A focused course, tailored for you
AI Governance Docs for Enterprise ML Platform Engineers
Build the compliance documentation that regulated enterprise customers require from your AI features.
When your model ships and the first enterprise customer flags it for an AI governance review, the questions arrive that your ML training never covered.
$199 one-time
Tailored to your situation. Access within 24 hours. 30-day money-back.
Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.
Why this course
Enterprise customers in financial services, healthcare, and government have started embedding AI governance requirements into their software procurement process. They want model cards, training data lineage documentation, EU AI Act classification rationale, and NIST AI RMF evidence packages. The engineers who build the features know the model inside out but have never had to produce these artefacts before. The first review is slow, inconsistent, and often fails, costing a deal or extending a sales cycle by weeks while compliance questions get escalated and deprioritised.
The 12 modules
Module 1. AI System Classification Under EU AI Act
EU AI Act sets four risk categories: prohibited, high-risk, limited-risk, and minimal-risk. Which bucket your ML feature lands in determines the documentation burden before a regulated enterprise customer can enable it. This module works through the classification criteria (intended purpose, deployment sector, level of human oversight) and produces a completed classification worksheet for your model type. Most ITSM prediction features land in limited-risk; some customer-facing NLP models cross into high-risk territory.
Module 2. NIST AI RMF for Enterprise SaaS Engineers
NIST AI RMF's four functions (Govern, Map, Measure, Manage) assign specific evidence responsibilities to the engineering team rather than legal or product. This module maps each AI RMF practice to the artefact your ML team is responsible for producing. Covers which practices require a written policy versus a technical evidence artefact, and which RMF practices your enterprise customers most commonly cite in their vendor AI governance questionnaires.
Module 3. Writing a Model Card That Passes Procurement Review
A model card written for peer engineers reads differently from one written for a regulated enterprise customer's compliance committee. This module covers the sections procurement reviewers focus on (intended use boundaries, performance across subgroups, known limitations, and monitoring commitments) and how to phrase technical detail for a non-ML audience without understating limitations. Includes a model card template structured to satisfy financial services, healthcare, and government reviewer requirements simultaneously.
Module 4. Training Data Documentation and Lineage
Regulated enterprise customers ask where your training data came from, how it was labeled, who had access, and what transformations were applied, before they confirm their own data processing obligations. This module covers training data lineage diagrams, consent and licensing documentation for each data source, and the specific questions a GDPR-aware enterprise data governance team asks about data used to train models that process employee or customer records.
Module 5. Explainability Methods and Compliance Requirements
SHAP, LIME, attention weights, and rule extraction satisfy different compliance requirements and enterprise AI governance policies. This module covers which explainability methods are accepted by major regulatory frameworks, how to document your chosen method in a vendor questionnaire, and how to explain your approach to a non-technical compliance reviewer. Financial services customers often require feature attribution; healthcare customers frequently require contrastive explanation. Module ends with a method-selection decision tree.
Module 6. SOC 2 and Your ML Features
When a SOC 2 audit scopes an enterprise SaaS platform, auditors examine AI and ML components differently from static software. This module covers the controls most commonly reviewed for ML features: change management for model updates, logging for predictions, monitoring for model drift, and access controls for training pipelines. Includes the specific control narrative language that ML engineers contribute to a SOC 2 audit response, with worked examples from ITSM prediction and workflow analytics features.
Module 7. Completing an Enterprise AI Governance Questionnaire
Enterprise customers send AI governance vendor questionnaires that mix NIST AI RMF practices, EU AI Act requirements, and their own internal AI policies into a single document. This module works through the standard questionnaire sections (AI system inventory, risk classification, human oversight mechanism, monitoring and incident response) and provides response guidance calibrated to common question formats. Covers how to give technically accurate answers that satisfy a non-ML compliance reviewer's scrutiny.
Module 8. Bias and Fairness Evaluation Documentation
Enterprise customers in regulated sectors require bias and fairness evaluation before enabling AI features that affect their employees or customers. This module covers which protected attribute categories financial services, healthcare, and government customers require analysis for; which fairness metrics suit your model type (demographic parity, equalized odds, calibration); and how to document results that include residual disparity alongside its justification, rather than presenting only binary pass-fail outcomes.
Module 9. Model Change Management and Audit Trails
A regulated enterprise customer's internal audit team will eventually request records showing how a model update was approved, tested, and deployed. This module covers model versioning practices, experiment tracking records, deployment approval processes, and the audit-trail artefacts that satisfy both internal audit committees and external SOC 2 auditors. Includes the model change log template and the evidence package structure for a production model update going to a regulated customer environment.
Module 10. Incident Response for AI Feature Failures
Model drift, bias incidents, and data pipeline failures each require different documentation and different notification timelines depending on the customer's sector and risk classification. This module covers the incident classification framework, notification requirements under EU AI Act for high-risk systems, and how to write a root cause analysis for an ML system failure that is technically complete without inadvertently acknowledging regulatory breach. Includes an incident report template with legal-review checkpoints.
Module 11. Contractual Implications of ML Features in Enterprise Deals
When a regulated enterprise customer signs a software agreement that includes ML features, the Data Processing Agreement and AI addendum include provisions the engineering team needs to understand. This module covers standard contractual clauses for AI governance, sub-processor disclosures required when training data involves customer records, and how engineering decisions about model architecture and data sourcing create or close contractual obligations that surface during agreement negotiation.
Module 12. Building the Internal AI Governance Artefact Library
Once you have produced compliance artefacts through one enterprise deal cycle, the goal is to never start from zero again. This module covers how to structure an internal AI governance library: the master template set, the classification decision tree, the process for updating governance artefacts when models retrain or the regulatory landscape shifts, and how to scope the library across all ML features shipped without creating a maintenance burden for any single engineer.
How this addresses your situation
Specific modules that map to what you said you are dealing with.
Your first major regulated-sector customer sends back a security questionnaire with a new AI governance section your team has never seen.
The product manager asks which platform features will be affected by EU AI Act before the engineering team finalises the next release scope.
A healthcare customer's compliance team requests a model card and training data documentation before they can enable the predictive analytics feature.
Your team is mid-SOC 2 audit and the auditor has questions about the ML model embedded in the ITSM workflow automation feature.
Who it is for
ML engineers and data scientists at enterprise SaaS platforms whose features embed predictive models, recommendation engines, or NLP capabilities sold into regulated industries. You build features that perform. You have not yet had to produce the compliance documentation artefacts that a bank's AI governance committee or a hospital's IT compliance team requires before they enable those features in production.
Who this is NOT for. Engineers at consumer tech companies or startups that do not sell to regulated enterprise buyers. Also not designed for compliance or legal professionals. This course is built for the engineer who writes the model and needs to write the compliance artefact themselves.
FAQ
My company has a legal team. Why do ML engineers need to know this?
Regulated enterprise customers direct technical AI governance questions to the engineering team during technical evaluation. Legal sets policy; engineers produce the artefacts. The faster your engineering team responds independently to technical AI governance questions, the shorter the sales cycle and the fewer escalations legal has to handle.
Does this cover ISO 42001?
Yes. Module 7 covers the major AI governance frameworks enterprise customers cite in their questionnaires, including ISO 42001, NIST AI RMF, and EU AI Act. The templates are designed to satisfy all three simultaneously rather than requiring a separate artefact set per framework.
My platform's ML features seem low-risk. Is this still relevant?
The classification itself is module 1. Features that seem low-risk at build time often land in a higher category when the customer's compliance team applies EU AI Act criteria to the specific use context. Module 1 gives you the classification worksheet to verify rather than assume, before a customer review surfaces the gap mid-deal.
