From parts to a running system
A pile of good practices is not governance. Governance is a system that keeps running when you are not looking - a place every AI system is recorded, people who own decisions, a rhythm that catches new risk, and evidence that a regulator or customer can inspect. This finale connects everything you learned into one operating model, then folds it into the data and privacy governance you already run so you end with one system, not three silos.
The operating model 9 min live
Put an AI registry in the centre. Everything else hangs off it: what a system is (classification), what it owes (obligations), how you judge its risk (NIST), how you run the management system (ISO), the evidence it works (evals), and how you watch it in the wild (monitoring and incidents).
LiveThe registry is the backbone3 min▶
An AI system registry (or inventory) is the one artefact everything else depends on. For every AI system it records:
- What it is and what it does - enough to classify it.
- Its tier - prohibited, high-risk, limited, minimal, or a GPAI model.
- Its owner - a named person accountable for it.
- Its obligations and status - what it owes, and how far along it is.
The blunt rule: if a system is not in the registry, it is not governed. Shadow AI is ungoverned AI. The registry is how "accidental scope" - systems nobody realised were in scope - stops happening.
LiveRoles, and evals as evidence3 min▶
- An AI governance lead - owns the operating model, the registry, and the review cadence.
- Product / system owners - each accountable for one system's obligations and evidence.
- A review board - the forum that signs off new systems, tier changes, and high-risk launches.
- Model evaluations produce the evidence that a system works and is safe. Evals are not a research nicety here - they are the proof you attach to a system's registry entry. (This is where the LLM/RAG evaluation course pays off directly.)
- Continual monitoring and serious-incident reporting close the loop: systems drift, so governance watches them in production and has a route to report when something goes seriously wrong.
Self-studyHow the seven sessions plug in2 min▶
Read the model as the whole track assembled: b1 fills the registry's tier field (classification); b2 populates obligations; b3 covers transparency duties; b4 handles the GPAI layer; b5 is the NIST risk method that scores each entry; b6 is the ISO/IEC 42001 management system that makes it auditable; b7 is the pre-market machinery (FRIA, conformity, CE, registration). The operating model is not new content - it is the wiring diagram that makes the seven parts run as one.
One system for AI, data, and privacy 9 min live
You are almost certainly already governing data and privacy. Do not stand AI governance up beside them as a third silo. Harmonise: one data map, one impact-assessment habit, one owner - built to the strictest of the frameworks that apply.
LiveThe FRIA / DPIA overlap3 min▶
- They overlap on purpose. The EU AI Act's fundamental rights impact assessment and the GDPR/PDPA data-protection impact assessment both ask "who does this affect, and how do we protect them?" Run them off one data map and one owner rather than as two disconnected forms.
- AI governance reads governed data. An AI system is only as governed as the data feeding it - your data governance work (lineage, quality, cataloguing) is an input, not a separate universe.
- Evals are the shared evidence. The same evaluation results that prove a model works also feed privacy and risk reviews. Produce evidence once, use it everywhere.
LiveStricter of the frameworks3 min▶
- Build to the EU AI Act floor. The Act is mandatory - it is your minimum, not your aspiration.
- Add ISO/IEC 42001 for proof. A certifiable management system makes your compliance auditable and repeatable rather than heroic.
- Use NIST for method. It gives you the risk vocabulary and functions to score and treat each system.
- Then take the stricter. Where GDPR/PDPA and the AI Act both bite, build to whichever demands more. One conservative standard beats three partial ones and a lot of arguing.
Vantage's full operating model. Vantage now runs one system: an AI registry listing its hiring tool (high-risk, Annex III(4), owner named) alongside every other model; a NIST-based risk method scoring each; an ISO/IEC 42001 AIMS making it auditable; evaluations attached as evidence; monitoring and incident routes live. Its FRIA-style thinking and its GDPR/PDPA DPIA run off one data map, one owner. Vantage started this track by discovering it had accidentally built a high-risk EU system with no governance. It ends with defensible, certifiable governance it can hand a customer - accidental scope turned into a system that runs.
Self-studyCompliance as a habit2 min▶
The last idea is the most durable: governance is not a project that finishes, it is a habit that repeats. Tie a review cadence to your own delivery - every new system and every significant feature enters the registry, gets classified, and picks up its obligations before it ships. Do that, and you never again wake up to an ungoverned high-risk system in production. That is the whole point of the operating model: it makes the right thing the default thing. Warmly done - you finished the track. Go make your AI defensible.
Score the model, plan 90 days ★ 10 min · scorecard
Turn the whole track into an honest self-score and a short plan. Rate Vantage first, then rate yourself.
Score six dimensions. Rate 0 to 3 on: registry, roles, risk method, management system, evals, monitoring. Where is Vantage strong, where thin?
Find the gap. Pick the lowest-scoring dimension - that is where the next month of effort goes.
Draft a 90-day plan. Three moves: what you stand up in 30 days (usually the registry), 60 days (roles + risk method), 90 days (evals + the ISO path).
Set the cadence. Write one sentence: the review rhythm that ties governance to every new system or feature, so it becomes a habit.
After the track ◐ light · your call
- Start the registry today: one row per AI system, with tier, owner, and status. Even a rough one beats none.
- Name your AI governance lead and your review board - who, and how often they meet.
- Write your one-sentence review cadence and put it somewhere your delivery process will actually trip over it.
- Revisit b1 to b7 for the system whose score was lowest - that is your first real build.
Official sources covered
A synthesis of the whole track. This finale weaves the EU AI Act, ISO/IEC 42001, NIST, and GDPR/PDPA into one operating model - confirm specifics against each source.
Three questions before you go 🎯 ◐ 90 seconds
1 · What sits at the centre of an AI governance operating model?
The registry is the backbone. If a system is not recorded there, it is not governed. Classification, obligations, risk method, management system, evals, and monitoring all hang off it.
2 · The AI Act's FRIA and the GDPR/PDPA DPIA are best handled by...
They overlap on the same question - who is affected and how do we protect them. Run them together off one data map and one owner rather than as two disconnected forms or three silos.
3 · The "stricter of the frameworks" approach means you...
The Act is the mandatory floor; ISO/IEC 42001 makes compliance auditable; NIST gives method. Where frameworks overlap, build to the stricter one - one conservative standard beats several partial ones.