AI GRCAPractice Lab
Step 1 of 5Brief
01 · Guided scenario · SaaS

Read the scenario brief

Demo mode — sign in to save your work

Treat the assignment as a multi-tenant product release where customer data, contractual promises, supplier changes and rollback readiness matter.

PRACTICE MODELoading

Restoring your saved mode and lab work…

SAAS WORKING CONTEXT

SaaS operating brief

A fast-growing software provider is embedding third-party AI into a multi-tenant product. Enterprise customers expect security, reliability and contractual clarity.

Evidence bar
  • Tenant-isolation and prompt-injection tests
  • Supplier change and incident terms
  • Release, rollback and customer-notification plan
WEEKS 22–23

Integrated operating model and sector judgement

Design the integrated operating model, complete supplier and lifecycle controls, and make defensible decisions across six sector case stations.

Practical output
Integrated Governance Operating Model · Supplier AI Due Diligence Checklist · Vendor/Licensing Agreement Risk Review · Buy vs Build Risk Comparison · Deactivation and Localisation Policy · Post-Deployment Monitoring Plan · Sector Judgement Record
FICTIONAL OPERATING ENTITY
SAAS ENTITYHelix Advisory CloudBase training lab: Meridian Group
“Design the integrated operating model, complete supplier and lifecycle controls, and make defensible decisions across six sector case stations.”

Helix Advisory Cloud plans a multi-tenant AI assistant that retrieves customer documents, drafts answers and prepares CRM tasks after user confirmation. It uses a hosted proprietary language model, embeddings and role-filtered retrieval.

IN SIMPLE TERMS

The software company wants an AI assistant that can search each customer's private files, draft work and prepare actions. Users confirm actions, but weak permissions or malicious instructions could expose data or trigger the wrong task.

KNOWN FACTS
  • The assistant retrieves documents from separate customer tenants
  • A hosted proprietary model generates answers and draft actions
  • Role permissions should filter retrieval before content reaches the model
  • Users must confirm CRM or email actions
  • Tenant-isolation, prompt-injection and rollback testing are incomplete
COMMERCIAL SIMULATION FILE

Inspect the evidence before you advise

The documents contain incomplete, conflicting and potentially unreliable evidence. Treat each claim according to its source.

OPERATING CONTEXT

A fast-growing software provider is embedding third-party AI into a multi-tenant product. Enterprise customers expect security, reliability and contractual clarity.

COMMERCIAL PRESSURE

Sales has promised the capability to two strategic customers, but engineering has only one sprint left before the announced release.

EXPECTED EVIDENCE
  • Tenant-isolation and prompt-injection tests
  • Supplier change and incident terms
  • Release, rollback and customer-notification plan
STEERING MEETING BRIEF

Conflicting demands, limited time, unclear ownership

Decision deadline
The steering committee meets in 10 working days. The launch slot will be lost if the decision is deferred beyond this meeting.
Budget constraint
Only GBP 28,000 remains in the assurance budget. Full independent testing was quoted at GBP 46,000, so the team must prioritise risk-based work.
Ownership gap
Product, Risk and Operations each believe another function owns final residual-risk acceptance. The governance charter is silent.
Executive sponsor

“Approve now with post-launch monitoring; delay threatens the business case.”

Risk partner

“Do not approve until critical evidence gaps and the unnamed risk owner are resolved.”

Operations lead

“The existing manual process is already failing service targets and creates its own harm.”

Supplier account director

“The product is proven in comparable organisations, but bespoke evidence requires a paid assurance package.”

OwnerChief Product OfficerClassificationInternal

Shows the reporting lines and decision rights relevant to the proposed AI use.

Executive sponsor
Chief Product Officer owns the business outcome and has requested the team to design the integrated operating model, complete supplier and lifecycle controls, and make defensible decisions across six sector case stations. The decision must be judged against tenant-isolation and prompt-injection tests.
Delivery chain
Chief Product Officer -> Product Director -> AI Product Owner -> Data Science Lead -> Operations Manager. Procurement manages the supplier; Information Security and Data Protection are consulted.
Approval ambiguity
The Product Director believes Risk accepts residual risk. Risk states that the accountable business executive must accept it. No committee terms of reference name the final approver.
Three lines
First line operates the system; second line sets policy and challenges risk; Internal Audit has not included the system in its current plan.
YOUR REVIEWER

AI governance committee

Can the operating model make consistent build, buy, release, monitor and retire decisions across sectors?

WEEK 23 · SIX INTERACTIVE DECISION STATIONS

Sector judgement under real constraints

Make and defend a decision for every sector. Each response becomes part of the shared practitioner portfolio.

Financial services

AI credit decision support and transaction fraud scoring

Decision: Approve, restrict or stop the proposed use in customer decisions.

  • Fair lending and consumer outcomes
  • Model risk management and explainability
  • Customer advice and contestability

Evidence bar unlocks after your rationale.

Healthcare

Clinical triage and decision-support assistant

Decision: Define the safe boundary between support and clinical decision-making.

  • Patient safety and sensitive data
  • Clinical validation and human oversight
  • Product liability and medical-device boundary

Evidence bar unlocks after your rationale.

Recruitment and HR

CV screening and candidate recommendation service

Decision: Determine whether the process is fair, transparent and meaningfully human-led.

  • Bias and non-discrimination
  • Candidate transparency and rights
  • Rubber-stamping and employment decisions

Evidence bar unlocks after your rationale.

Public sector

Citizen-service eligibility prioritisation

Decision: Decide whether public accountability and equality safeguards are sufficient.

  • Equality impact and vulnerable people
  • Procurement and supplier transparency
  • Reason-giving, review and public accountability

Evidence bar unlocks after your rationale.

Insurance

Claims triage, fraud scoring and pricing support

Decision: Set boundaries that prevent unfair customer outcomes while retaining operational benefit.

  • Pricing and fraud proxy discrimination
  • Vulnerable customers
  • Claims delay, challenge and redress

Evidence bar unlocks after your rationale.

Internal copilot

Enterprise RAG assistant over internal knowledge

Decision: Approve enterprise access only where confidentiality and access controls are demonstrably effective.

  • Data leakage and access-control inheritance
  • Staff misuse and overreliance
  • IP, privacy and confidentiality

Evidence bar unlocks after your rationale.

Start with evidence, not assumptions.

Record unknowns explicitly. Do not convert a supplier claim into a fact merely because it appears in the business case.

Lab overviewSave & continue