Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

AI Governance (AI team leads, innovation, product, legal)

Master AI risk, policy, EU AI Act, NIST AI RMF & agentic AI governance. 14 enterprise templates. Aligned with IAPP AIGP

Role Play

New

Created byVani Aggarwal, Agile Enterprise Coach London

Last updated 7/2026

English

What you'll learn

Identify the hidden AI risks already active inside your organization before your next audit catches them first
Explain why the governance frameworks enterprise buyers demand in 2026 are simpler to implement than most managers assume
Apply a repeatable classification system that tells you exactly which AI tools your team can use, which need controls, and which must stop today
Analyze your vendor contracts for five critical AI-specific gaps that most legal teams have never been asked to close
Build a board-ready AI governance program from scratch using a structured 90-day rollout your leadership will actually fund
Evaluate any AI use case for regulatory exposure across the EU AI Act, GDPR, and sector-specific compliance in under five minutes
Design an incident response process that contains an AI failure in 24 hours before it becomes a headline
Construct governance controls for AI agents that act autonomously — the risk surface that existing policies were never built to handle

Course content

8 sections • 49 lectures • 2h 9m total length

"It Took 90 Seconds to Lose the Lawsuit"1:51
A real court case. A real AI failure. A real company that argued its chatbot was a separate legal entity — and lost. Before you learn how to build the system, you need to understand exactly what happens when one does not exist. This lecture sets the stakes for every decision you will make in this course.

Why Governance Is the Top-Tier Skill of 20262:54
Something changed in the AI landscape that most professionals have not yet noticed — and the ones who have are quietly becoming the most valuable people in their organizations. This lecture reveals the professional shift that is happening right now, and exactly where it places you if you act on it. The numbers are specific. The window is open. Not for long.
The 5 Pillars4:37
Every AI regulation ever written — NIST, ISO, the EU AI Act — traces back to five foundations. Memorize them and every framework you will ever encounter suddenly makes sense. Miss one and your governance program will have a structural gap you may not discover until it is too late. This lecture is the fastest shortcut in the course.
Governance vs. Compliance vs. Ethics vs. Security3:22
These four words are used interchangeably inside most organizations. They are not the same thing. Confusing them is how well-intentioned companies build governance programs with expensive blind spots. This lecture draws the map that most teams have never seen — and explains why giving one function responsibility for all four is a failure waiting to happen.
Who Actually Owns AI Governance4:26
Most companies give AI governance to IT. That decision is the source of more governance failures than any specific AI mistake. There are seven distinct roles that a functioning governance program requires — and most organizations are missing at least three of them right now. This lecture tells you exactly who they are and what each one is responsible for.
The Manager's Liability Stack3:25
AI failures at your company do not stay at the company level. There are four distinct layers of consequence — and one of them lands on your name specifically. This lecture walks through exactly how AI mistakes travel up the org chart in 2026, and what the difference is between a failure that stays in the system and one that becomes personal.
Do You Have the Foundation?

"The Samsung Leak"0:55
Shadow AI: The Risk You Can't See2:20
The most dangerous AI risk in your organization right now is probably one you have never seen on a risk register. It is not a sophisticated attack. It is a well-meaning employee trying to do their job faster. This lecture explains the structural reason shadow AI exists in almost every company — and why banning it without replacing it makes the problem significantly worse.
Data Sovereignty: Where Does Your Prompt Actually Go?2:20
When someone on your team types a prompt into an AI tool, six things happen in the next two seconds. Most organizations only know about two of them. The ones they are missing carry the most legal exposure. This lecture maps the full journey — including the steps that determine whether your company is compliant or not, regardless of what your policy says.
Public vs. Enterprise LLMs: Why "Free" Is More Expensive2:15
There is a version of every major AI tool that costs nothing and a version that costs money. They look almost identical. The legal architecture beneath them is completely different. This lecture runs the math that most procurement conversations skip — and explains the one contractual difference that determines your regulatory exposure in a breach.
Hallucination 101: Why LLMs Predict, Not Know2:25
There is a fundamental misunderstanding about how large language models work that is causing real harm inside real organizations right now. Fixing it takes one insight — but that insight changes how every member of your team should be using AI from this point forward. This lecture gives you that insight, with a case study that has already cost one professional their reputation.
The Verification Loop2:04
There is a three-step discipline that separates managers who use AI safely from those who are one output away from a serious mistake. It takes ninety seconds. Most teams have never been taught it. This lecture gives it to you in full — with a downloadable cheat sheet your team can apply from tomorrow morning.
Bias, Drift, Leakage, Misuse: The Four Risk Surfaces2:53
Almost every AI failure that makes headlines is a variation of one of four risk surfaces. Knowing the four means you can identify a governance gap before it becomes an incident. This lecture names them, illustrates each with a real organizational failure, and explains why three of them are invisible without a specific type of monitoring most companies do not yet have.
The Risk Triage Matrix2:14
Every AI use case in your organization belongs in one of four tiers — and the tier it belongs in determines exactly what controls are required. This lecture gives you the classification system that replaces the question "should we use this?" with a decision that takes under sixty seconds. The matrix is downloadable. The decision criteria are specific. The ambiguity ends here.

Four Regimes, One Product Launch0:56
NIST AI RMF: The Govern, Map, Measure, Manage Loop3:54
There is a framework built by the US federal government that has quietly become the de facto baseline for AI governance globally — and most managers have never read it. Enterprise buyers ask about it. Procurement teams require it. Regulators cite it in litigation. This lecture gives you the working knowledge in six minutes that most courses take six hours to deliver.
ISO 42001: What Certification Actually Requires2:31
The world's first international management system standard for AI was published in 2023 — and the largest enterprise buyers are beginning to require it the way they once required ISO 27001 for security. There is one critical difference between this standard and every other framework in this course. This lecture explains what it is, and why it matters for how your company is evaluated by its biggest customers.
The EU AI Act, Decoded4:12
The EU AI Act carries penalties of up to 35 million euros — calculated against global annual turnover, not EU revenue. It is now in active enforcement. Most managers know it exists and have never read it. This lecture gives you the risk tier architecture, the specific obligations that apply to your use cases, and the compliance timeline in plain language — without a single paragraph of legal text.
What the EU AI Act Means If You're Not in the EU2:32
There is a specific condition in the EU AI Act that catches non-European companies by surprise — and most legal teams have not yet flagged it to their business units. If your AI system's output is used anywhere in the EU, the Act may apply to you regardless of where you are headquartered. This lecture explains exactly how that works, with the historical precedent that tells you where this is going.
GDPR, HIPAA, and Sector Overlap: The Compliance Stack2:45
No regulation operates in isolation. The companies that get into compliance trouble are almost always the ones that handled their regulations one at a time. There are five layers of obligation that stack on top of each other in most enterprise AI deployments — and one interaction between two of them that almost every manager in a people function has missed. This lecture draws the full stack.
Translating Frameworks Into a One-Page Operating Model2:18
Frameworks are useful for credibility. Laws are useful for boundaries. Neither is useful for a manager trying to make a real decision on a Tuesday. This lecture gives you the five-question front door that replaces every lengthy governance conversation in your organization — and a downloadable one-page model that turns the entire compliance stack into daily operational practice.
Can You Use the Frameworks, Not Just Name Them?

Meet Maya0:57
The Traffic Light Framework2:40
There is a classification system so simple that every employee in your organization can remember it — and so precise that it handles almost every AI governance decision a manager faces. Green. Yellow. Red. This lecture applies the system to a real team's real tools and surfaces something most managers discover when they run this exercise themselves: a significant portion of what they thought was green is actually yellow. Or red.
Building Your AI Task Force2:07
You cannot govern AI alone. But you also do not need a large team — you need four specific roles, and the right one in each. Most governance programs are missing at least one. The one that is missing is almost always the one where the next failure comes from. This lecture names the four, explains what each one does, and tells you the single biggest mistake organizations make when they try to run all four through the same function.
The RACI for AI Decisions3:05
The most common AI governance failure is not a bad decision. It is an unmade decision — one that fell between functions because no one knew they owned it. This lecture applies the RACI framework to the four AI decisions that matter most inside every organization, with specific examples of what each role is responsible for and what gets broken when someone is missing from the map.
The Internal Audit: Surveying Your Team's Real AI Usage2:13
If you ask your team what AI tools they are using, most of them will not tell you the truth. Not because they are dishonest. Because they are afraid. This lecture explains the psychology behind AI disclosure inside teams, gives you the exact six-question audit that surfaces what is actually happening, and hands you the language that makes employees feel safe enough to tell you.
The CFO's 30-Day Ultimatum
Designing the Acceptable Use Policy: Part 13:31
The AUP is the most important document in your governance program. It is also the document most companies get wrong — either too long to be usable, too generic to be enforceable, or too vague to protect anyone. This lecture walks through the first four sections of a three-page AUP that legal can approve and employees will actually read. The template is downloadable. The decisions are already made for you.
Enforcing the AUP: Part 23:19
A well-written AUP that no one follows is theater. The sections that determine whether a policy holds up in practice — required practices, prohibited practices, and consequences — are the sections most templates treat as afterthoughts. This lecture gives you the three remaining sections that turn a document into an enforceable agreement, including the one consequence structure that makes employees take policy violations seriously without destroying the reporting culture you need.
Psychological Safety: Why People Hide AI Mistakes2:45
Most AI incidents are discovered late. Not because they are technically hard to detect — because the person closest to the incident hid it. This lecture explains the specific fear architecture that prevents employees from reporting AI problems, and gives you two practices that dismantle it. Without these two practices, every other element of your governance program is working with incomplete information.
The Amnesty Conversation
Briefing the Board: AI Risk in 10 Slides3:49
Most AI governance briefings to senior leadership fail in the same way. This lecture gives you the ten-slide structure that does not. Each slide has a specific job. The deck runs twenty minutes. Leaders leave with confidence rather than confusion — and with specific asks they can actually act on. The template is downloadable. The talking points are in the course.
The Board Member Who Read the Newspaper
The Maya Test

The vendor we trusted1:16
The Vendor Vetting Checklist: 12 Questions That Reveal Risk3:17
Most companies vet AI vendors with the same checklist they use for any SaaS tool. That checklist is missing twelve questions that have become non-negotiable in 2026 — and vendors who cannot answer them cleanly are telling you something important. This lecture gives you all twelve, the scoring rubric, and the red flags that disqualify a vendor regardless of their total score.
Data Lineage: Knowing Where Your Training Data Came From2:35
Your AI system is, in a fundamental sense, a function of the data that built it. If that data has provenance problems — rights issues, consent gaps, regulatory violations — those problems are now inside your product. Most organizations cannot trace the lineage of their training data with any precision. This lecture explains the three categories of data lineage every governance program must track, and where to start.
Model Documentation and Change Management2:11
Software has version control. Most AI deployments do not. There are three documents every AI deployment should maintain — and most companies have none of them. The absence of these documents is what turns a contained vendor incident into a compliance exposure you cannot explain to a regulator. This lecture names the three, tells you what each one must include, and shows you why the absence of even one creates a gap in your audit trail.
The 5 Clauses Every AI Vendor Contract Needs2:55
Standard SaaS contracts were not written for AI. They are missing five clauses that have become essential in 2026 — and vendors who resist them are telling you exactly where their governance program ends. This lecture walks through each clause, what it must say to be enforceable, and the negotiation positions vendors typically take so you know where to hold firm and where the fallback is.
The Vendor Who Will Not Move
Continuous Monitoring: Drift, Bias, and Output Quality2:28
An AI system that performed well at deployment can perform badly six months later without anyone changing anything. The world moved. The model did not. This lecture explains the three things every operational AI deployment must monitor, why two of them are invisible without a specific practice most companies have not built, and what the consequence looks like when monitoring is absent versus when it is working.

The Agent That Deleted Production0:52
GenAI vs. Traditional AI: Why Governance Has to Adapt2:19
Everything your governance program was built to handle assumed a specific kind of AI. Generative AI broke three of its core assumptions — and most policies written before 2024 have not caught up. This lecture identifies the three fundamental shifts and explains why the implications are not theoretical. They are already visible in the gap between what your AUP says and what your team is actually doing.
Prompt Governance: Yes, Prompts Need Policies Too2:35
Most organizations govern the AI tools their employees use. Almost none govern what employees put into those tools. There are three categories of prompts inside your organization right now — and one of them behaves exactly like software, carries all of software's governance requirements, and is currently being managed by nobody. This lecture defines the three, assigns the right control to each, and names a specific attack surface most security teams have not yet added to their threat model.
The Output Review Standard: Disclosure, Attribution, IP2:17
When AI-generated content leaves your organization, three questions must be answered before it goes. Most organizations have answered none of them formally. The legal and reputational exposure that comes from getting even one of them wrong is specific, documented, and growing. This lecture gives you the standard, the three checks, and the cultural posture that holds up over time.
Agentic AI: The New Risk Surface2:46
An AI agent does not wait for your approval at every step. It takes a goal, plans a sequence of actions, and executes — sometimes for hours, across multiple systems, without checking back in. Every governance practice built before agents existed assumed a human was in the conversation. That assumption no longer holds. This lecture names the three risk surfaces that agents introduce and explains why they interact in ways that make each one significantly more dangerous.
Autonomy Gradients: When to Let Agents Act, When to Gate3:06
Aviation solved a version of this problem decades ago. For every function on an aircraft, designers explicitly decided how much authority the automation had versus how much the pilot retained. That decision was documented, per function, before anything flew. This lecture applies the same discipline to agentic AI — five levels of agent autonomy, the conditions under which each is appropriate, and the specific failure that happens when an agent is operating at a higher level than anyone realized.
Tool-Use Authorization and Agent Audit Logs2:36
An agent that can do anything can hurt anything. The discipline of agentic governance is to give the agent the smallest set of capabilities it needs, limit the actions it can take within those capabilities, and log everything it does. This lecture gives you the three-control framework — capability scoping, action-level authorization, and audit logging — with the specific limits that prevent the most common and most costly agentic failures.
The Human-in-the-Loop Reality Check3:04
Human-in-the-loop has been the dominant principle of responsible AI for a decade. It is not wrong. But there are three ways the implementation fails in practice — and one of them is active in almost every organization that has deployed an agent and believes human oversight is in place. This lecture names all three, explains the aviation-borrowed design principles that make oversight real rather than nominal, and closes the gap between what your governance program says and what is actually happening.

The Three Teardowns1:32
The 24-Hour AI Incident Response Playbook3:47
The first twenty-four hours after an AI incident determine the rest of the story. There is a specific order in which things must happen — and organizations that get the order wrong spend years managing the consequences of the response rather than the original failure. This lecture gives you the six-step playbook, the named roles, the decision points, and the one mistake in Step One that causes more escalations than any technical failure.
The Incident at 2 PM
Communication Strategy: Internal, External, Regulator2:57
AI incidents are communication crises wearing technical disguises. There are three audiences, each with different timing rules and different messages — and the sequence in which you communicate to them determines how the story ends. This lecture gives you the principles, the templates, and the lesson from the case study where four sentences was enough to recover — and the counter-case where thousands of words made everything worse.
Documentation: What to Capture in the First Hour2:30
The first hour of an incident is when documentation matters most and when it is most likely to be skipped. There are five categories of information that must be captured in real time — not reconstructed later. Missing any one of them creates a gap that affects every legal, regulatory, and organizational step that follows. This lecture gives you the five, explains why each is irreplaceable, and introduces the one role in the incident response team that most companies have not named.
Post-Mortem Discipline: Avoiding the Same Mistake Twice2:46
Most organizations that have AI incidents have them more than once. The reason is almost never technical. It is the absence of one practice — done correctly — that separates companies that learn from incidents from companies that repeat them. This lecture gives you the four characteristics of a post-mortem that actually works, the template for running one, and the cultural condition that determines whether the findings become lasting improvements or filed documents nobody reads again.
The Agent That Went Too Far
Judgment Under Pressure

Requirements

You work in or lead a team that uses, evaluates, or deploys AI tools in a professional setting
Basic familiarity with how large language models work (you have used ChatGPT, Copilot, or a similar tool)
No legal, technical, or compliance background required
No prior governance or policy experience required
A willingness to apply what you learn to your actual organization starting this week

Description

The Question Every Manager Will Be Asked in 2026

At some point in the next twelve months, someone above you — your CFO, your board, your largest enterprise customer, or a regulator — is going to ask you a direct question.

"How are we governing AI inside this organization?"

If you do not have a complete, defensible answer ready — not a vague policy document, not a half-finished tool list, not a verbal reassurance — the consequences will range from uncomfortable to career-defining.

This course is how you build that answer. Before the question arrives.

What This Course Is

AI Governance: The Corporate Guardrails is a 3.5-hour, enterprise-focused course designed for managers, compliance professionals, risk leaders, and executives who are accountable for how AI is used inside their organizations — and who need a practical, audit-ready governance program, not a theoretical framework lecture.

The course is structured across eight sections, forty-eight focused lectures, and fourteen downloadable templates that are ready to customize and deploy from the moment you complete the course. Every section builds on the last. Every lecture ends with something you can act on.

The course is aligned with the IAPP AIGP Body of Knowledge v2.1 — the same standard that governs the Artificial Intelligence Governance Professional certification, the fastest-growing governance credential in the world. This is not an exam preparation course. It is the foundational course that makes exam preparation efficient — and that makes you immediately useful to your organization before you ever sit for an exam.

The Problem This Course Solves

AI adoption inside organizations has outpaced the governance structures designed to manage it. The result is a gap — between what employees are doing with AI tools every day and what organizations have formally authorized, monitored, and protected.

That gap is not theoretical. It is the source of the data leaks, regulatory fines, discrimination lawsuits, chatbot liability rulings, and reputational incidents that are quietly reshaping how regulators, enterprise buyers, and boards think about AI risk.

Most organizations are managing this gap with one of three approaches — all of which fail.

The first approach is a blanket ban. Employees stop reporting what tools they use. Shadow AI goes underground. Nothing is actually safer; it is just less visible.

The second approach is a vague policy. A one-page document that nobody has read, does not map to any real tool or workflow, and would not survive five minutes of legal scrutiny.

The third approach is waiting. Waiting until an incident forces the issue. By that point, the cost of governance is a fraction of the cost of recovery.

This course is the fourth approach. Building the system before you need it, with frameworks that hold up under audit, policies that employees will actually follow, and controls that contain failures when — not if — they occur.

What You Will Be Able to Do After This Course

Completing this course will change how you operate as a professional working alongside AI. Not abstractly. Specifically.

You will be able to walk into a room with your legal team, your CISO, your CFO, or your board and lead a structured conversation about AI risk — with the vocabulary, the frameworks, and the documented program to back it up.

You will be able to look at any AI tool, workflow, or vendor relationship inside your organization and classify it by risk tier, identify the controls it requires, and trace its compliance exposure across the EU AI Act, GDPR, NIST AI RMF, and sector-specific regulation — in under five minutes.

You will be able to respond to an AI incident — a data leak, a hallucinated output that reached a customer, an agent that acted outside its authority — within twenty-four hours, using a structured playbook with named roles, defined communication protocols, and a documentation trail that protects your organization legally and reputationally.

You will be able to evaluate an AI vendor contract and identify the five clauses that standard SaaS agreements routinely omit — the clauses that determine your exposure when a vendor silently swaps the model underlying their product, uses your data to train their systems, or processes your regulated data in a jurisdiction you did not authorize.

You will be able to design an Acceptable Use Policy that legal will approve and employees will actually read — structured in plain language, tiered by risk classification, and enforced through a consequence framework that makes the policy real rather than advisory.

You will be able to govern agentic AI — autonomous systems that act on multi-step goals without per-action human approval — using a control framework built specifically for the risks that traditional governance policies were never designed to handle.

And you will be able to build a governance program from scratch in ninety days, using the structured rollout plan in the course, in a way that secures executive sponsorship, establishes operational cadence, and produces the deliverables that enterprise buyers, auditors, and regulators are increasingly expecting to see.

The Fourteen Templates You Will Download

One of the most immediate practical outputs of this course is a set of fourteen enterprise-ready templates, built around a running scenario — a mid-sized B2B software company — so that every artifact feels real rather than generic. Each template is designed to be customized and deployed inside your organization, not filed away as course materials.

The fourteen templates cover governance ownership mapping, risk triage classification, output verification discipline, framework-to-action translation, EU AI Act risk tier classification, Traffic Light workflow classification, Acceptable Use Policy design, board-level briefing structure, vendor vetting and scoring, AI vendor contract clause negotiation, agentic AI authorization, incident response execution, ninety-day program rollout planning, and AIGP certification roadmapping.

Each template is available for download in the resources section of its corresponding lecture.

The Frameworks You Will Master

This course teaches the three governance frameworks that enterprise procurement teams, corporate legal departments, and regulatory bodies in 2026 expect organizations to demonstrate alignment with.

NIST AI Risk Management Framework (AI RMF). Published by the US National Institute of Standards and Technology, this is the de facto baseline for AI governance in the United States and is increasingly cited globally. The course translates the framework's four core functions — Govern, Map, Measure, Manage — into the specific organizational decisions and daily operations of a working governance program.

ISO/IEC 42001. The world's first international management system standard for artificial intelligence. Unlike NIST, ISO 42001 is a certifiable standard — organizations can be audited against it and receive a third-party certificate. The course explains what certification actually requires, how it differs from self-attestation frameworks, and how to assess whether your organization is ready to pursue it.

EU AI Act. The first comprehensive AI law in the world, now in active enforcement. The course decodes the Act's risk tier architecture — prohibited, high-risk, limited risk, minimal risk — maps the compliance timeline, explains the penalty structure, and addresses the specific provision that brings non-European companies into scope without them realizing it. The course also explains the Act's interaction with GDPR, sector-specific regulation, and the obligations it places on both AI providers and AI deployers.

Beyond the three primary frameworks, the course covers the intersection with GDPR, HIPAA, India's DPDP Act, South Korea's AI Basic Law, and the emerging US state-level AI regulation landscape — giving learners a working understanding of the multi-jurisdictional compliance environment most enterprise organizations now operate in.

The AI Risks You Will Learn to Identify and Manage

The course maps the complete AI risk landscape as it exists in 2026 — not as a theoretical taxonomy, but as a set of live risk surfaces that are active inside most organizations right now.

Shadow AI — the unauthorized AI tools already in use inside your organization, creating data exposure, vendor opacity, and compliance blindness that your current tool inventory does not capture.

Data sovereignty violations — the specific mechanics of how prompt data travels across borders, enters vendor training pipelines, and creates regulatory exposure that most employees generating that data have never been told about.

Hallucination-driven harm — the structural reason large language models produce confident, fluent, specific outputs that are entirely fabricated — and the professional consequences for the humans who sign work that contains them.

Algorithmic bias — how AI systems encode and amplify patterns from historical training data in ways that produce systematically different outcomes for protected groups, and why technically correct systems can produce legally and ethically indefensible results.

Model drift — the invisible degradation of AI system accuracy over time as real-world data distributions shift away from training conditions, and why it is almost always discovered through consequences rather than monitoring.

Data leakage — the pathways through which sensitive organizational, customer, and regulated data flows from controlled environments to uncontrolled ones through AI tool use, and why the Samsung semiconductor incident was not an anomaly.

Agentic AI risk — the three risk surfaces specific to autonomous AI agents that act on multi-step goals: cascade risk, authorization scope violations, and attention failure in human-in-the-loop oversight.

Who Designed This Course and Why

This course was designed for one reason. The gap between the pace at which organizations are adopting AI and the pace at which they are building the structures to govern it is growing — not shrinking. And the professionals inside those organizations who will be asked to close that gap are, in most cases, not being given the tools to do it.

The course was structured to give managers and governance professionals a working program — not a reading list, not a conceptual overview, not a theoretical framework — within 3.5 hours. Every section is practical. Every lecture produces something actionable. Every template is ready to customize.

The course does not require a legal background, a technical background, or prior governance experience. It requires that you are accountable for AI use inside your organization, or will be soon, and that you are willing to build the system rather than wait for someone else to.

The Transformation

Before this course, AI governance is something your organization talks about and defers. The policy is a draft. The vendor contracts have gaps nobody has addressed. The team is using free-tier tools nobody has formally sanctioned. The incident response process does not exist.

After this course, AI governance is something your organization does. The program is documented. The tools are classified. The vendor relationships are contract-governed. The team knows the policy, understands why it exists, and has a channel to report when something goes wrong. The board has been briefed. The ninety-day plan is on the executive calendar.

The gap between those two states is 3.5 hours, fourteen templates, and the decision to build the system before you need it.

Frequently Asked Questions

What is AI governance and why does it matter for businesses in 2026?

AI governance is the set of policies, processes, roles, and controls that determine how artificial intelligence systems are developed, deployed, monitored, and managed inside an organization. It matters in 2026 because the regulatory landscape has fundamentally changed — the EU AI Act is in active enforcement, GDPR applies to AI-processed personal data, and sector-specific AI regulations are activating in healthcare, finance, employment, and critical infrastructure globally. Organizations that deploy AI without governance structures face regulatory fines, litigation exposure, reputational risk, and loss of enterprise customer trust. This course builds the governance program that manages all of those exposures.

What is the EU AI Act and how does it affect companies outside Europe?

The EU AI Act is the world's first comprehensive AI law, passed by the European Parliament in March 2024 and now in active enforcement. It classifies AI systems by risk tier — prohibited, high-risk, limited risk, and minimal risk — and assigns compliance obligations based on that classification. It applies to any organization that places AI on the EU market, uses AI in the EU, or whose AI output is used in the EU — regardless of where the organization is headquartered. This third condition is the one that brings a significant number of non-European companies into scope without them realizing it. The course covers the Act in depth, including its risk tiers, compliance timeline, penalty structure, and interaction with GDPR and sector-specific regulation.

What is shadow AI and why is it one of the biggest enterprise AI risks?

Shadow AI refers to any AI tool used by employees for work-related purposes that has not been formally approved by the organization's IT or governance function. It is one of the most significant enterprise AI risks in 2026 because it creates data exposure without organizational visibility — employees paste sensitive company data, customer data, and regulated data into tools whose terms of service the organization has never reviewed, whose data residency is unknown, and whose training rights may include the data being submitted. A 2024 study found that nearly half of all knowledge workers were using unsanctioned AI tools. The course covers how to discover shadow AI inside your organization, why banning it without replacing it makes the problem worse, and how to build the approval pathways that eliminate it systematically.

What is NIST AI RMF and why should my organization align to it?

The NIST AI Risk Management Framework is a voluntary framework published by the US National Institute of Standards and Technology that provides structured guidance for managing AI risk across the full AI lifecycle. It is organized around four core functions: Govern, Map, Measure, and Manage. It has become the de facto baseline for AI governance in the United States and is increasingly referenced globally — in enterprise procurement requirements, in US litigation involving AI harms, and in federal contracting requirements. Aligning to NIST AI RMF is the fastest credibility move a governance program can make, and the course provides a practical translation of the framework into operational decisions and daily activities.

What is the AIGP certification and is this course an exam preparation course?

The AIGP — Artificial Intelligence Governance Professional — is a certification offered by the IAPP (International Association of Privacy Professionals). It is the leading professional credential in AI governance globally, with certified professionals reporting average salaries of approximately $182,000 USD. This course is not an AIGP exam preparation course. It is a foundational course structured around the AIGP Body of Knowledge v2.1 — the same domains that the certification exam tests. Completing this course gives you the working knowledge and practical experience that makes formal exam preparation efficient. The course includes a dedicated lecture on the AIGP certification path and a downloadable roadmap for pursuing certification after completing this course.

What is agentic AI and why does it require different governance controls?

Agentic AI refers to AI systems that take a goal, plan a sequence of actions to achieve it, and execute those actions autonomously — using external tools, calling APIs, reading and writing files, sending communications, and making decisions — often for extended periods without per-action human approval. Traditional AI governance was designed for a model where a human types a prompt and reviews a response. Agentic AI collapses that model, creating three risk surfaces that traditional governance does not address: cascade risk (errors compound across action sequences), authorization scope violations (agents act beyond intended boundaries), and attention failure (nominal human-in-the-loop oversight that is not functionally real). The course dedicates a full section to agentic AI governance, including autonomy gradient frameworks, capability scoping, action-level authorization, and audit logging requirements.

How long does it take to complete this course and when will I see results?

The course is 3.5 hours of video content, structured across eight sections and forty-eight lectures. Most learners complete it across two to three focused sessions. The course is designed so that results begin immediately — the fourteen downloadable templates are usable from the day you complete the relevant section, and the course's final lecture gives you three specific actions to take within twenty-four hours of completing the course. Learners who follow the thirty-sixty-ninety day rollout plan included in the course typically have a documented, operational governance program in place within three months of completing it.

Is this course relevant if my company is small or if I am not in a technical role?

Yes. The course was designed specifically for professionals who are accountable for AI use inside their organizations but do not have a legal, technical, or compliance background. The frameworks are translated into plain-language decisions. The templates are ready to customize without specialist knowledge. The course is relevant at companies of any size where AI tools are in use — which, in 2026, includes almost every professional organization — and it is designed for managers, directors, HR leaders, risk professionals, and executives, not for engineers or data scientists.

What industries is this course most relevant for?

The course is relevant for any organization deploying AI in a professional context. It is particularly high-impact for organizations in industries with specific AI regulatory exposure: healthcare (HIPAA interaction with AI, clinical AI governance), financial services (credit scoring, investment advice, fraud detection governance), human resources (AI in hiring, performance evaluation, and workforce management), legal (AI in legal research, contract review, and advice generation), marketing and communications (AI-generated content, disclosure obligations, IP exposure), technology and SaaS (vendor governance, model documentation, enterprise customer requirements), and any organization with EU customers or users that may bring EU AI Act obligations into scope.

What makes this course different from other AI governance courses?

Most AI governance courses are built by compliance instructors and deliver regulatory information in lecture format. This course was built differently. Every concept is translated into an operational decision. Every section produces a downloadable artifact. Every risk is illustrated with a real organizational failure — not a hypothetical. The course follows a single running scenario across its most operational section, allowing learners to apply every tool to a consistent context before transferring it to their own organization. The result is not a course you finish and reference occasionally. It is a course you finish and immediately deploy.

A Note on Content Evergreen Design

This course was built to remain relevant and actionable for a minimum of twelve to eighteen months without requiring significant updates. Regulatory references are sourced from official documentation. Framework content reflects the most current published versions of each standard. Trend-sensitive content — agentic AI, current enforcement timelines, certification landscape — is clearly identified within the course as the content most likely to evolve, so learners can prioritize updating their knowledge in those areas first as the landscape shifts.

Enrollment

If AI is being used inside your organization — and it is — the question is not whether you need a governance program. The question is whether you build it before the audit, the incident, or the enterprise customer requirement that makes it unavoidable.

Three and a half hours. Fourteen templates. One complete governance program.

Enroll now.

Who this course is for:

Managers and team leads who are accountable for how their teams use AI but have no formal governance system in place yet
Risk, compliance, legal, and privacy professionals who need to extend their existing programs to cover AI-specific exposure
HR, L&D, and People leaders responsible for AI policy, workforce training, or employment-related AI use
IT, security, and product leaders who approve, deploy, or integrate AI tools and need a governance framework to operate within
Executives and directors who will be asked by their board, their auditors, or their enterprise customers to demonstrate that AI is being governed responsibly

AI Governance (AI team leads, innovation, product, legal)

What you'll learn

Explore related topics

Course content

COLD OPEN1 lecture • 2min

The Governance Mindset5 lectures • 19min

The AI Risk Landscape8 lectures • 17min

The Frameworks That Buyers Actually Care About7 lectures • 19min

The Manager's Playbook12 lectures • 24min

Vendor, Data & Model Governance7 lectures • 15min

Generative & Agentic AI — The 2026 Frontier8 lectures • 20min

Incident Response & Crisis Management7 lectures • 14min

Requirements

Description

Who this course is for: