One of six curricula in the AI Career Curriculum
AI Governance
You govern and assure the model: you decide whether a use is acceptable and prove it stays that way.
10 role tracks and 108 modules, free and MIT-licensed.
- AI WorkforceWork alongside the models
- AI StartupTurn it into a company
- AI GovernanceGovern, secure, and assure AI
- AI EngineeringBuild with the models
- ML EngineeringBuild and train the models
- AI InfrastructureRun the platforms models live on
Your relationship to the model
To you the model is a risk to be understood and managed: to people, to the organization, and to compliance. You don't usually build or run it. You set the rules it operates under, test it adversarially, and hold the evidence that it behaves as claimed.
This org covers AI governance — governing, securing and assuring AI: inventories and risk assessments, red-teaming and adversarial ML, release assurance and evaluation evidence, ML security, agentic safety, enterprise control architecture, and executive leadership of an AI governance program.
What you own
- Policy: acceptable use, risk tiers, and approval gates
- Risk and impact assessments mapped to frameworks (NIST AI RMF, ISO/IEC 42001, EU AI Act)
- Independent evaluation, red-teaming, and safety testing
- Security of AI systems: prompt injection, data leakage, and supply chain
- Model inventory, documentation, audit, and incident review
What you don't own: The implementation. You define what 'safe enough' means and verify it; the builders and operators make it so.
The tracks
Ordered by level. Each one opens with Module 00, which maps the role's place relative to the model before the technical work starts.
Analyst & Risk (L15–L25)
AI inventory & intake, risk assessments, fairness review, impact assessments & model cards, regulatory tracking
Risk frameworks, harm modeling, risk registers, LLM red-teaming, adversarial ML, fairness, privacy risk
Assurance, Privacy, Security & Safety (L30–L45)
Data minimization, PII detection & redaction, memorization & extraction risk, consent & DSRs for models, GDPR/state-law reviews
Release assurance, assurance cases, release gates, evaluation evidence pipelines, cross-jurisdiction obligations
ML security, zero trust, secrets, adversarial ML, runtime security, policy as code, supply chain, SecOps
Agent threat modeling, prompt injection & jailbreaks, dangerous-capability evals, excessive-agency containment
- AI AuditorL45
Audit planning vs ISO/IEC 42001, NIST AI RMF & EU AI Act, evidence sampling, control testing, findings, assurance reports
Architect (L50)
AI control libraries, policy as code, multi-jurisdiction reconciliation, AI management systems, risk appetite
Executive (L60–L70)
Running the program, board & audit reporting, regulator engagement, regulatory change, program maturity
AI regulation & risk, model risk management, responsible AI, AI security, audit evidence, board reporting
Who you work with
No curriculum owns the model end to end. These are the handoffs with each of the others.
AI Workforce
Work alongside the models
- You hand them
- Clear rules on what may be shared with which tools, and which uses need review, written so people can follow them
- They hand you
- How AI is actually being used on the ground, including the shadow uses policy hasn't caught up with
AI Startup
Turn it into a company
- You hand them
- A defensible position for customers, regulators, and investors, and early warning on uses that would sink the company
- They hand you
- The company's risk appetite, target markets, and customer commitments that set the compliance bar
AI Engineering
Build with the models
- You hand them
- Risk tiers, guardrail requirements, and red-team findings to fix before (and after) launch
- They hand you
- System descriptions, eval results, and guardrail designs for each AI feature, plus incident reports when something goes wrong
ML Engineering
Build and train the models
- You hand them
- Data-use rules, documentation standards, and the risk-based evaluation bar a model must clear
- They hand you
- Data provenance, model cards, training-data documentation, and evaluation results they can audit
AI Infrastructure
Run the platforms models live on
- You hand them
- Control requirements (logging, access, retention, residency) and the evidence they need to produce
- They hand you
- Audit logs, access controls, data-residency guarantees, and evidence that controls actually run in production
What you'll work with
- Regulation & standards
- EU AI Act, NIST AI RMF, ISO/IEC 42001, SR 11-7
- Threat frameworks
- OWASP (incl. LLM Top 10), MITRE ATLAS
- Policy as code
- Open Policy Agent (OPA), Kyverno
- Supply chain
- Sigstore / Cosign, SLSA
- Infrastructure & secrets
- HashiCorp Vault, Kubernetes, Terraform, GitHub Actions
- Explainability
- SHAP
- Model platforms
- Hugging Face, OpenAI, Anthropic
How the tracks work
Learn
Each track is a sequence of modules: lecture chapters, hands-on exercises, quizzes, and projects. Start with Module 00 and work forward.
Check your work
The paired solutions repo has a reference walkthrough for every exercise. Attempt each one first; the gap between your answer and the reference is where the learning happens.
Built in the open
The content is written with AI assistance and under ongoing human review, so it can contain mistakes. Report anything wrong through the repo's Issues; fixes ship continuously.