AI Governance & Practical AI Bootcamp
Become an AI Governance Analyst, and a practical AI practitioner.
The bootcamp for the AI era: govern AI to NIST AI RMF, ISO/IEC 42001 and the EU AI Act, and actually use AI, hands-on, to do the work. You leave able to both certify and operate responsible AI.
Choose how you learn
One bootcamp. Three ways to take it.
3Same role-based outcome. Pick the format that fits your life. Read it at your own pace with graded feedback, watch the video track, or join the live quarterly cohort.
Instructor-led
Watch the instructor teach on video: a guided track with self-checks, per-module interview prep and a hands-on lab.
In development
Self-paced
Read the full course in the portal at your own pace: lessons, graded quizzes and assignments your instructor reviews.
Available now in the Fourth Tech Hub
Live cohort
Real-time sessions with the practitioner on a quarterly schedule: accountable, interactive, and capped for attention. We open these as cohorts are scheduled.
Next cohort · To be announced
Roles this prepares you for
- AI Governance Analyst
- Responsible AI Lead
- AI Risk & Compliance Analyst
- GRC Analyst (AI)
- AI Assurance / Audit support
Standards & references
You'll build a portfolio of
- AI system inventory
- AI risk assessment (NIST AI RMF)
- AI governance policy
- Model card
- Prompt & guardrail library
- AI audit checklist
The curriculum
The 10 modules
10Generative AI Foundations
How LLMs really work, what they can and can't do, and a hands-on first session with the tools.
The AI Risk Landscape
Bias, hallucination, privacy, IP, security and societal risk: what actually goes wrong with AI.
NIST AI Risk Management Framework
Govern, Map, Measure, Manage: applying AI 100-1 and the Generative AI Profile in practice.
ISO/IEC 42001: AI Management System
Stand up an AIMS: scope, AI policy, controls and the documentation auditors expect.
The EU AI Act & Global Regulation
Risk tiers, prohibited and high-risk systems, obligations and the wider regulatory map.
AI & LLM Security
Prompt injection, data leakage, model and supply-chain risk: the OWASP LLM Top 10, hands-on.
Practical AI for GRC & Security
Use AI to accelerate real work (risk assessments, control mapping, evidence review) with guardrails.
Prompt Engineering & Responsible Use
Reliable, repeatable prompting; building a prompt and guardrail library your team can trust.
AI Audit & Assurance
Assess AI systems: model cards, bias and robustness testing, and an AI governance evidence pack.
AI Governance Job Readiness
Day-in-the-life, interview questions, portfolio and a capstone AI governance program.
The challenge
AI arrived in your organisation before any policy did
Teams are already using it, procurement is already buying it, and the person asked to govern it is usually finding out what exists at the same time as writing the rules for it.
Nobody knows what is in use
An inventory of AI systems is the first thing every framework asks for and the first thing nobody has. Shadow usage is the normal starting position, not a failure.
The frameworks are not the law and the law is not a framework
The NIST AI RMF, ISO/IEC 42001 and the EU AI Act overlap and do different jobs. Treating them as one thing produces a programme that satisfies none of them.
Bias is discussed and never measured
Fairness gets a paragraph in the policy and no test. Without a measurement and a threshold agreed in advance, the paragraph is decoration.
The transformation
From writing an AI policy to governing AI, and using it yourself
The concepts and the rules first, then the programme that holds them, then the part most courses skip: using AI in your own GRC work without undermining the assurance you provide.
AI governance means a usage policy
You run an inventory, an intake process and a risk tier per use case
NIST, ISO and the EU AI Act are interchangeable
You can say which applies, to what, and what each one actually requires
Bias is a paragraph in the policy
You define a fairness measure and a threshold before the system ships
Vendor AI is assessed like any other software
You ask about training data, model changes and generative-specific risk
An AI incident is handled like an outage
You can run model risk and AI incident response as their own discipline
Using AI in GRC work feels unsafe
You use it with guardrails and human review, and can defend the output to an auditor
Describes the capabilities this programme is designed to develop. Results vary with experience and effort. Completing a programme does not guarantee employment, promotion or acceptance by any employer.
The programme in numbers
What you actually receive
41.75
Hours of instruction
24
Modules
60
Lessons
24
Graded quizzes
6
Marked assignments
3
Courses included
Counted from the courses this enrolment grants, not written by hand, so they cannot drift from what you receive.
- AI Governance, Risk & Compliance (AI GRC) — 8 modules, 13 hours
- AI Governance Foundations — 8 modules, 15h 45m
- Practical AI for GRC & Security Teams — 8 modules, 13 hours
Curriculum
What you will study, module by module
Phase 1: What AI governance is, and the rules
- 1.Why AI Needs Governance1h 30m
- 2.The NIST AI Risk Management Framework2h 30m
- 3.The Rules: EU AI Act and ISO/IEC 420011h 15m
- 4.Responsible AI as an Assurance Practice2h 30m
- 5.AI Acceptable-Use and Policy Essentials2 hours
- 6.Core AI Concepts and the AI Lifecycle2 hours
- 7.AI Harms, Bias, and Fairness in Plain Terms2 hours
- 8.Data Governance and Privacy for AI2 hours
Phase 2: Running an AI governance programme
- 9.The AI Risk Landscape1h 15m
- 10.Frameworks: NIST AI RMF and ISO/IEC 420011h 15m
- 11.Regulation: The EU AI Act1h 15m
- 12.Building an AI Governance Program1h 15m
- 13.AI Incident Response and Model Risk Management2 hours
- 14.AI System Inventory and Use-Case Intake2 hours
- 15.Metrics, Monitoring, and Board Reporting for AI Risk2 hours
- 16.Third-Party and Generative AI Vendor Risk2 hours
Phase 3: Using AI in your own GRC work, defensibly
- 17.Foundations: How GRC Teams Should Think About AI1h 15m
- 18.Accelerating Risk Assessments and Control Mapping1h 15m
- 19.Policies, Audit Evidence, and Vendor Reviews1h 15m
- 20.Guardrails, Human-in-the-Loop, and Defensible Use1h 15m
- 21.AI-Assisted Risk Registers and Audit Workpapers2 hours
- 22.Automating Evidence Collection and Continuous Compliance with AI2 hours
- 23.Prompting Well and Evaluating AI Output for GRC Work2 hours
- 24.Securing Your Team's AI Usage2 hours
Calendar
A plan that fits around work
Week 1
7h 48m
- 1.Why AI Needs Governance
- 2.The NIST AI Risk Management Framework
- 3.The Rules: EU AI Act and ISO/IEC 42001
- 4.Responsible AI as an Assurance Practice
Week 2
6 hours
- 5.AI Acceptable-Use and Policy Essentials
- 6.Core AI Concepts and the AI Lifecycle
- 7.AI Harms, Bias, and Fairness in Plain Terms
Week 3
7 hours
- 8.Data Governance and Privacy for AI
- 9.The AI Risk Landscape
- 10.Frameworks: NIST AI RMF and ISO/IEC 42001
- 11.Regulation: The EU AI Act
- 12.Building an AI Governance Program
Week 4
8 hours
- 13.AI Incident Response and Model Risk Management
- 14.AI System Inventory and Use-Case Intake
- 15.Metrics, Monitoring, and Board Reporting for AI Risk
- 16.Third-Party and Generative AI Vendor Risk
Week 5
7 hours
- 17.Foundations: How GRC Teams Should Think About AI
- 18.Accelerating Risk Assessments and Control Mapping
- 19.Policies, Audit Evidence, and Vendor Reviews
- 20.Guardrails, Human-in-the-Loop, and Defensible Use
- 21.AI-Assisted Risk Registers and Audit Workpapers
Week 6
6 hours
- 22.Automating Evidence Collection and Continuous Compliance with AI
- 23.Prompting Well and Evaluating AI Output for GRC Work
- 24.Securing Your Team's AI Usage
Total 41h 45m across 24 modules. Hours are the time the material is built to take, not a cap: nothing stops you going slower or faster.
Fit
Is this programme for you?
This is for you if
- AI governance has landed on you and you are starting from the inventory.
- You work in GRC, privacy, audit or security and AI keeps entering your scope.
- You want to use AI in your own work without weakening the assurance you sign.
- You will do the written work. A governance programme is a set of documents that hold.
This is not for you if
- You want a certificate for a CV line without doing the written work.
- You need an accredited or regulator-recognised qualification. This is a Fourth Tech certificate, not an accredited award, and we say so rather than implying otherwise.
- You want to build or fine-tune models. This governs AI systems and does not teach you to train one.
- You need legal advice on the EU AI Act for your own products. This teaches the obligations and is not a legal opinion, and the implementation timeline is still moving.
Outcomes
What you will be able to do
- Build an AI system inventory and a use-case intake that catches shadow usage
- Say which of the NIST AI RMF, ISO/IEC 42001 and the EU AI Act applies, and to what
- Risk-tier an AI use case and attach controls proportionate to the tier
- Define a fairness measure and a threshold before a system ships, not after
- Assess a vendor's AI: training data, model changes and generative-specific risk
- Run AI incident response and model risk management as a standing practice
- Report AI risk to a board in terms it can act on
- Use AI in risk assessments, control mapping and evidence work with defensible guardrails
What you need
- No prior experience in the field. The programme starts from the vocabulary.
- A computer with a modern browser. The labs run in the browser, so no virtual machine and no particular operating system.
- Time for the written assignments. They are marked against a rubric, and skipping them removes the only thing that distinguishes you afterwards.
- No machine learning background. Phase 1 starts from what a model is and where the risk sits.
- No AI platform licence. The exercises are built from constructed systems and use cases.
Your path to the certificate
- 01
Enrol
Pay once and the programme opens in your portal immediately.
- 02
Work the phases
Each phase is a complete course in its own right, sequenced so the work compounds.
- 03
Submit the assignments
Each module has a quiz marked on our server and an assignment marked against a rubric.
- 04
Build the capstone
A single piece of work across the whole programme, which becomes your portfolio centrepiece.
- 05
Earn the certificate
Issued with a unique ID and a public verification page anyone can check.
Hands-on labs
You don't watch. You do.
7Next cohort · To be announced
Secure your seat for $2,000.
You're in as soon as you pay: the full program opens in your portal right away, to work through at your own pace. When a live cohort is scheduled you'll get its day-by-day plan and sessions as well, and cohorts are capped at 20 seats.