for its build and deployment, and present the decision to a governance committee.

• Scoping a real use case
• Classifying risk and applicable law
• Setting controls for build and deployment
• Preparing the committee paper
• Defending the decision and recording it

You build A governance file and committee paper for one AI system, from proposal to monitoring plan.