AI Training 2026
FAST-10

AI Governance, Risk, Ethics, and Responsible Use for Growing Businesses

12 hours · 4 live sessions × 3h · Wadood Chaudhary
Resources · Labs, projects and reading · Lesson 28 of 31

Reading list

TEXT · 7 MIN

FAST-10 Reading List: AI Governance, Risk, Ethics, and Responsible Use for Growing Businesses

Provider: 7formations | Course: FAST-10 | Instructor: Wadood Chaudhary | Links verified by fetch or search as of Oct 2026

Training, not legal advice. These are primary sources: frameworks (NIST, ISO), laws and regulator guidance (Massachusetts, federal, EU, one other state as an example), and security references (OWASP, CISA). Read the required items; use the optional ones as references when you build your inventory, register, test script, and policy. Rules change: check each page's date, and confirm obligations for your employer with counsel.

How to use. Required readings take 20 to 45 minutes per session and are done before (or right after) the session they support. Optional readings go deeper. 'Living page' means the publisher updates it continuously; read the current version. Reading times are estimates for the parts that matter to this course, not the whole document.

Session 1: What governance means in a small company

Required

  • AI Risk Management Framework (overview page)
    Publisher: National Institute of Standards and Technology (NIST) | Date: Living page; AI RMF 1.0 released January 2023 | Reading time: about 10 min
    URL: https://www.nist.gov/itl/ai-risk-management-framework
    Why read: NIST's AI RMF landing page: the current version, playbook, profiles, and any revision news. Check it before relying on any summary, including ours.

  • Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1
    Publisher: NIST | Date: January 2023 | Reading time: about 30 min
    URL: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf
    Why read: AI RMF 1.0. Read Part 2 (the Core: Govern, Map, Measure, Manage). Skim the trustworthiness characteristics in Part 1.

Optional

  • NIST AI RMF Playbook
    Publisher: NIST Trustworthy and Responsible AI Resource Center (AIRC) | Date: Living page | Reading time: about 20 min
    URL: https://airc.nist.gov/airmf-resources/playbook/
    Why read: The AI RMF Playbook: suggested actions for each subcategory. Use it to pick a few right-sized actions, not all of them.

  • ISO/IEC 42001:2023 Information technology: Artificial intelligence: Management system
    Publisher: International Organization for Standardization (ISO) | Date: December 2023 | Reading time: about 10 min
    URL: https://www.iso.org/standard/42001
    Why read: ISO/IEC 42001:2023, the certifiable AI management-system standard. Read the abstract to see how it differs from the NIST framework; customers or partners may ask about it.

  • Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1
    Publisher: NIST | Date: July 2024 | Reading time: about 25 min
    URL: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
    Why read: NIST AI 600-1, the Generative AI Profile. Read the list of 12 generative-AI risks; it is a ready-made checklist for the inventory and register.

Session 2: Laws, contracts, and data

Required

  • General Laws Chapter 93H: Security Breaches
    Publisher: The 194th General Court of the Commonwealth of Massachusetts | Date: Current statute text | Reading time: about 10 min
    URL: https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H
    Why read: G.L. c. 93H: definition of personal information and breach notice duties.

  • 201 CMR 17.00: Standards for the Protection of Personal Information of MA Residents
    Publisher: Mass.gov, Office of Consumer Affairs and Business Regulation | Date: Regulation page dated 10/19/2017 (in force since 2010) | Reading time: about 15 min
    URL: https://www.mass.gov/regulations/201-CMR-1700-standards-for-the-protection-of-personal-information-of-ma-residents
    Why read: 201 CMR 17.00: the written information security program, including vendor oversight (17.03(2)(f)).

  • Attorney General Advisory on the Application of the Commonwealth's Consumer Protection, Civil Rights, and Data Privacy Laws to Artificial Intelligence
    Publisher: Massachusetts Attorney General's Office | Date: April 16, 2024 | Reading time: about 15 min
    URL: https://www.mass.gov/doc/ago-ai-advisory-41624/download
    Why read: Massachusetts Attorney General advisory (April 2024): consumer-protection, anti-discrimination, and data-security laws apply to AI developers, suppliers, and users.

  • AI Act (regulatory framework overview and application timeline)
    Publisher: European Commission, Shaping Europe's digital future | Date: Living page (updated after the AI Omnibus, 2026) | Reading time: about 10 min
    URL: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
    Why read: The European Commission's AI Act page: risk tiers and the application timeline. Relevant if you sell AI-enabled products or services into the EU.

Optional

Session 3: Measuring and testing risk

Required

  • OWASP GenAI LLM Top 10 2026
    Publisher: OWASP Gen AI Security Project | Date: Published August 4, 2026 | Reading time: about 20 min
    URL: https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/
    Why read: OWASP Top 10 for LLM Applications 2026. Read the one-line descriptions of all ten; use LLM01, LLM02, LLM03, LLM07, and LLM08 in your test script.

Optional

  • OWASP Top 10 for LLM Applications
    Publisher: OWASP Gen AI Security Project | Date: 2025 edition | Reading time: about 5 min
    URL: https://genai.owasp.org/llm-top-10/
    Why read: OWASP GenAI project home for the Top 10, with earlier versions and related guidance.

  • AI Data Security: Best Practices for Securing Data Used to Train and Operate AI Systems
    Publisher: Cybersecurity and Infrastructure Security Agency (CISA) with partners | Date: May 2025 | Reading time: about 20 min
    URL: https://www.cisa.gov/resources-tools/resources/ai-data-security-best-practices-securing-data-used-train-operate-ai-systems
    Why read: CISA and partners on securing data used to train and operate AI systems. Useful for vendor questions about data provenance and protection.

  • Navigating the Jagged Technological Frontier (Dell'Acqua et al.), HBS Working Paper 24-013
    Publisher: Harvard Business School | Date: September 2023 | Reading time: about 15 min
    URL: https://www.hbs.edu/faculty/Pages/item.aspx?num=64700
    Why read: Why AI quality varies sharply by task: the reason testing must be task-specific.

Session 4: Policy and incidents

Required

Optional

Link verification

Links verified by fetch or search as of Oct 2026. Links that could not be confirmed were dropped and are not listed. The instructor re-checks links before each cohort.

Something went wrong. Reload Dismiss

Rejoining the server...

Rejoin failed... trying again in seconds.

Failed to rejoin.
Please retry or reload the page.

The session has been paused by the server.

Failed to resume the session.
Please retry or reload the page.