AIGP study plan

Map every stage of the AI life cycle (problem definition, data collection and processing, model development, verification and validation, deployment, operation and monitoring, decommissioning) and identify the governance decision points at each stage

Differentiate the core risk management frameworks: NIST AI RMF (Govern, Map, Measure, Manage), ISO/IEC 23894, and ISO/IEC 42001

Define an accountability structure for AI governance, assigning decision rights to a governing body, system owners, data stewards, and independent reviewers

Build a working vocabulary of at least 25 AI governance terms used across the four domains

Classify the principal AI risk categories (performance and accuracy, bias and fairness, privacy, security and adversarial, intellectual property, third-party and supply chain, drift and model decay) and pair each with at least two controls

Apply the NIST AI RMF functions to a single hypothetical high-risk use case from scoping through monitoring

Score risks on likelihood and impact and justify residual-risk acceptance thresholds

Specify the documentation artifacts that evidence risk treatment: model cards, system cards, data sheets, algorithmic impact assessments, and DPIAs

Outline the EU AI Act risk tiers (prohibited, high-risk, transparency-only, minimal) and list the obligations attached to each

Distinguish the duties of providers, deployers, importers, and distributors for high-risk systems

Compare the GDPR obligations that most often attach to AI systems: lawful basis, data protection impact assessment, and rights around solely automated decision-making

Trace how a risk assessment output feeds into technical documentation and post-market monitoring obligations

Compare the scope and structure of the NIST AI RMF, OECD AI Principles, UNESCO Recommendation, ISO/IEC 42001, and the G7 Hiroshima process, noting where they overlap and diverge

Explain conformity assessment, CE marking, technical documentation, and post-market monitoring as they apply to high-risk systems

Survey the US landscape: federal agency activity, state-level AI statutes, and sectoral regulators such as the FTC, EEOC, FDA, and CFPB

Cross-walk organizational policy controls against at least two external frameworks to expose gaps

Distinguish model families and learning paradigms: supervised, unsupervised, and reinforcement learning; classical versus deep learning; generative versus discriminative systems; and where agentic patterns fit

Interpret performance and evaluation metrics (precision, recall, F1, AUC, calibration, drift indicators) and explain the governance consequence of each failure mode

Catalogue the organization's AI use cases and classify each by life-cycle stage, risk tier, and affected stakeholder group

Summarize impact categories: labor and workforce, accessibility, environmental and compute footprint, economic concentration, and effects on specific communities

Evaluate explainability and interpretability approaches (feature attribution, surrogate models, inherently interpretable models) and state the tradeoffs against accuracy and security

Analyze competing fairness definitions and harm types, including group versus individual fairness, disparate impact, allocation harms, and representational harms

Debate automation versus augmentation and specify what meaningful human oversight requires in practice

Assess transparency obligations to end users, including disclosure of AI interaction and synthetic content

Examine privacy-enhancing technologies, data provenance, and consent debates in model training and inference

Analyze intellectual property and copyright questions arising from training data and generated outputs

Assess environmental impact measurement and sustainability reporting expectations for AI systems

Evaluate emergent governance debates: frontier model evaluation, open-weight release, agentic autonomy, and allocation of liability across the value chain

Complete two full-length timed practice exams under exam conditions

Log every missed item by domain and subdomain and write the corrected rationale for each

Re-study the three weakest subdomains identified by the error log

Consolidate the framework comparison, life-cycle table, and risk register into a single rapid-review sheet