AI Governance: the course

About the course

The course follows AI Governance, Book 2 of The Transformed Architecture, part by part. It starts with foundations: what AI governance is, the six usage modes of large language models, the AI Act and its neighbouring instruments, eight principles and a readiness assessment. It then treats model origin and suppliers, the core method of classification, governance as code, trustworthy AI and evidence, and the organisation that carries it: operating models, forums, roles, adoption, portfolio, economics and the public authority. It closes with cases, an incident, anti-patterns, practices and an outlook. Two fictional organisations, Nordvik Region and Hansa Mutual, carry the worked examples. The course matters because the people who answer for AI must be able to show, from records, what each system is for and whether it stayed within it.

After the course the participant can

Classify every use of AI in an organisation by usage mode, from Mode 0 Ambient AI to Mode 5 Autonomous production agents, and assign its minimum control baseline
Determine the organisation's role under the AI Act for a system, its risk tier and the events that reopen the classification
Assess a model's origin across five risk categories and review a supplier contract clause by clause against enforcing controls
Express risk classification, risk appetite, approval policies, waivers and the AI inventory as version-controlled artefacts evaluated at pipeline gates
Design human oversight, fairness evaluation and transparency as mechanisms with thresholds, and assemble the evidence they produce into a chain an auditor can follow
Design the operating model, decision tiers, stop authority and roles that hold accountability for AI, including consultation with employee representatives
Manage an AI portfolio with falsifiable value hypotheses, cost envelopes and a decision table, and report to a management body from generated evidence
Draft a governance roadmap and a first-90-days plan that separate what is observable, expected and speculation

Who it is for

Chief risk officers, compliance officers and internal auditors who must answer for AI
Enterprise architects, AI architects and chief architects
Chief information officers and heads of digital services
Data protection officers and legal counsel working with AI systems
Members of AI governance boards and management bodies
Senior public officials and system owners in public authorities

Before the course

Familiarity with IT governance in a large organisation; no background in machine learning is assumed
A basic acquaintance with the GDPR and with how your organisation approves and buys IT systems
Helpful but not required: Architecture as Code, Book 1 of the series, for policy, governance and evidence as code

Material

Three ways to run it

The same material in three lengths. Each row of an agenda names the lessons it draws on.

Executive briefing90 minutes

For members of management bodies, executive teams and AI governance boards who must set appetite and answer to supervisors

A briefing on what a management body must decide and be able to show. It covers the definition of AI governance, the usage modes, what the AI Act asks of a provider and a deployer, the decision tiers and the stop authority, and what a risk report against appetite looks like, and it ends with the eight conclusions and the first horizon of the phased programme.

0:00	What AI governance is and is not; five changes AI brings and three recurring tensions Ch. 1
0:15	Six usage modes: why one word, AI, hides uses whose risk and controls differ by orders of magnitude Ch. 2
0:30	The AI Act for decision-makers: roles that move, risk tiers and the dates that matter Ch. 3, Ch. 8
0:45	Who decides and who can stop it: decision tiers, the management body's duties and the stop authority Ch. 13, Ch. 19
1:00	Reporting against appetite and deciding on money: the generated risk report and the five-outcome decision table Ch. 16, Ch. 16A
1:15	Eight conclusions, what to do in the first six months, and questions Ch. 25

One-day seminar1 day

For architects, risk and compliance staff, data protection officers and system owners who will build or review the governance arrangements

A working day that walks one use case through the method: placed in a usage mode, classified, bought or built under an origin policy and a contract, passed through governance gates, given designed oversight and left with evidence. The afternoon turns to forums, stop authority, portfolio and cost, and ends with a tabletop exercise and a plan for the first ninety days.

09:00	Foundations: the working definition, the usage modes and a usage-mode register built by participants Ch. 1, Ch. 2
10:00	The regulatory map and classification: role, risk tier, tiering questionnaire and register entry Ch. 3, Ch. 8
11:00	Sovereignty and suppliers: five risk categories, origin policy and contract clauses with enforcing controls Ch. 6, Ch. 7
12:00	Lunch break
13:00	Governance as code and evidence: policy families, gates, waivers and the evidence chain Ch. 9, Ch. 11
14:00	Oversight that is real: an oversight design specification and a transparency notice Ch. 10
14:45	Organisation and decisions: operating model, decision tiers, roles and stop authority Ch. 12, Ch. 13, Ch. 14
15:30	Portfolio and economics: value hypothesis, cost envelope and the decision table Ch. 16, Ch. 16A
16:00	Tabletop exercise on stop decisions, built on the incident timeline Ch. 19
16:40	Conclusions and each participant's first-90-days plan Ch. 25

Full course8 weeks, one session of three to four lessons a week

For teams that will run AI governance: architects, risk, compliance, data protection, platform leads, business system owners and board secretariats

The full course covers all 26 lessons in the order of the book, with an exercise in every lesson that produces an artefact of the kind the chapter describes. The long Part IV is spread over two weeks and Part III over two. Participants build up a governance repository for their own organisation, or for Nordvik Region or Hansa Mutual, and submit it as the capstone.

Week 1	Foundations: definition, usage modes, the regulatory landscape, principles and readiness Ch. 1, Ch. 2, Ch. 3, Ch. 4, Ch. 5
Week 2	Sovereignty and suppliers: model origin, procurement, vendor management and open models Ch. 6, Ch. 7
Week 3	Risk classification as code and AI governance as code Ch. 8, Ch. 9
Week 4	Trustworthy AI, evidence, assurance and audit Ch. 10, Ch. 11
Week 5	Organisational design, decision forums, competence and roles, change and adoption Ch. 12, Ch. 13, Ch. 14, Ch. 15
Week 6	Management as Code for the portfolio, AI economics and AI in public authorities Ch. 16, Ch. 16A, Ch. 17
Week 7	Experience: case studies, the cautionary incident with a tabletop exercise, anti-patterns and best practices Ch. 18, Ch. 19, Ch. 20, Ch. 21
Week 8	Future trends, conclusions for the two organisations, reflections, consolidated conclusions and capstone presentations Ch. 22, Ch. 23, Ch. 24, Ch. 25

Modules and lessons

One module for each part of the book and one lesson for each chapter. A lesson has learning objectives, key concepts, a teaching plan, discussion questions, an exercise and a self-test.

Module 1 · Part I · Foundations

Module 1 lays the foundations of the method. It defines AI governance as a system of decisions, controls and evidence, introduces the six usage modes of large language models, maps the AI Act and its neighbouring instruments for architects, sets out eight principles with executable verifications and closes with a readiness assessment kept as a scorecard. Participants leave able to place any AI use in a mode, a regulatory position and a readiness score. Lecture: Foundations: from declared intent to evidence

Module 2 · Part II · Sovereignty and Suppliers

Module 2 asks whose AI the organisation commits to and on what terms. It applies five categories of geopolitical risk by the same criteria to every model origin, separates a hosted service from open weights run on European infrastructure, and turns the assessment into an origin policy, a drilled exit plan, a vendor assessment and contract clauses with enforcing controls. Participants leave able to assess a model's origin and review a supplier contract against the AI Act, public procurement law and DORA. Lecture: Sovereignty and suppliers: neither blanket ban nor blanket trust

Module 3 · Part III · Risk, Governance, Trust and Assurance

Module 3 is the core of the method. It turns the AI Act's classification into a decision tree over a signed descriptor, keeps the risk register and risk appetite as data, builds the management system as policies and gates in a pipeline, attaches mechanisms to transparency, fairness and human oversight, and assembles the resulting evidence into a signed chain. Participants leave able to classify a use case, write a gate policy in outline, design oversight that is real and answer an auditor's question with an artefact. Lecture: Risk, governance, trust and assurance: the committee decides, the pipeline applies

Module 4 · Part IV · Organisation and Leadership

Module 4 turns from controls to the people and bodies that hold them. It covers operating models and team topology, decision forums tiered by risk class, the AI architect and the roles around it, change and adoption under European labour law, the portfolio run as a register, the economics of systems whose cost follows consumption, and the particular duties of public authorities. Participants leave able to say, for any AI system, who owns it, who decides, who can stop it, what it costs and how it is explained. Lecture: Organisation and leadership: who owns, who decides, who can stop it

Module 5 · Part V · Experience

Module 5 turns from what should be done to what has been observed. It reads eight case studies through usage mode, AI Act role and the control that mattered, reconstructs one agent incident in an evaluation environment for its governance lessons, catalogues fifteen anti-patterns with symptom, consequence and remedy, and reassembles the book's practices by lifecycle stage and by the three tensions. Participants leave able to diagnose a programme, run a tabletop exercise on stop decisions and hold a steering committee to twelve lessons. Lecture: Experience: what the cases, an incident and the failures teach

Module 6 · Part VI · Future and Conclusions

Module 6 looks ahead and draws the book together. It teaches a way to read an outlook, separating what is observable, expected and speculation and keeping it in a horizon register, closes the cases of Nordvik Region and Hansa Mutual with what worked, what was hard and a 24-month plan, presents the author's own reflections as judgement and not finding, and consolidates eight conclusions into a phased programme. Participants leave with a horizon register, a roadmap and a first-90-days plan for their own organisation. Lecture: Future and conclusions: governing on ground that is still being laid

Final assignment

Capstone

A governance repository for one AI system and its organisation

Choose one AI system that affects people or business decisions in your own organisation; if that is not possible, take Nordvik Region's benefits-triage system or Hansa Mutual's claims-triage agent. Build the governance repository for it from the artefacts the course has taught, so that a reviewer can follow the path from declared intent to evidence without asking you a question. The repository must place the system in a usage mode, state your role under the AI Act and the risk tier with its basis, record the sourcing and exit position, show who decides and who can stop the system, describe how oversight works in practice, and say what evidence proves each control operated. Mark honestly every artefact that does not yet exist and every question that remains open. Present the repository in ten minutes as if to your AI governance board, and ask for one decision.

Steps

Write the usage-mode register entry, the regulatory position and the risk-tiering questionnaire for the system, with the article behind each answer.
Add the risk register entry with controls and review triggers, and the model-origin assessment or vendor clause checklist with the exit plan.
Write the oversight design specification, the transparency notice for affected persons and, where it applies, an outline of the fundamental rights impact assessment.
Record the decision rights: the tier that decides go-live, the RACI, the stop authority and restart rule, and any consultation commitments as controls.
Add the portfolio entry with a falsifiable value hypothesis, the cost envelope with stop conditions and the retirement criteria.
Build an evidence-pack index that maps each audit question to an artefact, list the gaps as findings with owners, and prepare the board presentation with one decision requested.

Deliverables

A structured governance repository for one AI system, with every artefact named above or an explicit gap entry in its place
An evidence-pack index mapping audit questions to artefacts, with gaps recorded as findings with owners and dates
A first-90-days plan for closing the gaps, with workstreams, evidence and success measures
A ten-minute presentation to an AI governance board ending in one requested decision

Assessment criteria

Fidelity to the method: the usage mode, AI Act role and risk tier are stated with their basis, and the book's terms and artefact types are used exactly
Traceability: a reviewer can walk from intent to classification, control, decision and evidence through identifiers, without relying on explanation
Enforceability: every rule, clause and commitment is paired with the control that enforces it and the test or evidence that proves it
Accountability: named roles hold the go-live decision, the oversight and the stop authority, and nothing consequential is left to a supplier or to a system
Honesty: missing artefacts, untested controls and open questions are recorded as such, with owners and dates