Day 1: Establishing the AI Governance Foundation

Governance Principles and Scope

• Application limits around principles and scope
• Independent review for high-impact cases
• Ownership of approved AI outputs
• Oversight roles across the lifecycle

AI System Inventory

• Validation checks for AI system inventory
• Oversight cadence for governance controls
• Decision rights and approval thresholds
• Control testing prior to workplace approval

Roles, Rights, and Accountability

• Operational risks around roles and rights
• Audit evidence supporting full traceability
• Evidence retention for later review
• Exceptions handled with recorded rationale

Day 2: Designing Risk-Based Governance Controls

Use Case Risk Classification

• Validation checks for use case
• Policy limits limiting unauthorized use
• Human oversight at high-impact decisions
• Escalation paths for control failures

Approval and Human Oversight

• Decision points for human oversight
• Containment steps prior to wider spread
• Privilege changes requiring closer oversight
• Attack paths across trust boundaries

Documentation and Transparency

• Performance signals around documentation and transparency
• Identity risks tied to context
• Escalation thresholds for critical threats
• Evidence preserved for incident oversight

Day 3: Operating Governance Across the Lifecycle

Monitoring and Incident Management

• Application limits around incident management
• Malicious patterns across security telemetry
• Access anomalies needing prompt investigation
• Recovery actions after security events

Third-Party AI Governance

• Practical tests for third-party AI governance
• Threat signals needing rapid triage
• Adversarial tests before production release
• Detection gaps exposed by testing

Responsible AI Governance Framework

• Performance signals around responsible AI
• Outliers reviewed before model use
• Data quality prior to analytical interpretation
• Assumptions tested before final conclusions

• Case analysis examining AI system inventory in workplace decisions
• Simulation testing human oversight under operational pressure
• Guided exercise applying incident management to workplace cases
• Group review evaluating responsible AI against evidence