Welcome to the AI Governance Board
Departments across Summit Workplace Solutions have been adopting AI tools on their own — with no consistent approval, documentation, monitoring, or training. Your board has been asked to build the organizational program that brings order to this.
The situation at Summit Workplace Solutions
Individual departments aren't acting in bad faith — they just don't have a shared process to follow. Your job is to build that process: how tools get approved, how risks get assessed and treated, how vendors get evaluated, and what happens when something goes wrong.
Important: this lesson is educational, not legal advice
This lesson teaches general governance and risk concepts so you can think clearly about how organizations manage AI responsibly. It is not legal advice, and completing a checklist or policy template never guarantees legal compliance. Real compliance and legal questions always belong with an organization's qualified legal and compliance professionals.
Essential question
What does it actually take to govern how an organization adopts and uses AI — and why can't a checklist alone guarantee that?
Estimated time
About 50 minutes, in 13 steps. Your progress is saved automatically, so you can pause and come back.
What you will be able to do by the end of this lesson
- Distinguish policies, standards, and procedures.
- Score and place AI risks using likelihood and impact.
- Choose whether to avoid, mitigate, transfer, or accept a risk.
- Evaluate a fictional AI vendor.
- Design an approval and oversight workflow.
- Respond to a simulated AI incident and draft governance policy elements.
Sixteen Terms Behind AI Governance
Read each short explanation, then flip the cards to check your understanding. This part is practice — it is not graded.
Rules at different levels
Governance is the overall system of rules, roles, and processes an organization uses to direct and control something. A policy states what's required at a high level. A standard gives a specific, measurable requirement. A procedure gives the exact steps to follow. Compliance means meeting the requirements set by laws, regulations, or an organization's own rules.
Understanding risk
A risk assessment identifies risks and evaluates two things: risk likelihood (how probable it is) and risk impact (how severe the consequences would be). Once identified, an organization chooses a risk treatment: avoid it, mitigate it, transfer it, or accept it.
Keeping a system accountable
Access control determines who can view, use, or change a system. An audit log records who did what and when. Documentation explains how and why something was designed or decided. Incident response is the organized process for handling something going wrong.
Watching what comes in and what happens after
A vendor assessment evaluates an outside company's product before an organization relies on it. Model monitoring is the ongoing checking of an AI system's performance after it's deployed — governance doesn't stop once a tool is approved.
Vocabulary check (practice)
Click a card to flip it and see what that term means. Flip through all 16 before continuing.
0 of 16 cards flipped.
Activity 1: Policy, Standard, or Procedure?
Classify each statement below.
Activity 2: Score These Risks
For each fictional AI risk, rate its likelihood and its impact.
Activity 3: Place Risks on the Risk Matrix
Select a risk below, then click the matrix cell where it belongs.
Activity 4: Avoid, Mitigate, Transfer, or Accept?
For each risk, choose the most appropriate treatment.
Activity 5: Evaluate These AI Vendors
Review each vendor's profile and decide whether to approve or reject them.
Activity 6: Build an Approval and Oversight Workflow
For each design decision below, choose the option that reflects sound governance.
Activity 7: Respond to This Incident
An approved AI tool produced a customer-facing message with several factual errors, and it was sent before anyone reviewed it. Check every action below that's an appropriate part of the response.
Activity 8: Draft the Governance Policy
Check every element that belongs in Summit's AI governance policy.
0 characters (minimum 50)
Activity 9: Final Governance-Board Recommendation
One more request has reached the board for a final decision.
Your recommendation:
0 characters (minimum 40)
Activity 10: Final Knowledge Check
A mixed set of questions covering everything from this lesson.
Reflection & Completion
0 characters · 0 sentences detected (need at least 2)
Your results so far
Total: 0 / 100
Lesson complete
Verification ID:
PDF generation isn't available in this browser, so use the print-friendly report instead — you can print it or save it as a PDF from your browser's print dialog.