AI Security Governance, Risk, and Compliance

Preview the shift from building AI systems to governing them, confirm the Python and spreadsheet prerequisites, and tour the browser-based workspaces where every exercise runs.

Learn how explainable AI (XAI) and SHAP enable security auditors to detect bias, assess model risk, and create defensible audit findings for black-box models.

Audit AI for security using SHAP: investigate model decisions, detect proxy biases, perform counterfactuals, and draft clear audit memos for stakeholders.

Learn to implement the NIST AI Risk Management Framework's Govern, Map, Measure, Manage loop to identify, track, and mitigate AI-specific risks in dynamic environments.

Apply the NIST AI Risk Management Framework to assess, score, and visualize AI risks, build risk registers, and create executive reports for responsible AI deployment.

Learn how to use MITRE ATLAS to identify adversary tactics against AI systems, assess techniques like data poisoning and prompt injection, and anticipate threats that traditional security tools miss.

Build an AI threat model with MITRE ATLAS: map attack surfaces, score technique likelihood and impact, and prioritize mitigations for a production ML pipeline.

Learn how the EU AI Act's risk-based tiers classify AI systems, and identify the data governance, transparency, human oversight, and robustness duties that attach to high-risk deployments.

Apply the EU AI Act to classify AI systems by risk tier, build a compliance matrix, map obligations to controls, and produce an auditable compliance plan.

Learn how an AI Acceptable Use Policy fits the wider policy stack, and identify the approved-tool lists, data classification rules, and prohibitions that make a policy enforceable.

Draft an enforceable AI Acceptable Use Policy: define prohibited uses, map policy clauses to technical controls, and design an exception procedure with clear approval authority.

Understand unique AI incident types, detection strategies, response frameworks, severity levels, blameless learning, and emerging regulatory requirements for effective AI incident management.

Build an AI incident response playbook: classify incident severity, implement automated detection against metric baselines, and define escalation paths for AI-specific failure modes.

Learn what separates a genuine key risk indicator from a vanity metric, and how to select, band, and threshold AI security KRIs for executive dashboards.

Build an AI security KRI dashboard in code: compute refusal-rate and fairness indicators, apply green-amber-red bands, and surface portfolio-level risk for governance review.

Learn to identify, categorize, and mitigate the unique risks of third-party AI vendors, including data, bias, drift, lock-in, and security with robust governance and contracts.

Assess third-party AI vendors: score risk across weighted criteria, evaluate SLA compliance, tier vendors by exposure, and produce evidence-backed procurement recommendations.

Learn how a model card documents security posture, what belongs in its Security Considerations section, and how it anchors a transparency stack that regulators can audit.

Author a security-focused model card: document adversarial vulnerabilities and subgroup performance, then crosswalk each section to EU AI Act Article 11 technical documentation duties.

Learn to audit AI for disparate outcomes using core fairness metrics, understand why they cannot all be satisfied at once, and govern fairness across the model lifecycle.

Run a fairness audit end to end: measure subgroup disparities, test threshold adjustments against a policy card, and defend a launch, hold, or remediate decision.

Explore AI's data retention paradox, deletion challenges post-training, regulatory conflicts, key data types, and privacy-preserving techniques for responsible AI governance.

Build an AI data retention and deletion pipeline: apply retention schedules, select deletion methods under legal holds, and trace deletion impact through model lineage.

Learn what distinguishes a governance operating model from a framework: decision rights, an AI Review Board charter, RACI accountability, and the failure modes that break most designs.

Design an AI governance operating model: draft a review board charter, assign RACI accountability, set reporting cadences, and stress-test the design against common failure modes.