Cybersecurity career intelligence
Get weekly cybersecurity career intelligence
By subscribing you agree to our privacy policy. Unsubscribe anytime.
© 2026 Bespoke Intermedia LLC
Founded by Julian Calvo, Ed.D., M.S. · Cybersecurity career intelligence · Est. 2024
This course is educational content only. Nothing here constitutes legal advice. Regulatory analysis covers publicly available law and guidance documents for learning purposes. Consult qualified legal counsel before making compliance decisions.
DecipherU · Course 6
AI Governance and Risk
AI Governance and Risk is a 12-module cybersecurity governance course for compliance officers, risk managers, privacy leads, and in-house counsel building AI governance programs. The course synthesizes NIST AI RMF (AI 100-1, AI 600-1), the EU AI Act (Regulation 2024/1689), ISO/IEC 42001, sectoral AI regulations across healthcare, finance, and employment, and the corporate governance frameworks from Microsoft, Google, Anthropic, and OpenAI. Study time is 45 to 55 hours plus a founder-reviewed capstone. Designed and instructed by Julian Calvo, Ed.D., M.S.
Course author
Julian Calvo, Ed.D., M.S.
Founder of DecipherU. Doctoral research in applied AI and education. Background spans software engineering, AI infrastructure, and the cybersecurity-AI convergence. Every regulatory citation in this course is reviewed by a legal co-reviewer before publication. Reviews the capstone personally.
After completing the course and capstone, you can run a full AI governance program: from risk assessment through regulatory conformity, vendor management, bias review, incident response, and audit.
Implement NIST AI RMF with a control map per system
Run the full Govern, Map, Measure, Manage cycle. Build a NIST AI RMF profile for a real use case, including the Generative AI Profile (NIST AI 600-1) for LLM deployments.
Run an EU AI Act conformity assessment end-to-end
Classify systems under the risk-based framework, apply provider and deployer obligations, build a technical file, and prepare for notified body review where applicable.
Build an enterprise AI governance program
Design the charter, RACI, committee structure, policy framework, and operating cadence. Communicate the program to executives, boards, and regulators.
Manage AI vendor risk with a 6-domain questionnaire
Assess foundation model providers and AI tool vendors. Build contract addenda covering data ownership, output liability, model deprecation, and AI Act compliance language.
Design AI privacy architecture
Build the data flow map, apply minimization, design a data subject rights workflow that handles AI-specific requests, and implement privacy-preserving ML where warranted.
Run a fairness assessment with disaggregated metrics
Apply the harm taxonomy, choose appropriate fairness metrics, build a measurement plan, and produce a remediation report suitable for internal audit and regulator review.
Manage an AI incident under EU AI Act and GDPR timing
Classify the incident, trigger the response process, meet EU AI Act Article 73 reporting obligations alongside GDPR Article 33 timing, and conduct a post-incident review.
Run an internal AI audit program
Build the evidence map, apply the ForHumanity audit criteria alongside NIST AI RMF controls, and produce a board-level report that satisfies audit committee expectations.
Twelve modules cover the full governance stack: landscape and disciplines, NIST AI RMF, EU AI Act compliance, sectoral regulations, enterprise program design, vendor risk, privacy, bias and fairness, transparency, incident management, and auditing. Module 12 is a capstone: design a complete AI governance program for a real or representative organization.
The course makes the framework layering explicit. Rather than presenting a single house approach, it shows which source applies where and how they interact, so practitioners can defend their choices to auditors and regulators.
You run GDPR compliance today. Your organization is deploying AI systems and your DPO or General Counsel has asked you to own the EU AI Act mapping. The course covers exactly that overlap: where GDPR and the AI Act interact, where they diverge, and what new governance structures you need to build.
You manage model risk under SR 11-7 and your bank is deploying AI at scale. The course covers the model risk management lineage, where AI pushes beyond SR 11-7's assumptions, how the OCC's evolving guidance applies, and how to build an AI model risk framework that satisfies regulators and your board's risk committee.
You have been asked to stand up an AI governance committee from nothing. The course delivers the committee charter template, RACI design, escalation paths, ethics review criteria, and the operating cadence that keeps a governance committee from becoming a rubber stamp.
Required
Recommended
Reviews
First cohort enrollment opens Q2 2026. Reviews from practitioners who completed the capstone will appear here once the first cohort finishes. Approved capstones in the top 10% become anonymized case studies with explicit permission.
No. This is educational content only. Nothing in the course constitutes legal advice. Regulatory analysis covers publicly available law, guidance, and framework documents for learning purposes. Before making compliance decisions, consult qualified legal counsel with expertise in the relevant jurisdiction and sector.
Yes, if your AI systems are placed on the EU market or their outputs are used in the EU, the Act applies regardless of where your company is incorporated. Module 3 covers territorial scope in detail, including the provider and deployer definitions that determine your obligations.
The NIST AI RMF (AI 100-1) is voluntary for most organizations in the United States. However, federal contractors and critical infrastructure operators face increasing pressure to align with it, and several state AI bills reference it. The course covers where it is voluntary, where it is effectively required, and how to build a defensible program either way.
Module 4 maps the full sectoral landscape. The capstone exercise requires a multi-sector organization. The course teaches you to build a unified controls library that satisfies overlapping requirements rather than running parallel siloed programs.
Module 7 covers AI privacy specifically and explicitly maps to GDPR and HIPAA. The course is designed for practitioners who already understand one privacy regime and need to extend it to cover AI-specific risks: data provenance, training data rights, output privacy, and automated decision-making.
Approved capstones earn the AI Governance and Risk verifiable credential, signed with Ed25519 and embeddable on LinkedIn. IAPP does not currently recognize third-party credentials against the AIGP certification. As IAPP recognition develops over time, the course positioning will be updated. The credential reflects demonstrated practitioner capability, not exam passage.
45 to 55 hours of study across 12 modules. At 4 to 6 hours per week, most practitioners finish modules in 9 to 12 weeks. The capstone (40 to 60 page governance program design) adds 20 to 40 hours depending on the complexity of your chosen organization.
The AIGP is an exam-based credential from the IAPP. This course is a practitioner program: you build deliverables (governance charters, NIST AI RMF profiles, EU AI Act conformity assessments, vendor questionnaires, audit plans) rather than studying for a multiple-choice test. The two serve different purposes and are not substitutes for each other.
Fourteen-day full refund from purchase date. Email support@decipheru.com with your order number and a refund is processed within 3 business days. After 14 days, refunds are evaluated case by case.
The required prerequisite is working knowledge of at least one privacy or risk regime (GDPR, HIPAA, SR 11-7, FERPA, or equivalent). Without that baseline, the regulatory cross-mapping in Modules 3, 4, and 7 will be harder to absorb. Practitioners without a prior framework can take the GRC and Compliance Fundamentals course first.
AI Product Management
Product governance, responsible AI feature design, and AI product lifecycle from a PM lens. Pairs with the governance course for practitioners who span both functions.
$497
AI Security Engineering
Technical depth on AI security: adversarial ML, LLM red-teaming, secure deployment. The engineering complement to governance and risk.
$597
AI Security Operations Mastery
Operational security for AI systems. SOC monitoring, incident response, and threat intelligence applied to AI-specific attack vectors.
$497