THE FUTURE MARKETACADEMY
Your classroomRoom 01 · AI Lab
School of AI

AI Governance Basics: policies, audits and compliance

Step 6 of 7 in AI Lab

Next in your path: 1.2.3 Prompt Testing: evaluate and improve your prompts

What you'll be able to do
  • Explain what AI governance is and name the four jobs it does (govern, map, measure, manage).
  • Describe, at an overview level, the privacy rules in your country that apply when a team uses AI with personal information (Canada's PIPEDA is the worked example).
  • Say where AI rules stand in your country today: what is law, what is proposed and what is voluntary (Canada is the worked example).
  • Draft a short AI use policy that a team can read in five minutes.
  • Build an inventory of AI use cases, sort them into risk tiers, and run a simple use-case audit.
  • Keep the records, training and review dates that prove the policy is real, and know when to call a privacy officer or lawyer.

Before this course: AI Risk at Work: privacy, bias and misuse in practice (course 1.8.2). You already know the three risk families, what a privacy breach is, how to test for bias, how to limit what an AI tool can do, and how to fill in a one-page risk check and a Do and Don't sheet. This course goes one step further: from a team's good habits to a written policy, a repeatable audit and a basic map of the rules, using Canada as the worked example (the "In your country" boxes show other countries). Education only; this is not legal advice. Laws change, and a real legal question belongs with a privacy officer or a lawyer.

Words in this course 48Open the Vocabulary Hall
01

What AI governance is

In simple words

A school has rules, a principal, a bell schedule and a lost-and-found box. That is how everyone knows what to do and who to ask. AI governance is the same thing for AI at work: the rules, the people in charge, and the way you check that the rules are followed.

Key facts
  • AI governance means the policies, roles, processes and records that guide how an organization chooses, uses and watches AI. Course 1.8.2 gave you the one-page risk check; governance makes it repeatable across a whole organization.
  • The U.S. National Institute of Standards and Technology (NIST) published its AI Risk Management Framework (AI RMF 1.0) on January 26, 2023. It is voluntary. Its four core functions are Govern, Map, Measure and Manage. NIST also published a Generative AI Profile on July 26, 2024.
  • Canada's Government of Canada guide on generative AI for federal institutions sets out six principles, summarized as FASTER: Fair, Accountable, Secure, Transparent, Educated, Relevant. The guide is written for public servants, but a business can borrow the ideas.
  • The Government of Canada's Voluntary Code of Conduct on advanced generative AI systems (launched September 2023) has six principles: accountability, safety, fairness and equity, transparency, human oversight and monitoring, and validity and robustness. It is voluntary and aimed at organizations that build or run advanced generative AI systems.
  • This course uses one simple map that fits all of the above:
JobThe questionWhere it appears in this course
GovernWho is responsible, and what are the rules?Lesson 4 (policy), Lesson 7 (roles, review)
MapWhat AI do we use, for what, with whose data?Lesson 5 (inventory and tiers)
MeasureIs it working fairly and safely?Lesson 6 (audit)
ManageWhat do we do about problems?Lesson 6 and 7 (fixes, records, incidents)
  • The four jobs are this course's plain-language map of the NIST function names. For what NIST actually says, read the framework itself.
Step by step
  1. Write the name of your organization or team at the top of a page (a small business, club or class project is fine).
  2. Write the four words Govern, Map, Measure, Manage in a column.
  3. Next to each word, write one thing your team already does that fits (for example "Govern: we have a Do and Don't sheet from course 1.8.2").
  4. Next to each word, write one thing that is missing.
  5. Circle the word with the biggest gap. This is where you start.
  6. Check: every word has one thing you have and one thing you lack, and one word is circled.
Watch on YouTube
NIST AI Risk Management Framework (RMF): a practical guideStandarity · YouTube · youtube.com
CertMike explains the NIST AI Risk Management FrameworkMike Chapple · YouTube · youtube.com

Videos by other creators on YouTube, for reference. They are not made by or affiliated with The Future Market.

LESSON 01What AI governance is
LESSON 01 / ANIMATED LESSON / AI VOICE00:00 / 01:00
Read the video script
[Host] "Good rules for AI are not just a document. They are rules, people and checks that work together."
[Text on screen: Govern · Map · Measure · Manage] "NIST, a U.S. standards body, names four jobs: govern, map, measure and manage."
[Text on screen: Who is responsible? What AI do we use? Is it working? What do we fix?] "Who is responsible? What AI do we use? Is it working fairly? What do we fix?"
[Host] "Find the biggest gap in your team and start there."
Try it now

Fill in the four-word page for one real team. Write one thing you have and one thing you lack for each job, and circle the biggest gap.

ClaudeStuck? Copy a ready-made prompt for Claude

Copy this, open Claude, paste it, and Claude will walk you through the lesson step by step.

For a grown-up: Claude is for adults (18+). Copy this, paste it into Claude, and use the answer to explain the lesson to your child.

I'm learning "AI Governance Basics: policies, audits and compliance" on The Future Market. Lesson 1: "What AI governance is".

What the lesson teaches:
- AI governance means the policies, roles, processes and records that guide how an organization chooses, uses and watches AI. Course 1.8.2 gave you the one-page risk check; governance makes it repeatable across a whole organization.
- The U.S. National Institute of Standards and Technology (NIST) published its AI Risk Management Framework (AI RMF 1.0) on January 26, 2023. It is voluntary. Its four core functions are Govern, Map, Measure and Manage. NIST also published a Generative AI Profile on July 26, 2024.
- Canada's Government of Canada guide on generative AI for federal institutions sets out six principles, summarized as FASTER: Fair, Accountable, Secure, Transparent, Educated, Relevant. The guide is written for public servants, but a business can borrow the ideas.
- The Government of Canada's Voluntary Code of Conduct on advanced generative AI systems (launched September 2023) has six principles: accountability, safety, fairness and equity, transparency, human oversight and monitoring, and validity and robustness. It is voluntary and aimed at organizations that build or run advanced generative AI systems.
- This course uses one simple map that fits all of the above:
- Job - The question - Where it appears in this course
- Govern - Who is responsible, and what are the rules? - Lesson 4 (policy), Lesson 7 (roles, review)

The exercise I'm working on:
Fill in the four-word page for one real team. Write one thing you have and one thing you lack for each job, and circle the biggest gap.

I'm stuck. Please:
1. Explain the main idea in plain, simple words with one everyday example.
2. Walk me through the exercise one small step at a time. Ask me what I've done so far before giving the next step.
3. Don't just give me the final answer. Help me do it myself, and check my work when I share it.
I'm a parent helping my child (about 8 years old) with a lesson called "What AI governance is" from the course "AI Governance Basics: policies, audits and compliance".

Here's what the lesson says:
A school has rules, a principal, a bell schedule and a lost-and-found box. That is how everyone knows what to do and who to ask. AI governance is the same thing for AI at work: the rules, the people in charge, and the way you check that the rules are followed.

The activity:
Fill in the four-word page for one real team. Write one thing you have and one thing you lack for each job, and circle the biggest gap.

Please explain this so an 8-year-old understands: short sentences, a fun everyday example, and no hard words.
Then give me 3 simple questions I can ask my child to check they understood, and a way to do the activity together, one tiny step at a time.
Open Claude
Sources
My notes
02

Privacy law in plain words (Canada's PIPEDA as the worked example)

This lesson is part of full access: every course and every level for one payment.

03

Where AI rules stand (Canada as the worked example)

This lesson is part of full access: every course and every level for one payment.

04

Draft an AI use policy

This lesson is part of full access: every course and every level for one payment.

05

Inventory and risk tiers

This lesson is part of full access: every course and every level for one payment.

06

Run a use-case audit

This lesson is part of full access: every course and every level for one payment.

07

Records, training and knowing when to call for help

This lesson is part of full access: every course and every level for one payment.

++

Final project

This lesson is part of full access: every course and every level for one payment.

??

Quiz

  1. What are NIST's four core AI risk management functions?

  2. Why check whether a proposed AI bill is in force before relying on it?

  3. A new privacy bill is read in parliament for the first time. What is its status?

  4. Name three common fair information principles in privacy law.

  5. Why check which privacy law covers your customers?

  6. What is good practice when a decision about a person is based only on automated processing?

  7. What does an AI impact assessment produce?

  8. Name four sections of a short AI use policy.

  9. In the course's three-tier model, what makes a use High risk?

  10. In an audit, how do you treat a missing piece of evidence?

  11. Why keep a record of every data breach, and for how long?

  12. Name two situations where you should call a privacy officer or lawyer.

EX

Final exam

This lesson is part of full access: every course and every level for one payment.

CE

Certificate

This lesson is part of full access: every course and every level for one payment.