This course is educational content only. Nothing here constitutes legal advice. Regulatory analysis covers publicly available law and guidance documents for learning purposes. Consult qualified legal counsel before making compliance decisions.
DecipherU · Course 6
AI Governance and Risk
For the compliance, risk, privacy, or in-house counsel professional who knows AI governance is the table-stakes responsibility of the leaner cybersecurity and Applied AI C-suite. This 12-module course is for the practitioners liability has a name for, built on NIST AI RMF (AI 100-1, AI 600-1), the EU AI Act, ISO/IEC 42001, and sectoral regulations in healthcare, finance, and employment. 45-55 hours of study plus a rubric-evaluated capstone. Designed by Julian Calvo, Ed.D., M.S.
What completing this course actually does for your comp
BLS OES May 2024 + Lightcast 2024 AI premiumTarget role after completion
AI Governance Lead
Base comp band: $141K–$170K (BLS median ± Enterprise tier).
With AI fluency (this course)
$167K–$182K
+13% to +23% lift on AI-fluent postings (Lightcast 2024).
Time investment
~70 hours
Self-paced. Most learners ship the capstone within 8–12 weeks of focused study.
What this replaces
Pricing posture
Standalone: $497. Bundled inside Operator ($129/mo) and Frontier ($299/mo), pays for itself if you would buy 3+ standalone courses.
Course author
Julian Calvo, Ed.D., M.S.
Founder of DecipherU. Doctoral research in applied AI and education. Background spans software engineering, AI infrastructure, and the cybersecurity-AI convergence. Every regulatory citation in this course is reviewed by a legal co-reviewer before publication. Reviews the capstone personally.
After completing the course and capstone, you can run a full AI governance program: from risk assessment through regulatory conformity, vendor management, bias review, incident response, and audit.
Implement NIST AI RMF with a control map per system
Run the full Govern, Map, Measure, Manage cycle. Build a NIST AI RMF profile for a real use case, including the Generative AI Profile (NIST AI 600-1) for LLM deployments.
Run an EU AI Act conformity assessment end-to-end
Classify systems under the risk-based framework, apply provider and deployer obligations, build a technical file, and prepare for notified body review where applicable.
Build an enterprise AI governance program
Design the charter, RACI, committee structure, policy framework, and operating cadence. Communicate the program to executives, boards, and regulators.
Manage AI vendor risk with a 6-domain questionnaire
Assess foundation model providers and AI tool vendors. Build contract addenda covering data ownership, output liability, model deprecation, and AI Act compliance language.
Design AI privacy architecture
Build the data flow map, apply minimization, design a data subject rights workflow that handles AI-specific requests, and implement privacy-preserving ML where warranted.
Run a fairness assessment with disaggregated metrics
Apply the harm taxonomy, choose appropriate fairness metrics, build a measurement plan, and produce a remediation report suitable for internal audit and regulator review.
Manage an AI incident under EU AI Act and GDPR timing
Classify the incident, trigger the response process, meet EU AI Act Article 73 reporting obligations alongside GDPR Article 33 timing, and conduct a post-incident review.
Run an internal AI audit program
Build the evidence map, apply the ForHumanity audit criteria alongside NIST AI RMF controls, and produce a board-level report that satisfies audit committee expectations.
Twelve modules cover the full governance stack: landscape and disciplines, NIST AI RMF, EU AI Act compliance, sectoral regulations, enterprise program design, vendor risk, privacy, bias and fairness, transparency, incident management, and auditing. Module 12 is a capstone: design a complete AI governance program for a real or representative organization.
The course makes the framework layering explicit. Rather than presenting a single house approach, it shows which source applies where and how they interact, so practitioners can defend their choices to auditors and regulators.
You run GDPR compliance today. Your organization is deploying AI systems and your DPO or General Counsel has asked you to own the EU AI Act mapping. The course covers exactly that overlap: where GDPR and the AI Act interact, where they diverge, and what new governance structures you need to build.
You manage model risk under SR 11-7 and your bank is deploying AI at scale. The course covers the model risk management lineage, where AI pushes beyond SR 11-7's assumptions, how the OCC's evolving guidance applies, and how to build an AI model risk framework that satisfies regulators and your board's risk committee.
You have been asked to stand up an AI governance committee from nothing. The course delivers the committee charter template, RACI design, escalation paths, ethics review criteria, and the operating cadence that keeps a governance committee from becoming a rubber stamp.
Required
Recommended
Reviews
First cohort enrollment opens Q2 2026. Reviews from practitioners who completed the capstone will appear here once the first cohort finishes. Approved capstones in the top 10% become anonymized case studies with explicit permission.
No. This is educational content only. Nothing in the course constitutes legal advice. Regulatory analysis covers publicly available law, guidance, and framework documents for learning purposes. Before making compliance decisions, consult qualified legal counsel with expertise in the relevant jurisdiction and sector.
Yes, if your AI systems are placed on the EU market or their outputs are used in the EU, the Act applies regardless of where your company is incorporated. Module 3 covers territorial scope in detail, including the provider and deployer definitions that determine your obligations.
The NIST AI RMF (AI 100-1) is voluntary for most organizations in the United States. However, federal contractors and critical infrastructure operators face increasing pressure to align with it, and several state AI bills reference it. The course covers where it is voluntary, where it is effectively required, and how to build a defensible program either way.
Module 4 maps every regulated sector. The capstone exercise requires a multi-sector organization. The course teaches you to build a unified controls library that satisfies overlapping requirements rather than running parallel siloed programs.
Module 7 covers AI privacy specifically and explicitly maps to GDPR and HIPAA. The course is designed for practitioners who already understand one privacy regime and need to extend it to cover AI-specific risks: data provenance, training data rights, output privacy, and automated decision-making.
Approved capstones earn the AI Governance and Risk verifiable credential, signed with Ed25519 and embeddable on LinkedIn. IAPP does not currently recognize third-party credentials against the AIGP certification. As IAPP recognition develops over time, the course positioning will be updated. The credential reflects demonstrated practitioner capability, not exam passage.
45 to 55 hours of study across 12 modules. At 4 to 6 hours per week, most practitioners finish modules in 9 to 12 weeks. The capstone (40 to 60 page governance program design) adds 20 to 40 hours depending on the complexity of your chosen organization.
The AIGP is an exam-based credential from the IAPP. This course is a practitioner program: you build deliverables (governance charters, NIST AI RMF profiles, EU AI Act conformity assessments, vendor questionnaires, audit plans) rather than studying for a multiple-choice test. The two serve different purposes and are not substitutes for each other.
Seven-day full refund from purchase, while you have completed less than 10% of the course. Email support@decipheru.com with your order number; refunds process within 3 business days. After 7 days or above 10% completion, refunds are case-by-case. A refund triggers a 90-day lockout on re-purchasing this course or subscribing to a tier that bundles it.
The required prerequisite is working knowledge of at least one privacy or risk regime (GDPR, HIPAA, SR 11-7, FERPA, or equivalent). Without that baseline, the regulatory cross-mapping in Modules 3, 4, and 7 will be harder to absorb. Practitioners without a prior framework can take the GRC and Compliance Fundamentals course first.
Each cert-prep add-on translates this practitioner course into a focused exam ramp for a named industry credential. The parent course teaches the discipline; the add-on bridges to the specific exam blueprint.
This course is part of a packaged path
Each path bundles the curriculum sequence, the compensation delta it unlocks, and the recommended courses (this one is on the list). If you are not sure which path matches your starting point, the 2-minute AI Risk Score routes you to the right one.
PM → AI PM
Operate AI products end-to-end.
The 15-module AI PM track for working product managers shipping non-deterministic systems.
$155K → $215K-$285K · open path →
Convergence
Lead AI governance and risk.
The convergence persona for compliance, privacy, and risk practitioners owning the AI program.
$120K → $215K-$310K · open path →
AI Product Management
Product governance, responsible AI feature design, and AI product lifecycle from a PM lens. Pairs with the governance course for practitioners who span both functions.
$497
AI Security Engineering
Technical depth on AI security: adversarial ML, LLM red-teaming, secure deployment. The engineering complement to governance and risk.
$597
AI Security Operations Mastery
Operational security for AI systems. SOC monitoring, incident response, and threat intelligence applied to AI-specific attack vectors.
$497
Course content is for educational purposes only and does not constitute professional advice. All claims are supported by cited peer-reviewed academic research. DecipherU does not teach or reproduce any proprietary sales methodology. Verify all referenced sources independently.