Track 07 · Data & governanceLesson 08 of 11
Governance built in, not bolted on
Frameworks and controls in the vocabulary the risk committee uses.
- Specialisation · Financial services
- 30 min read
- 60 min hands-on
- Pro
What you'll be able to do
01- Explain what the EU AI Act, the NIST AI RMF and ISO/IEC 42001 each are (a law, a voluntary risk framework, a certifiable management system standard) and what each asks of a delivery team.
- State the EU AI Act's risk tiers and application dates as amended by the Digital Omnibus, and say which ones a given engagement is exposed to.
- Classify a use case by intended purpose: AI system or not, prohibited, high-risk (Annex I or III), the Article 6(3) derogation, transparency-only or minimal, plus the customer's internal tier.
- Map controls to lifecycle stages so that compliance artefacts are produced by the build, not written afterwards.
- Design the compliance-by-design artefacts: use-case register entry, impact assessment, system card and human oversight design.
- Run a RACI with the customer's risk, legal, privacy and clinical or model-risk teams, and defend a classification in front of a risk committee.
Before you start
- Bias and fairness evidence: bias testing and mitigation, which this concept treats as one control among many.
- Approval gates and bounded autonomy: the mechanics behind "human oversight".
- From requirements to eval criteria: evals are the evidence most controls point to.
- Threat modelling an AI system: the security half of the risk assessment.
- Data residency and sovereignty: residency is one of the controls you will map.
The short version
A risk committee speaks three dialects. The EU AI Act is law: it sorts AI systems into tiers by intended purpose and attaches obligations to providers and deployers, with dates. The NIST AI RMF is a voluntary framework: four functions (Govern, Map, Measure, Manage) and a Generative AI Profile that lists the risks to manage. ISO/IEC 42001 is a certifiable management system: how an organisation runs AI responsibly, with 38 reference controls in Annex A. Your job is not to be the lawyer. It is to classify the use case with the customer's risk and legal teams, record the reasoning, map each obligation to a control that the build produces as a by-product (register entry, impact assessment, system card, oversight design, evals, logs, monitoring), and name an owner for each. Do it at scoping, because the classification decides the architecture: whether a human decides, what gets logged, what you must test.
- Purpose drives tier. The same model can be minimal risk as a call summariser and high-risk as a triage tool. Classify the intended purpose, and watch for feature drift.
- Dates moved. As of September 2026, the Digital Omnibus (Regulation (EU) 2026/1744) defers Annex III high-risk obligations to 2 December 2027 and Annex I to 2 August 2028. Prohibitions, AI literacy and GPAI duties already apply.
- Legal tier and internal tier differ. A use case can be "minimal" under the AI Act and still be consequential under US health rules or the customer's own policy.
- Compliance-by-design means artefacts from the pipeline, not documents written for the committee the week before go-live.
- Not legal advice. You bring structure and evidence. Classification is signed by the customer's legal and compliance owners.
Pro lesson
The rest of this lesson is in Pro.
The mental model, worked example, field note, failure table, exercise and self-check, with the voice tutor.
- Every stage and specialisation, in full
- Every lab and every role project
- Halden weeks 2–10, on your record
- Every drill, live in the playground
- All solutions, plus the server judge
- Lab Assistant and every Teach with AI