Academy · Standards-based
AI governance preparation, built from the standards rather than a syllabus we invented.
ISO/IEC 42001 for the management system, the NIST AI Risk Management Framework for the method, and the EU AI Act for the risk-tier discipline everybody has now adopted. This track is shaped differently from the other four because the field is: there is no single owning body with one published domain outline, and this page will not pretend there is.
Academy is arranged in a conversation, not bought from a page. Independent preparation — CyberWave is not affiliated with any standards or certification body. All five tracks
What it is
The least settled body of knowledge, with the most immediate deadlines.
The other four tracks on this site prepare you for one exam owned by one body with one published outline. AI governance has standards from ISO and IEC, a framework from NIST, a regulation from the European Union, and several credentials whose outlines are still moving. Building a track on any single one of those would date badly, so this one is built on the primary sources and says where each came from.
The AI shipped before the governance did. That is the actual starting condition, in almost every organisation.
Which is why the track starts with an inventory rather than a policy. A feature switched on inside a SaaS product, a model inside a vendor’s roadmap, a script somebody wrote to summarise tickets — these are already in production, already touching customer data, and already outside whatever the policy says. Writing the policy first produces a document that governs none of them.
The second thing that gets fixed is language. Model, system, use case; provider, deployer, distributor. Those distinctions carry legal weight, and most of the disagreement in a first AI governance meeting turns out to be terminological rather than substantive.
Who it suits
The people who take it.
- Whoever was handed AI oversight
- Usually announced rather than agreed, often in a meeting you did not call. This track is the shortest route from that position to a defensible plan.
- The security or privacy lead
- Your customer questionnaires grew an AI section, and your existing answers do not cover it. The management system shape will already be familiar; the subject matter is what is new.
- The compliance lead looking at ISO/IEC 42001
- Somebody has asked whether you could certify against it. Understanding the standard properly is how you answer that honestly — including when the answer is “not this year”.
- The product owner who shipped an AI feature
- It went out, it works, and now procurement at a large customer wants to know how it is governed. The provider-versus-deployer distinction is the first thing to get right.
The syllabus
The documents the track is built from, named and dated.
No paraphrased “body of knowledge”. These are the primary sources, so you can read them yourself and so you can tell when a summary somebody sends you is out of date. Standards get revised and regulation phases in — check the current version of each rather than a secondary account of it.
| Reference | What it is | How the track uses it |
|---|---|---|
| ISO/IEC 42001:2023 | The management system standard for artificial intelligence. Published in 2023 and built on the same harmonised structure as ISO/IEC 27001 — context, leadership, planning, support, operation, performance evaluation, improvement — with an annex of controls, an annex of implementation guidance, and further annexes on AI-related objectives, risk sources and use across sectors. | The spine of the track. If you already know how a management system works, this is the fastest route into AI governance, because the shape is familiar and only the subject matter is new. |
| NIST AI Risk Management Framework 1.0 | A voluntary framework organised into four functions — Govern, Map, Measure, Manage — each broken into categories and subcategories, with a companion playbook and a profile addressing generative AI specifically. | The working method. Where ISO/IEC 42001 describes the system you build, the NIST functions describe what you do inside it, and the language is plainer for people who have to explain it to a product team. |
| EU AI Act — Regulation (EU) 2024/1689 | The regulation that introduced the risk-tier vocabulary now used everywhere: prohibited practices, high-risk systems, transparency obligations for certain systems, and everything else. It also sets separate duties for general-purpose models, and distinguishes the obligations of a provider from those of a deployer. | The tiering discipline, and the provider-versus-deployer distinction. Both are worth learning even where the regulation itself does not reach you, because customers and insurers have adopted the vocabulary. |
| ISO/IEC 23894:2023 | Guidance on AI risk management, aligned to the ISO 31000 risk vocabulary rather than inventing a parallel one. | How AI risk is written into a register that already exists, instead of standing up a separate AI register that nobody reviews. |
| ISO/IEC 22989:2022 | AI concepts and terminology — the definitions the other documents assume you have. | Read early. A great deal of AI governance disagreement is two people using “model”, “system” and “use case” to mean different things. |
Sector rules sit on top of all of this — financial services, health, employment and public sector each add their own requirements, and a Canadian organisation also has federal and provincial privacy law in the picture. Those are scoped per organisation rather than taught generically.
The method
Govern, Map, Measure, Manage.
The four NIST functions, which are the most usable structure in this field. They are deliberately not numbered here: Govern is not a first step, it runs across the other three, and reading them as a sequence is the most common mistake made from a summary.
- Govern
- Policies, roles, accountability, culture and oversight — including who is allowed to approve a deployment and who has to be told when one changes. This function is not a phase; it runs across the other three, which is the part most reading summaries get wrong.
- Map
- Establish context and categorise the system: what it is for, who it affects, what the intended and foreseeable uses are, what data it depends on, and what could go wrong for somebody on the receiving end of an output.
- Measure
- Analyse, assess and track. Which characteristics you evaluate — validity, reliability, security, transparency, privacy, fairness — how, how often, and what happens when a measurement cannot actually be made, which is common and needs recording rather than ignoring.
- Manage
- Prioritise, treat and monitor. Allocating risk treatment, handling third-party and supply chain exposure, responding when something goes wrong, and keeping the record of what was decided and why.
Applied to one real system, these four produce something concrete quickly: a named owner, a described purpose, an affected group, a set of characteristics you have agreed to measure, a treatment for what you found, and a trigger for reassessing when the model or the vendor changes. That last one is the item most first attempts leave out, and it is the one that makes the rest hold up.
The format
What “the exam” means on this track.
Honestly: it depends on what you are aiming at, and the page is not going to smooth that over. Three different destinations lead to three different plans.
If you are targeting a specific named AI governance credential, preparation follows that body’s own published outline and its candidate handbook — including how its exam is delivered, how it is scored and what it requires of you afterwards. Those documents are the authority on format, not us, and they are moving quickly enough that quoting item counts here would be unreliable within a year.
If your destination is ISO/IEC 42001 readiness rather than a personal credential, the measure is different: an inventory, a scoped management system, an impact assessment method, tiered use cases with written reasoning, and controls with owners. That is assessed by an accredited certification body if you go on to seek certification — and by your own internal audit before that.
And if a customer questionnaire is what started this, the destination is a set of answers you can evidence. Which is the most common reason people arrive, and the quickest to make progress on.
Where the exams are going
Several bodies now offer AI governance credentials, and their outlines are still being revised as the regulation phases in. That is a reason to learn the primary sources rather than a provider’s summary of them: the standards move slowly, the exam blueprints move fast, and only one of those is worth memorising.
What this track is not
It is not legal advice on the AI Act, not a certification, and not machine learning engineering. It is governance: inventory, roles, risk, oversight, documentation and review. Where a question is legal, the answer is your counsel’s.
Preparation
What preparation covers, in this order.
The order is the point on this track. An inventory before a policy, terminology before tiering, and one real system before any general discussion of AI risk. Scope and pace are agreed with you rather than fixed here.
- 01
Inventory what is already running
Almost every organisation starting this work has more AI in production than its list shows — a feature in a SaaS tool, a model in a vendor’s product, a script somebody wrote. Governance that starts from a policy rather than an inventory governs nothing.
- 02
Settle the terminology
Model, system, use case. Provider, deployer, distributor, importer. Training data versus input data versus output. These distinctions carry legal weight and most disagreements in a first AI governance meeting are terminological rather than substantive.
- 03
Learn the management system shape
ISO/IEC 42001 clause by clause, and its annex of controls. For anyone who has worked with ISO/IEC 27001 this is the fastest part of the track; for anyone who has not, it is where the time goes, because everything else hangs off it.
- 04
Work the four NIST functions on a real system
Govern, Map, Measure, Manage, applied to one system you actually operate. Abstract AI risk discussion is endless; a single named system with a named owner and a named affected group ends it in an afternoon.
- 05
Tier your own use cases, and record why
Place each use case against the regulatory risk tiers, decide which obligations follow, and write down the reasoning. The written reasoning is the artefact — a tier assigned without a rationale cannot be defended when somebody disagrees a year later.
- 06
Produce the artefacts the standards ask for
An AI policy that says something, an impact assessment, register entries, human oversight arrangements, supplier questions, and a change trigger for when a model or a vendor updates. Documents somebody will maintain, not a binder.
Back at work
Where AI governance stops being a reading list.
Academy is not product training and Sentinel is not exam preparation. The overlap is the vocabulary — and on this track the overlap is unusually close, because AI governance is mostly a documentation and ownership problem.
An AI management system is a set of requirements, mapped to controls, with named owners and dated evidence — which is structurally the same problem Sentinel exists to organise. A tiered use case becomes a requirement record with the reasoning attached. Human oversight becomes a control with an owner and a review frequency. A model change at a vendor becomes a tracked action with a date. An AI risk goes in the same register as every other risk, which is where ISO/IEC 23894 points you anyway.
CyberWave also has to answer these questions about itself, which is the least abstract way we know to learn this material. Sentinel’s own AI assistance is scoped to the customer’s tenant, data is stored in Supabase in Canada, compute runs on Vercel in the United States, and AI processing goes to Anthropic in the United States. Those are the kinds of facts an AI inventory is supposed to contain — stated plainly, for your suppliers as well as ours.
Straight answers
What we will not tell you about AI governance.
No invented domain outline, no partner badge, no promise about a result or a regulatory outcome. Where something has not been established, it does not appear on the page.
Is there a single recognised AI governance certification yet?
Can CyberWave certify us against ISO/IEC 42001?
Does the EU AI Act apply to us if we are in Canada?
Is CyberWave affiliated with any of the bodies behind these standards?
What does preparation cost, and when does it run?
Does this cover governing our use of AI tools internally?
Governance is an inventory, an owner and a review date.
Everything else in AI governance is downstream of those three. Keeping them current, across every framework you are answering to, is what Sentinel is for.
No credit card required
- Published pricing on every standard plan
- No credit card required for the trial
- No automatic charge when a trial ends
- Tenant-isolated architecture, data stored in Canada
- Clear data-processing terms
- No compliance guarantee — human judgement still required