AI compliance & governance
AI governance in the company: charter, shadow AI and GDPR
Frame the use of AI: usage diagnosis, committee and roles, generative AI charter, data protection and security.
- Duration
- 14 h · 2 days
- Level
- Intermediate
- Format
- On site · Remote · Blended
- Max. group size
- 12 participants
Overview
Employees already use AI tools, often without a framework. This two-day program helps compliance officers, CIOs, DPOs and executives take back control: diagnose real uses (including "shadow AI"), define roles and decision bodies, write a usage charter and link the approach with GDPR and security. Participants leave with an AI charter, a governance plan and tracking indicators tailored to their organization.
Who this program is for
- Executives, CIOs, CISOs and digital transformation leads
- DPOs, lawyers and compliance officers
- HR and managers in charge of supporting AI adoption
Prerequisites
- No technical prerequisites
- Have an idea of the AI tools already used in the organization
Learning objectives
- Carry out a diagnosis of AI uses and spot shadow AI
- Define a governance: roles, committee, approval flows
- Write a generative AI usage charter tailored to your organization
- Apply GDPR to AI projects: legal basis, minimization, impact assessment, processors
- Identify and handle the security risks of generative AI
- Build in ethics, bias, transparency and human oversight
- Set up indicators and a change management plan
Detailed curriculum
7 modules · 14 h · 2 days
Day 1
Usage diagnosis and shadow AI
30% theory · 70% practice
- What is shadow AI and why it grows
- Mapping the tools, uses and data involved
- Assessing exposure: sensitive data, automated decisions, published content
- Prioritizing risks and quick wins
🛠 Hands-on workshops
Usage mapping1 h
Inventory your organization's AI uses and classify them by risk level.
✅ Deliverable : A prioritized map
Governance framework: roles, committee, processes
50% theory · 50% practice
- Principles of AI governance: accountability, proportionality, traceability
- Roles: sponsor, AI lead, DPO, CISO, business teams
- AI committee: composition, frequency, decisions
- Approval process for a new use case or a new tool
- Link with risk management and existing policies
🛠 Hands-on workshops
Responsibility matrix1 h
Build the roles matrix and the approval process for a use case.
✅ Deliverable : A responsibility matrix and a flowchart
Usage policy and generative AI charter
20% theory · 80% practice
- Structure of a charter: purpose, scope, rules, penalties, review
- Allowed and prohibited data, approved tools, work accounts
- Rules for verification, transparency and accountability
- Copyright, confidentiality and clauses with service providers
- Rollout, signature and staff awareness
🛠 Hands-on workshops
Write the charter2 h
As a group, write a usage charter adapted to the organization's context and challenge it.
✅ Deliverable : A draft AI usage charter
Day 2
AI and data protection (GDPR)
60% theory · 40% practice
- When an AI processes personal data
- Legal basis, purpose, minimization and retention period
- Impact assessment (DPIA): triggers and method
- Processors, transfers outside the European Union and contractual clauses
- Individuals' rights and automated decisions
🛠 Hands-on workshops
Case study: scoping an AI project1 h
Determine the legal basis, risks and measures for an AI project involving personal data.
✅ Deliverable : A GDPR scoping sheet for the project
Security and AI suppliers
50% theory · 50% practice
- Generative AI risks: data leaks, prompt injection, dangerous outputs
- Access, logging and account management
- Assessing a supplier: hosting, data reuse, certifications, commitments
- Managing AI-related incidents
🛠 Hands-on workshops
Supplier evaluation grid0.5 h
Fill in an evaluation grid for a common AI tool.
✅ Deliverable : A completed evaluation grid
Ethics, bias, transparency and human oversight
60% theory · 40% practice
- Bias and discrimination: origins and detection
- Explainability and informing individuals
- Human oversight: how to make it real
- Ethical principles turned into operating rules
Implementation and steering
30% theory · 70% practice
- 6- and 12-month action plan
- Indicators: uses inventoried, incidents, people trained
- Change management and communication
- Periodic review of governance
Tools and technologies
ChatGPTMicrosoft 365 CopilotMicrosoft ExcelMicrosoft Word
Teaching methods
- Diagnosis workshop based on participants' real uses
- Co-construction of the charter and the governance plan
- Incident case studies (data leaks, erroneous content, bias)
- Experience sharing and document templates
Assessment
- Collective review of the charter produced
- Group-assessed case studies
- Knowledge-check quiz at the end of the course
Required equipment
- A room with a projector, or a connection to a virtual classroom
- One computer per participant
- Existing internal policies (security, data protection, digital usage), if available
Resources provided
- Generative AI usage charter template
- Evaluation grid for an AI tool or supplier
- Template for a register of uses and a governance committee
- Impact assessment template adapted to AI projects
Career outcomes
- AI usage charter ready for internal approval
- Governance plan with roles, bodies and processes
- Evaluation grid for new AI tools and suppliers
Related video courses
My video courses that go with this program, to get ready for the training or to review afterwards. Free with an account.
