# AI Governance, Risk, Ethics, and Responsible Use for Growing Businesses

**Course FAST-10** · 12 hours · Instructor: Wadood Chaudhary · Presented by 7formations

## Session 1. What governance means in a small company (3 hours)

- Why governance; right-sized controls
- NIST AI RMF in plain terms
- Inventory: sanctioned and shadow AI
- **Lab 1: AI inventory.**

## Session 2. Laws, contracts, and data (3 hours)

- G.L. c. 93H and 201 CMR 17.00
- HIPAA and AI
- Fairness in hiring and lending
- Vendor terms and retention
- **Lab 2: Obligations list and vendor terms comparison.**

## Session 3. Measuring and testing risk (3 hours)

- Risk assessment and register
- Testing for bias, false claims, prompt injection
- Human oversight design
- **Lab 3: Risk assessment and test script.**

## Session 4. Policy and incidents (3 hours)

- Acceptable use policy
- Incident response and notification
- Tabletop exercise
- Training your staff
- **Lab 4: Policy, incident checklist, tabletop notes.**

## Worksheets and deliverables

- W1 AI inventory
- W2 Obligations list
- W3 Vendor terms comparison
- W4 Risk register
- W5 Test script results
- W6 Tabletop after-action notes
- Final AI acceptable use policy

## Attendance and completion

- Attendance is recorded at the start and end of every session (live virtual: platform attendance log plus an instructor roll call or poll; in-person: signed sheet).
- A trainee must attend 100% of instructional hours. A missed session may be made up by attending the same session in another scheduled cohort within 30 days; the make-up is logged the same way.
- A trainee must submit every required lab deliverable and score 'Meets' on the final applied task.
- Each completion record is tied to the trainee, the employer FEIN, and the course number, and is kept for the contract retention period.
- Incomplete trainees are not reported as completions and are not billed to anyone. FAST AI pays for completions only; employers and trainees are never charged.
- Optional asynchronous pre-work (under 10% of course time) is supplemental, is not counted as instructional hours, and never substitutes for a live session.

## Assessment rubric

Each criterion is scored Not yet / Meets / Strong. Completion requires Meets on every criterion for the final deliverable (resubmission allowed within the course window).

| Criterion | Meets standard |
| --- | --- |
| Risk analysis | Risks identified, rated, and mapped to controls |
| Legal awareness | Applicable obligations identified correctly |
| Testing | Test script run and findings recorded honestly |
| Policy | Clear, right-sized, enforceable policy |