AI governance: ISO/IEC 42001 and the EU AI Act
Taking the EU AI Act as the main example, you classify the AI systems an organisation builds or runs and bring them under governance with an ISO/IEC 42001 management system, impact assessment, data governance, human oversight and a conformity file.
Level 401 · 19 lessons · 15 practice labs
Lessons
Frameworks
- What AI governance covers: from safe use to governing systems
- The EU AI Act: structure, roles and timeline
- Risk classes: prohibited, high-risk, transparency, minimal
- Other examples: NIST AI RMF, UK principles, national strategies
- Quick task: place five systems in risk classes
ISO/IEC 42001
- ISO/IEC 42001: the AI management system
- AI policy, roles and objectives
- The AI risk and impact assessment process
- Annex A controls and the Statement of Applicability
- Quick task: SoA entries for AI controls
Obligations for high-risk systems
- AI inventory and model cards
- Training data governance and record keeping
- Bias and fairness checks
- Human oversight and appeals
- Conformity assessment and the technical file
- Quick task: fill in a model card
Lifecycle
- AI supplier due diligence
- Post-market monitoring and serious incident reporting
- Capstone: the governance file for a hiring AI
Practice labs
- Decide the role: provider or deployer: In eight scenarios, decide whether the organisation is provider, deployer, importer or distributor.
- Place five systems in risk classes: Classify five AI systems, with reasons, as prohibited, high-risk, subject to transparency duties or minimal risk.
- Draw up the obligations timeline: Place on a timeline the obligations and application dates that apply to a deployer of a high-risk system.
- Match the framework to its nature: Match the EU AI Act, NIST AI RMF, ISO/IEC 42001 and national principles by binding force and scope.
- Sort into the NIST AI RMF functions: Sort sixteen activities into the govern, map, measure and manage functions.
- Choose frameworks for a multi-country company: Write, with reasons, a governance approach that combines mandatory and voluntary frameworks for a company active in three regions.
- Place each clause under its heading: Place fifteen clauses under the principles, roles, objectives and prohibitions headings of an AI policy.
- SoA entries for AI controls: Write the applicability, justification and status for eight ISO/IEC 42001 Annex A controls.
- An AI impact assessment: Write an impact assessment for a customer service chatbot covering affected groups, possible harms, likelihood and measures.
- Complete the AI inventory: Fill in the missing owner, purpose, risk class or supplier fields of a ten-system inventory from the notes given.
- Fill in a model card: From the technical notes of a credit pre-screening model, write a model card with purpose, data, performance, limits and monitoring.
- Review training data governance: Review a dataset document against source, representativeness, labelling, personal data and record-keeping needs and report the gaps.
- Decide where human oversight sits: For six decision processes, decide where a human steps in: approval, review or appeal.
- Run a bias check: From a hiring model's results table, calculate selection rates across groups and report differences above the threshold.
- The governance file for a hiring AI: From prepared documents on Göktaşı Yazılım's hiring tool, compile the technical file index, supplier review and post-market monitoring plan.
About this course
Taking the EU AI Act as the main example, you classify the AI systems an organisation builds or runs and bring them under governance with an ISO/IEC 42001 management system, impact assessment, data governance, human oversight and a conformity file.
What you will learn
- Frameworks
- ISO/IEC 42001
- Obligations for high-risk systems
- Lifecycle
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.