learn-ai-governance-with-phoebe / Leader session 1 of 6
Learn AI Governance with Phoebe · Leader track · Session 1 of 6

Why AI governance now and how the Act reaches you

AI governance used to be a values statement. Since the EU AI Act became binding law, it is a compliance obligation with fines up to 7% of global turnover - and it does not stop at Europe's border. If your AI system's output is used in the EU, your Singapore company is in scope. This session gives you the landscape: why governance is now a board topic, the three frameworks that matter, and the one test for whether the Act reaches you.

🟢 Leader track Leaders: C-level · boards · AI leads No jargon Start here
0-3 · Welcome 3-20 · Concepts 20-40 · Exercises 40-45 · Q&A
Part 0

Why this hour is worth your calendar

Three things changed at once. AI is now making or shaping real decisions - who gets hired, who gets credit - at a scale and opacity that outruns old controls. Regulators responded: the EU AI Act is the first comprehensive, binding AI law, and it is written to follow AI wherever its effects land. And a set of frameworks - NIST AI RMF, ISO/IEC 42001, Singapore's Model AI Governance Framework - grew up to turn "govern your AI" from a slogan into a runnable program. This hour puts the three together and answers the first question a Singapore leader must ask: does the EU AI Act apply to us?

Read this first Educational, not legal advice. The EU AI Act is new and its high-risk timeline is under live amendment. Verify against the Regulation text and get proper advice before acting.
Live - presented in session Self-study - read after class ★ Try it now prompt Sources covered at the end
★ What you walk out with today Why AI governance is now a legal obligation not a values statement, the three-layer framework map (law / method / proof), the one test for whether the EU AI Act reaches your Singapore company, and five questions to put to your AI, legal, and data teams this week.
Part 1 · covers the governance landscape

Law, method, proof 9 min live

The confusing part of AI governance is that several big things share the name. They are not competitors - they are three layers. One is the law you must obey; one is how to think about risk; one is how to run and prove your governance.

EU AI Act - BINDING LAW what you MUST do · risk tiers, obligations, fines up to 7% of global turnover NIST AI RMF - a METHOD voluntary · how to think about risk (Govern, Map, Measure, Manage) ISO/IEC 42001 - PROOF voluntary but CERTIFIABLE · run + prove governance to a regulator Singapore Model AI Governance Framework voluntary, principles-based · the APAC responsible-AI reference (+ a GenAI edition) NIST shows what good looks like · ISO 42001 lets you prove it · the EU AI Act makes parts mandatory.
🔍 Click to zoom - the three layers of AI governance
LiveThe one line that untangles it3 min▶

Say it this way: "NIST shows what good looks like, ISO 42001 lets you prove it, and the EU AI Act makes parts of it mandatory."

  • EU AI Act: binding law. Risk-tiered obligations, prohibited uses, provider/deployer duties, real fines. If you are in scope, this is the floor - not optional.
  • NIST AI RMF: a voluntary, US-origin risk method (Govern, Map, Measure, Manage). It gives your teams a common language for AI risk and maps neatly onto the Act and ISO.
  • ISO/IEC 42001: the first certifiable AI management-system standard. It is how you run governance operationally and show an auditor or a customer third-party-verified proof.
  • Singapore's Model AI Governance Framework: voluntary, principles-based, the responsible-AI reference for the region - useful even where the Act does not reach.
★ Try it now (any chat AI)Explain the difference between the EU AI Act, the NIST AI Risk Management Framework, and ISO/IEC 42001 to a board member in plain English - which is law, which is voluntary, which is certifiable - and how a company would use all three together.
LiveWhy governance became a board topic3 min▶
  • The decisions got consequential. AI now screens job applicants, scores credit, triages services. When it is wrong or biased, the harm is real and the liability is yours.
  • The law got teeth. The EU AI Act's top fine tier is EUR 35 million or 7% of global turnover - a board-level number, larger than the GDPR's.
  • The scrutiny got public. Customers, employees, and regulators now ask "how is this AI governed?" - and "we're careful" is not an answer you can evidence.
Real world

Vantage's board question. Our running-case Singapore firm, Vantage, sells an AI hiring tool. Its board assumed AI regulation was a European problem for European companies - until a customer in Germany asked for its EU AI Act conformity documentation. That single request turned governance from a someday-item into a this-quarter one. The rest of the course is Vantage answering it.

Part 2 · covers Article 2 territorial reach

When the Act reaches Singapore 8 min live

The EU AI Act uses a market-and-output model, not a where-are-you model. Like the GDPR, it follows the effect. For a Singapore company the trigger is simple, and it catches more firms than they expect.

SG AI system no EU office Placed on the EU market OR output used in the EU In scope (Art 2) obligations by your role + tier Output used in the EU is the catch: a SG hiring model whose decisions land on EU candidates is in scope.
🔍 Click to zoom - Article 2: output used in the Union brings you in
LiveThe output-in-the-Union trigger3 min▶

Article 2 puts you in scope if any of these is true, regardless of where your company sits:

  • You place an AI system (or a GPAI model) on the EU market or put it into service there - even through an EU reseller.
  • You are a deployer located in the EU.
  • You are a provider or deployer in a third country and the output of your AI system is used in the Union.

That third limb is the one that surprises Singapore firms. A model run entirely in Singapore, whose results are used to make decisions about people in the EU - screening EU job applicants, scoring EU loan seekers - is in scope. A purely Singapore-internal system whose output never touches the EU is not.

The pattern you already know This mirrors the GDPR's extraterritorial reach (session-mates who took the GDPR course will recognise it): the law follows the EU individual, not your headquarters. If you serve or affect people in the EU with AI, assume you are in scope until you have checked.
Self-studyGovernance is bigger than the Act2 min read▶

It would be a mistake to reduce AI governance to "comply with the EU AI Act". The Act is the sharpest legal edge, but governance is the broader discipline of making sure your AI is trustworthy, accountable, and defensible - whether or not a specific law compels it. Even a Singapore company entirely outside the Act's reach has customers, employees, and a reputation that depend on its AI behaving well, and Singapore's own Model AI Governance Framework exists precisely to guide that. So treat the Act as the forcing function that makes governance concrete and urgent, but build the program for the wider goal: an AI operation you can explain, evidence, and stand behind. That framing also future-proofs you - more AI laws are coming, and a real governance program adapts to the next one far more cheaply than a bare EU-AI-Act checklist does.

Exercise 1 of 2

Does the Act reach you? ★ 12 min · pen and paper

Run the Article 2 test on your own AI systems.

List the AI systems your company builds or uses - the CV screener, the recommender, the chatbot, the credit model.

For each, ask: do we place it on the EU market, or is its output used in the EU (about EU people)? Mark in scope / out of scope.

For the in-scope ones, note your likely role - are you the provider (you built it) or a deployer (you use someone else's)? This decides who carries the obligations.

Circle the highest-stakes in-scope system. That is where the rest of this course pays off first.

★ Your scope-check partner (paste into any chat AI)You are checking EU AI Act applicability for a Singapore company. For each AI system I describe, ask whether we place it on the EU market or its output is used in the EU, and whether we are the provider or the deployer. Then tell me which systems are in scope and our role for each. Educational only, remind me to get advice. My systems: [list them]
Exercise 2 of 2

Map your frameworks ★ 8 min · your next AI review

Four questions that reveal whether your governance is a program or a slide.

"Which of our AI systems are in scope of the EU AI Act, and what tier are they?" If nobody can answer, governance has not started.

"Do we use a risk method like the NIST AI RMF, or do we assess AI risk ad hoc?" A common method beats hero effort.

"Could we show a customer or regulator evidence of our governance - or just describe it?" This is the ISO 42001 question: proof vs assertion.

"Who owns AI governance, and does it connect to our data governance and our model evaluations?" Three disconnected efforts is the common failure.

The mindset The Act sets the floor; the frameworks build the house. A mature program uses all three - the law for what is mandatory, NIST for how to reason about risk, ISO to prove it - run by one owner, not three.
Homework

Before session a2 ◐ 30 min total

★ Questions to ask your AI, legal, and data teams this week
  1. Which of our AI systems have output used in the EU, and are therefore in scope of the EU AI Act?
  2. For each, are we the provider or the deployer - who carries the obligations?
  3. Do we use a common AI risk method (like the NIST AI RMF), or is risk assessed ad hoc?
  4. Could we evidence our AI governance to a customer or regulator, or only describe it?
  5. Who owns AI governance, and does it connect to our data governance and our evals?
Source material

Official sources covered

Taught from the primary texts and framework docs. This page covers:

✓EU AI Act Article 2 (scope)Part 2 · market + output-in-the-Union reach
✓NIST AI RMF · ISO/IEC 42001 (framework roles)Part 1 · law / method / proof - detail in a5
◐Singapore Model AI Governance FrameworkPart 1 · the APAC voluntary reference
Check yourself

Three questions before you go 🎯 ◐ 90 seconds

1 · A Singapore firm runs an AI hiring model in Singapore, but its decisions are used to screen candidates in Germany. Under the EU AI Act it is...

Article 2 catches providers/deployers in a third country when the AI system's output is used in the EU. The law follows the effect, not the company's location.

2 · "NIST shows what good looks like, ISO 42001 lets you prove it, the EU AI Act makes parts mandatory." This means...

They are three layers, not competitors: the law you must obey, the method for reasoning about risk, and the certifiable system that evidences governance.

3 · The EU AI Act's top fine tier is...

Prohibited-practice breaches carry up to EUR 35M or 7% of global turnover (Art 99) - larger than the GDPR's top tier, and a board-level number.

Leader session 1 cheat sheet · pin this

Three layersEU AI Act = binding law · NIST AI RMF = voluntary risk method · ISO 42001 = certifiable proof.
The one lineNIST shows what good looks like, ISO 42001 lets you prove it, the Act makes parts mandatory.
Reach (Art 2)In scope if you place AI on the EU market OR the output is used in the Union - wherever you sit.
The SG catchA model run in Singapore whose decisions affect EU people is in scope. Output follows the person.
Provider vs deployerProvider (built it) carries the most; deployer (uses it) has its own duties. Know your role.
The stakesTop fine: EUR 35M or 7% of global turnover - bigger than the GDPR.
Bigger than the ActGovernance = trustworthy, accountable, defensible AI. The Act is the forcing function.
SG frameworkSingapore's Model AI Governance Framework - voluntary, principles-based, the APAC reference.