EIGHTEEN TECHNOLOGY GROUP · XVIII

AI Governance Learning Path

A 16-week path from IT and security practitioner to AI governance advisor for small and midsize businesses, ending with an IAPP AIGP certification and a sellable service offer.

Duration

16 weeks

Weekly effort

6–8 hrs

Credential

IAPP AIGP

End result

Client-ready kit

Timeline at a glance

Foundations
Wk 1–3

Frameworks
Wk 4–7

Controls Lab
Wk 8–11

AIGP
Wk 12–14

Launch
Wk 15–16

0 of 0 tasks complete

Phase 1 · AI Foundations & Risk Literacy

Weeks 1–3

Goal: explain how generative AI works, where it fails, and why governance matters, in language a business owner understands.

Tasks

Wk 1Set up business seats on ChatGPT Business and Claude Team for Eighteen Technology Group. Use both daily for real work.
Wk 1Learn core concepts: LLMs, training vs. prompting, context windows, retrieval (RAG), agents, connectors, and how vendors handle business data.
Wk 2Study the main AI risk categories: hallucination, data leakage, prompt injection, bias and discrimination, IP/copyright, over-reliance, and shadow AI.
Wk 2Read the OWASP Top 10 for LLM Applications to understand security-specific AI risks.
Wk 3Compare the business-tier data terms of OpenAI, Anthropic, Microsoft Copilot, and Google Gemini: training use, retention, SSO, audit logs, admin controls.
Wk 3Write a one-page "AI risk for small business" explainer in plain English.

Learning resources

AI Fluency: Framework & Foundations (Anthropic Academy) Free
Free self-paced course on working with AI effectively and safely, with a certificate. Start here in Week 1.
Generative AI for Everyone (DeepLearning.AI) Free
Andrew Ng's non-technical intro to how generative AI works and where it fits in business. Free to audit on Coursera; the certificate costs extra.
Elements of AI (University of Helsinki) Free
Plain-language AI fundamentals course. Good for vocabulary.
Neural networks video series (3Blue1Brown) Free
Visual explanation of how neural networks and transformers (LLMs) work under the hood.
OWASP Top 10 for LLM Applications 2025 Free
The core AI security risk list: prompt injection, sensitive info disclosure, excessive agency, and more. Read every entry in Week 2.
OWASP GenAI Security Project Free
Home of the LLM Top 10 plus newer guidance on agentic AI risks, cheat sheets and governance checklists.
MIT AI Risk Repository Free
A database of 1,000+ catalogued AI risks organized by cause and domain. Use it to build your risk categories.
MITRE ATLAS Free
ATT&CK-style matrix of real adversary tactics against AI systems. Familiar format for security people.
AI Incident Database Free
Real-world AI failures. Great source of client-facing stories.
Prompt injection writing (Simon Willison) Free
The clearest ongoing explanations of prompt injection and why it is hard to fix.
Anthropic Trust Center Free
Claude's security certifications, compliance documents and data handling.
OpenAI Trust Portal Free
ChatGPT business/enterprise security and compliance documentation.

Deliverable: AI risk explainer (one page) and a vendor comparison table you can reuse in sales conversations.

★ Milestone: you can lead a 20-minute AI risk conversation with an owner.

Phase 2 · Frameworks, Standards & Law

Weeks 4–7

Goal: speak fluently about the frameworks clients, insurers, and auditors reference, and know when to hand off to an attorney.

Tasks

Wk 4NIST AI Risk Management Framework (AI RMF 1.0): the four functions Govern, Map, Measure, Manage. Skim the companion Playbook.
Wk 4NIST Generative AI Profile (NIST AI 600-1): the GenAI-specific risks and suggested actions.
Wk 5ISO/IEC 42001 (AI management system): structure, clauses, and how it parallels ISO 27001. A summary or overview course is enough for now.
Wk 5Map NIST AI RMF to controls you already know (ITIL change management, M365 security baselines) and note the overlaps.
Wk 6EU AI Act basics: risk tiers, prohibited uses, transparency duties, and who counts as a provider vs. a deployer.
Wk 6US landscape: state AI laws (Colorado, California, Texas, others), FTC guidance on AI claims, and employment/hiring AI rules. Track these; don't memorize them, because they change often.
Wk 7Massachusetts angle: how 201 CMR 17.00 (the state data security regulation) and privacy obligations apply when client data flows into AI tools.
Wk 7Build a simple "framework crosswalk" sheet: NIST AI RMF function, your control, the evidence you'd show.

Learning resources

NIST AI Risk Management Framework (home) Free
Overview and links for the AI RMF and all related NIST resources.
NIST AI RMF 1.0 (PDF) Free
The framework itself. Read Part 2 (the Core: Govern, Map, Measure, Manage) carefully.
NIST AI RMF Playbook Free
Suggested actions for every AI RMF outcome. Your source for practical control ideas.
NIST AI 600-1 Generative AI Profile (PDF) Free
Twelve GenAI-specific risks with suggested actions. The most directly useful NIST doc for SMB advice.
NIST AI RMF Crosswalks Free
Official mappings between the AI RMF, ISO 42001 and other frameworks.
ISO/IEC 42001:2023 Paid
The AI management system standard. Purchase is optional for now; read the overview page and a summary.
EU AI Act Explorer Free
Searchable full text, summaries and a compliance checker for the EU AI Act.
EU AI Act (European Commission) Free
Official overview of the risk-based approach and timelines.
IAPP US State AI Governance Legislation Tracker Free
Tracks cross-sectoral state AI laws (Colorado, Texas, California and more). Check monthly.
FTC: Artificial Intelligence Free
FTC guidance and enforcement on AI claims, deception and data use.
201 CMR 17.00 (Massachusetts) Free
Massachusetts data security regulation. Your local angle when client personal data flows into AI tools.
CISA: Artificial Intelligence Free
US government AI security guidance, including joint guidance on AI data security.

Deliverable: Framework crosswalk and a regulatory watch list, with sources you check monthly.

★ Milestone: you can explain NIST AI RMF and ISO 42001 to a CPA or an attorney partner.

Phase 3 · Technical Controls Lab

Weeks 8–11

Goal: turn governance policy into enforced controls. This is your competitive edge over policy-only consultants.

Tasks (in your own M365 tenant)

Wk 8Shadow AI discovery: use Microsoft Defender for Cloud Apps to find generative AI apps in use, then sanction or block them.
Wk 8Entra ID: set up SSO and Conditional Access for ChatGPT Business and Claude Team, and restrict access to managed devices.
Wk 9Microsoft Purview: sensitivity labels, DLP policies for AI and browser uploads, and Data Security Posture Management for AI.
Wk 9SharePoint/OneDrive oversharing review: permission hygiene, the prerequisite for any AI tool that searches company data.
Wk 10Platform admin consoles: retention settings, connector approvals, user provisioning (SCIM where available), and audit logs for both ChatGPT and Claude.
Wk 10Intune: browser and app policies for managed vs. unmanaged devices accessing AI tools.
Wk 11Write an AI incident runbook: data pasted into an unapproved tool, a harmful AI output, a compromised AI account.
Wk 11Optional: Microsoft Learn paths for Purview and Information Protection (the SC-401 track) to formalize these skills.

Learning resources

Secure AI interactions with Microsoft Purview (learning path) Free
Microsoft Learn path: sensitivity labels, DLP and DSPM for AI. The backbone of this phase.
Identify and mitigate AI data security risks (module) Free
Hands-on module for configuring DSPM for AI and tracking AI interactions.
Learn about DSPM for AI Free
Docs for discovering AI usage and one-click AI data protection policies, including ChatGPT and Gemini.
Discover AI apps and data (Microsoft Security for AI) Free
Step-by-step guide covering Purview and Defender for Cloud Apps discovery of generative AI apps.
Manage generative AI apps Free
How to discover, monitor and block generative AI apps with Defender for Cloud Apps and Defender for Endpoint.
Entra SaaS app integration tutorials Free
Find the SSO setup tutorials for ChatGPT, Claude and other AI apps in the Entra gallery.
Claude Help Center (Team/Enterprise admin) Free
Admin settings, SSO, data retention and connector controls for Claude.
OpenAI Help Center (ChatGPT Business admin) Free
Workspace admin, SSO, data controls and retention for ChatGPT Business.

Deliverable: A documented "AI Secure Baseline" (the control set you deploy for every client) plus an incident runbook.

★ Milestone: you can demo shadow-AI discovery and DLP blocking live to a prospect.

Phase 4 · IAPP AIGP Certification

Weeks 12–14

Goal: earn the leading AI governance credential (no prerequisites) to back up your advice.

Tasks

Wk 12Download the current AIGP Body of Knowledge and exam blueprint from iapp.org. Map each domain to what you learned in Phases 1–3.
Wk 12Choose prep: IAPP official training, or self-study with the official textbook and practice questions. Book the exam for the end of Week 14.
Wk 13Deep dive on your weak areas (usually law and regulation for technical candidates). Make flashcards.
Wk 13Take a full practice exam under timed conditions and review every miss.
Wk 14Final review, then sit the exam.
Wk 14Add AIGP to LinkedIn, the website, and the proposal templates.

Learning resources

IAPP AIGP certification Paid
Official page: Body of Knowledge, exam blueprint, fees and registration. Download the BoK first.
IAPP AI Governance Center Free
Articles, reports and webinars that track the AIGP domains.

Deliverable: AIGP certification. Check iapp.org for current exam fees, format, and continuing-education requirements.

★ Milestone: certified AI governance professional.

Phase 5 · Productize & Launch

Weeks 15–16

Goal: package everything into a repeatable offer for Eighteen Technology Group.

Tasks

Wk 15Finalize the AI Governance Starter Kit: acceptable-use policy, AI tool inventory and risk register, vendor AI assessment checklist, owner one-pager, incident runbook.
Wk 15Run the full kit on Eighteen Technology Group itself (you're client zero) and capture time spent to price accurately.
Wk 16Define the offer tiers: AI Readiness Assessment (fixed fee), AI Workplace Deployment (project), AI Governance Retainer (monthly).
Wk 16Line up one business attorney as a referral partner for regulatory questions.
Wk 16Offer a discounted pilot assessment to 2–3 friendly businesses for testimonials and case studies.

Learning resources

NIST AI RMF Playbook (Govern function) Free
Use the Govern section as a checklist when drafting your acceptable-use policy and roles.
OWASP GenAI Security Project resources Free
Includes an LLM security and governance checklist you can adapt for client assessments.

Deliverable: A sellable AI governance offer with pricing, templates, and a first pilot client.

★ Milestone: first paid or pilot AI governance engagement.

A typical study week (6–8 hours)

MonRead: 60 min of framework or course material

TueLab: 90 min hands-on in your tenant or AI admin consoles

WedRead: 45 min of news and regulatory watch

ThuLab: 90 min building controls or templates

WeekendCreate: 2 hrs on that week's deliverable

Stay-current sources

IAPP state AI tracker Free
Monthly check on new state laws.
Stanford AI Index Free
Annual report with adoption, incident and policy data. Good for sales stats.
AI Incident Database Free
New real-world failures to use as client examples.
OWASP GenAI Security Project Free
Updates to the LLM and agentic Top 10 lists.
Anthropic and OpenAI trust centers Free
Quarterly review of vendor certifications and data terms.

After week 16: stay current

Monthly: review your regulatory watch list and update the starter kit templates.
Quarterly: re-check vendor terms and admin features for ChatGPT, Claude, and Copilot. They change often.
Year 2 options: ISO/IEC 42001 Lead Implementer; ISACA AI credentials if you later earn CISM or CISA.
Continuing education: keep AIGP active through IAPP's continuing-education requirements.

Boundary to keep: advise on governance process, controls, and risk; refer legal interpretation to your attorney partner. That protects Eighteen Technology Group and strengthens your referral network.