Every business using AI needs someone who can answer basic questions: Which tools are approved? What data can go in them? Who checks the output? What happens when something goes wrong? In small and mid-sized companies, that person is usually an operations manager, office manager, compliance lead, or IT generalist with no formal AI governance training. This instructor-led course builds that capability. Trainees learn the NIST AI Risk Management Framework (Govern, Map, Measure, Manage) in practical terms and apply it to their own company's AI use. They study the rules that matter most in Massachusetts, including G.L. c. 93H and 201 CMR 17.00 for personal information, HIPAA for health data, anti-discrimination law in hiring and lending, and the obligations that come with vendor terms and data retention. Hands-on labs include building an AI tool inventory, running a risk assessment on a fictional use case, testing a chatbot for bias and prompt injection, reviewing a vendor's data terms, and running a tabletop exercise on an AI data incident. Each trainee drafts an AI acceptable use policy and a risk register suited to their own company's size. Trainees work in their approved AI tool and spreadsheets; no coding is required.
What you will be able to do
By the end of the course, trainees will be able to:
- Build an AI tool and use inventory for their workplace (sanctioned and unsanctioned use).
- Conduct a risk assessment on a use case using NIST AI RMF functions and record it in a risk register.
- Identify at least five applicable legal or contractual obligations for a scenario (93H, 201 CMR 17.00, HIPAA, anti-discrimination, vendor terms).
- Test an AI tool for bias, hallucination, and prompt injection using a provided test script and record the findings.
- Draft an AI acceptable use policy and an incident response checklist appropriate to a small or mid-sized employer.
Who this course is for
Compliance and risk officers; Operations and office managers; HR managers; IT generalists and managers; Privacy and security coordinators; Quality managers
Before you start
Role with responsibility for policy, compliance, IT, operations, or people management. FAST-01 or FAST-09 recommended.
Hands-on activities
- Inventory sweep: find AI in a fictional company's software list and shadow-IT survey results.
- Risk assessment lab on a fictional Charles River Family Dental appointment chatbot.
- Red-team-lite: structured tests for bias, false claims, and prompt injection in the approved tool (no attempts to bypass vendor safety controls).
- Vendor terms review: compare two fictional AI vendor data clauses.
- Tabletop exercise: an employee pasted a customer list into a public chatbot; walk through response and notification.
- Policy drafting workshop with peer review.
How your learning is measured
- Attendance at all four sessions.
- AI inventory and risk register (Meets / Not yet).
- Test script results with findings.
- Tabletop exercise participation and after-action notes.
- Final AI acceptable use policy and incident checklist scored against rubric.
