AI GRCAPractitioner Programme
PROGRAMME MAP

See the whole programme at once

Each of the 24 modules has something to learn, a lab to practise in, an assessment and evidence to keep. Switch views to follow a framework from the module that teaches it to the lab that applies it, or to browse all 14 labs and 52 artefacts.

ModuleLearnPractise inTestEvidence
Module 1AI Foundations for GovernanceLesson availableFoundationsAICheckpoint 1System description, lifecycle, actors and model-type assessment
Module 2Responsible AI, Trustworthy AI & HarmLesson availablePrinciplesAIHireAICheckpoint 1Stakeholder map, harm assessment, probability/severity matrix and launch gate
Module 3GRC & Assurance BasicsLesson availableCheckpoint 1Banking AI system assessment, risk register, risk-control matrix, evidence findings and governance decision
Module 4AI and the Wider Legal LandscapeLesson to followLegalAICheckpoint 1Cross-functional legal-risk checklist and defensible contract/launch recommendation
Module 5NIST AI RMF & OECD PrinciplesLesson to followRMFAIPrinciplesAICheckpoint 2RMF assessment scaffold and OECD principles mapping; framework relationships are formally documented later in AIMS360 (Module 12)
Module 6NIST GOVERNLesson to followRMFAICheckpoint 2Governance, ownership, appetite, supplier and approval-gate mapping
Module 7NIST MAPLesson to followRMFAICheckpoint 2Context, intended use, misuse, dependencies and risk scenarios
Module 8NIST MEASURELesson to followRMFAICheckpoint 2Testing plan, acceptance criteria, benchmarks and model card
Module 9NIST MANAGE & Risk TreatmentLesson to followRMFAICheckpoint 2Treatment, residual risk, release controls, rollback and monitoring
Module 10GenAI, RAG & LLM Application RiskLesson to followSecureGenAICheckpoint 3Architecture map, system card, RAG checklist, grounding and output controls
Module 11Agentic AI, Prompt Injection & SecurityLesson to followSecureGenAICheckpoint 3Agent control checklist, threat scenarios, security tests and incident plans
Module 12ISO AI StandardsLesson to followAIMS360ImpactAIFoundationsAICheckpoint 3ISO 22989/42001/42005 crosswalk and framework relationships
Module 13ISO/IEC 42001 FoundationsLesson to followAIMS360Checkpoint 3AIMS, PDCA, clauses, Annex A, scope and certification/implementation analysis
Module 14Clause 4: ContextLesson to followAIMS360Checkpoint 3Context register, interested parties, boundaries, scope and exclusions
Module 15Clauses 5–6: Leadership & PlanningLesson to followAIMS360ImpactAICheckpoint 3Policy, objectives, roles, risk planning and impact-assessment alignment
Module 16Clauses 7–10 & Annex ALesson to followAIMS360Checkpoint 3Operating procedure, control mapping, performance evaluation and gap roadmap
Module 17EU AI Act & Global LandscapeLesson to followActAICheckpoint 4Classification, actors, territorial scope and global AI law scan
Module 18High-Risk AI, GPAI, Timeline & EvidenceLesson to followActAICheckpoint 4High-risk matrix, GPAI dependency review, conformity and implementation roadmap
Module 19UK GDPR, DUAA, DPIA & AI PrivacyLesson to followPrivacyAICheckpoint 4DPIA screening, ADM safeguards, privacy assessment and plain-language notice
Module 20COSO Internal Control FoundationsLesson to followControlAICheckpoint 5COSO context, risk-control matrix, evidence catalogue and management view
Module 21Control Testing, Assurance & Audit ReadinessLesson to followAssureAICheckpoint 5Assurance plan, control test, findings, board summary and approval recommendation
Module 22Integrated AI Governance Operating ModelLesson to followOperateAICheckpoint 5Intake-to-retirement model, supplier/licensing review, sourcing and lifecycle policies
Module 23Sector Cases & Practitioner JudgementLesson to followOperateAIHireAICheckpoint 5Six sector decisions covering finance, health, HR, public sector, insurance and copilots
Module 24Mock Exam, Capstone & VivaLesson to followCapstoneAIFull Timed Final MockTimed analysis, integrated assessment, approval recommendation, viva and improvement plan