1 / 20

Longhand AI competency course

Responsible AITurn principles into controls someone can inspect.

Use Govern, Map, Measure, and Manage to decide what the system may access and do, how failure will be detected, where people remain accountable, and when work must stop or escalate.

Version 1.085 minutesPractice evidence required

The finish line

A context-specific AI risk-control record

Your record covers purpose, people, data, sources, permissions, tests, human review, incidents, stop rules, and qualified escalation. It is practice evidence—not compliance or legal approval.

Progress is saved in this browser.

Longhand AI competency course

Responsible AITurn principles into controls someone can inspect.

Use Govern, Map, Measure, and Manage to decide what the system may access and do, how failure will be detected, where people remain accountable, and when work must stop or escalate.

Version 1.085 minutesPractice evidence required

The finish line

A context-specific AI risk-control record

Your record covers purpose, people, data, sources, permissions, tests, human review, incidents, stop rules, and qualified escalation. It is practice evidence—not compliance or legal approval.

Progress is saved in this browser.

Measurable learning objectives

By the end, you can produce evidence—not just repeat the framework.

Use Govern, Map, Measure, and Manage to produce a context-specific AI risk-control record.

Classify data, affected people, rights, sources, permissions, and downstream effects before use.

Define tests, human review, stop rules, and incident evidence appropriate to the consequence of failure.

Recognize when legal, financial, medical, security, privacy, HR, or other qualified professional review is required.

You will see a worked example, diagnose a weak example, complete guided practice, and leave with an independent practice artifact. The artifact prepares you for a later human-scored performance assessment.

Course requirements

Know what you need—and what counts as evidence.

Prerequisites

One proposed AI workflow or the incident-report practice case.
The organization's applicable data, privacy, security, acceptable-use, and professional-review rules—or an explicit note that they must be obtained.
Authority to analyze risk; this course does not authorize access, deployment, external action, or professional reliance.

Assessment connection

Final AI Work Capstone — Safety and Governance Dimension · planned

A completed AI risk-control record
A data, permission, and affected-party map
Verification, human-review, stop, incident, and qualified-escalation rules

Lesson practice is formative. This course does not issue proficiency or certification; the listed performance assessment requires separate evidence and qualified human evaluation.

Authoritative sources and course version

Version 1.0 · estimated 85 minutes · sources reviewed 2026-08-10

Artificial Intelligence Risk Management Framework (AI RMF 1.0)National Institute of Standards and Technology · Govern, Map, Measure, and Manage functions and trustworthy AI characteristics.Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence ProfileNational Institute of Standards and Technology · Generative-AI-specific risks and risk-management actions.NIST Privacy FrameworkNational Institute of Standards and Technology · Data processing, privacy risk, governance, and control selection.Copyright and Artificial IntelligenceU.S. Copyright Office · Current U.S. Copyright Office reports and guidance related to AI and copyright.Web Content Accessibility Guidelines (WCAG) 2.2World Wide Web Consortium · Testable accessibility requirements for learner-facing web content and interactions.

The guide

Explain it. See it. Challenge it. Apply it. Save the evidence.

Step 1 of 5 · 15 min

Define the authorized purpose, owner, policies, decision rights, and prohibited uses.

Govern the purpose and accountability

Risk controls fail when the workflow has no accountable owner, authorized purpose, or rule for resolving conflicts. NIST treats Govern as a cross-cutting function because accountability must shape mapping, measurement, and management from the start.

Do this

1Name the authorized purpose and the result being pursued. List secondary uses that are not authorized without a new review.
2Identify the accountable human for the workflow, data decision, professional judgment, external action, and incident response. A model cannot hold these accountabilities.
3List applicable organizational policies, contractual limits, jurisdictional questions, and professional standards. Mark unknown requirements for qualified review.
4Define documentation, change control, review cadence, and who can pause or terminate the workflow.
5Prohibit impersonation, fabricated authority, undisclosed external action, and representations that AI output received a review it did not receive.

Remember: Following this course does not establish legal compliance or satisfy an organization's governance obligations by itself.

What you leave with

Authorized-purpose statement

Accountability map

Policy and change-control record

Govern review

Question	Acceptable evidence
Why may this workflow exist?	Approved purpose connected to a legitimate result and defined users
Who owns each consequential decision?	Named human function with authority, criteria, and time to intervene
Which rules apply?	Policy, contract, jurisdiction, and professional-review references or explicit unresolved questions
Who can change or stop it?	Version control, approval rule, monitoring review, and stop authority

Step 1 of 5 · Run it

Apply it before you move on

Do this

1Name the authorized purpose and the result being pursued. List secondary uses that are not authorized without a new review.
2Identify the accountable human for the workflow, data decision, professional judgment, external action, and incident response. A model cannot hold these accountabilities.
3List applicable organizational policies, contractual limits, jurisdictional questions, and professional standards. Mark unknown requirements for qualified review.
4Define documentation, change control, review cadence, and who can pause or terminate the workflow.
5Prohibit impersonation, fabricated authority, undisclosed external action, and representations that AI output received a review it did not receive.

Remember: Following this course does not establish legal compliance or satisfy an organization's governance obligations by itself.

Open the governance record

Create the Govern section of an AI risk-control record for this workflow. Include authorized purpose, prohibited secondary uses, accountable humans by decision, applicable policies/contracts/jurisdiction questions, documentation, change approval, review cadence, and pause/termination authority. Mark unknown requirements for qualified review; do not give legal conclusions.

Workflow: [paste]

What you leave with

Authorized-purpose statement

Accountability map

Policy and change-control record

Practice evidence target

The workflow has an authorized purpose, accountable humans, applicable rules or explicit unknowns, change control, and named pause/termination authority.

Step 1 checkpoint

Govern the purpose and accountability: practice checkpoint

Practice evidence target

The workflow has an authorized purpose, accountable humans, applicable rules or explicit unknowns, change control, and named pause/termination authority.

Recording this checkpoint saves self-reported lesson practice in this browser. It is not evidence of certified competency; certification requires a separately submitted artifact and qualified human evaluation.

Step 2 of 5 · 18 min

Understand the context before selecting controls or connecting tools.

Map data, people, permissions, and impact

The same AI behavior can be low risk in a synthetic practice case and unacceptable with confidential employee, customer, legal, health, or security information. Mapping makes the real context and affected people visible.

Do this

1Inventory every input, generated output, metadata source, connection, retention location, recipient, and downstream system. Classify sensitivity and authorization for each.
2Minimize data to what the purpose requires. Identify consent, notice, confidentiality, licensing, copyright, provenance, and deletion questions.
3Map people who receive benefit, bear error, are represented in data, are evaluated, or may have limited ability to contest the output.
4Classify every action as read-only, reversible, approval-gated, external, or prohibited. Verify actual permissions rather than inferring them from tool capability.
5Describe foreseeable misuse, out-of-scope use, dependency, and downstream effects—including accessibility barriers and disparate error consequences.

Remember: Do not paste confidential or regulated information into a system merely because the exercise asks you to analyze it. Use a synthetic record when authorization is unclear.

What you leave with

Data and source inventory

Affected-party map

Permission and action classification

Data and action boundary

Category	Examples	Default handling
Public/authorized	Official public source or approved synthetic data	Use within purpose; preserve provenance and terms
Internal/confidential	Operations, contracts, customer or employee information	Use only in approved systems with minimization and access control
Regulated/highly sensitive	Health, legal, financial, credentials, security, protected personal data	Require controlling policy and qualified review before use
External action	Send, file, publish, buy, delete, change record	Explicit approval unless separately authorized and controlled

Step 2 of 5 · Run it

Apply it before you move on

Do this

1Inventory every input, generated output, metadata source, connection, retention location, recipient, and downstream system. Classify sensitivity and authorization for each.
2Minimize data to what the purpose requires. Identify consent, notice, confidentiality, licensing, copyright, provenance, and deletion questions.
3Map people who receive benefit, bear error, are represented in data, are evaluated, or may have limited ability to contest the output.
4Classify every action as read-only, reversible, approval-gated, external, or prohibited. Verify actual permissions rather than inferring them from tool capability.
5Describe foreseeable misuse, out-of-scope use, dependency, and downstream effects—including accessibility barriers and disparate error consequences.

Remember: Do not paste confidential or regulated information into a system merely because the exercise asks you to analyze it. Use a synthetic record when authorization is unclear.

Create the context map

Create the Map section of an AI risk-control record. Build tables for data/source/authorization/sensitivity/retention, affected people and possible impacts, and action/reversibility/approval. Include consent, confidentiality, provenance, copyright or licensing, accessibility, contestability, and foreseeable misuse. Mark unknowns as blockers; do not assume consent or permission.

Workflow: [paste]

What you leave with

Data and source inventory

Affected-party map

Permission and action classification

Practice evidence target

You can trace every material data flow and action to an authorized purpose, accountable person, affected group, retention rule, and permission decision—or an explicit unresolved blocker.

Step 2 checkpoint

Map data, people, permissions, and impact: practice checkpoint

Practice evidence target

You can trace every material data flow and action to an authorized purpose, accountable person, affected group, retention rule, and permission decision—or an explicit unresolved blocker.

Step 3 of 5 · 18 min

Define tests, thresholds, and evidence proportional to the consequences of failure.

Measure trustworthiness in the actual context

A model that performs well on a demonstration can still fail on missing sources, unusual cases, changed interfaces, biased data, prompt injection, or real operating volume. Measurement must test the workflow and context, not the model in isolation.

Do this

1Define quality measures tied to the task: claim support, completeness, classification accuracy, correction rate, safe refusal, accessibility, or another observable result.
2Create representative normal, boundary, adversarial, missing-data, and prohibited-action cases. Include groups or contexts that could experience different error rates or consequences.
3Specify acceptance thresholds before running the test and retain inputs, outputs, versions, reviewer decisions, and failures needed for inspection.
4Test human review: give the reviewer the information, criteria, time, and authority needed to catch consequential errors; measure review workload and misses.
5Record uncertainty and residual risk. Passing a finite test set does not prove universal safety or correctness.

Remember: Use authoritative human review for high-consequence claims. Model-based evaluation can assist triage but cannot certify its own professional correctness.

What you leave with

Test matrix

Predeclared thresholds

Human-review test

Residual-risk record

Minimum test families

Family	Question
Normal	Does the workflow meet the intended task on representative cases?
Boundary	What happens at unusual sizes, ambiguity, conflicting sources, or rare conditions?
Adversarial	Can instructions, sources, or connected content cause unsafe behavior or data exposure?
Missing/changed	Does it fail safely when data, tools, permissions, or interfaces are absent or stale?
Prohibited action	Does the workflow stop rather than perform an unauthorized external effect?

Step 3 of 5 · Run it

Apply it before you move on

Do this

1Define quality measures tied to the task: claim support, completeness, classification accuracy, correction rate, safe refusal, accessibility, or another observable result.
2Create representative normal, boundary, adversarial, missing-data, and prohibited-action cases. Include groups or contexts that could experience different error rates or consequences.
3Specify acceptance thresholds before running the test and retain inputs, outputs, versions, reviewer decisions, and failures needed for inspection.
4Test human review: give the reviewer the information, criteria, time, and authority needed to catch consequential errors; measure review workload and misses.
5Record uncertainty and residual risk. Passing a finite test set does not prove universal safety or correctness.

Remember: Use authoritative human review for high-consequence claims. Model-based evaluation can assist triage but cannot certify its own professional correctness.

Design the test record

Create the Measure section for this AI workflow. Define task-specific quality and safety measures, normal/boundary/adversarial/missing-data/prohibited-action cases, affected-group checks where relevant, predeclared thresholds, human-review tests, retained evidence, and residual uncertainty. Do not claim universal safety from a finite test set.

Workflow and context map: [paste]

What you leave with

Test matrix

Predeclared thresholds

Human-review test

Residual-risk record

Practice evidence target

Your test plan includes normal, boundary, adversarial, missing-data, and prohibited-action cases; predeclared thresholds; human-review tests; and retained evidence.

Step 3 checkpoint

Measure trustworthiness in the actual context: practice checkpoint

Practice evidence target

Your test plan includes normal, boundary, adversarial, missing-data, and prohibited-action cases; predeclared thresholds; human-review tests; and retained evidence.

Step 4 of 5 · 16 min

Select, operate, monitor, and retire controls based on measured risk.

Manage risk with layered controls

A disclaimer is not a control. Effective management changes access, behavior, detection, response, or consequence and produces evidence that the control actually operated.

Do this

1Choose layered controls: data minimization, least privilege, read-only access, allowlists, deterministic validation, approval gates, rate or scope limits, isolation, monitoring, and fallback procedures.
2Assign each residual risk to accept, mitigate, transfer, avoid, or escalate—with an accountable human and rationale.
3Define monitoring signals, incident severity, containment, notification, evidence preservation, recovery, and post-incident review.
4Set change triggers for new model versions, sources, tools, permissions, users, jurisdictions, or consequences. Require regression testing before material changes enter use.
5Define retirement: revoke connections, stop schedules, archive required evidence, delete data under policy, and inform affected users when appropriate.

Remember: Controls must be tested in the system where they matter. Written policy without enforcement or evidence is an intention, not proof of operation.

What you leave with

Layered control table

Residual-risk decisions

Incident and change plan

Retirement plan

Control strength

Weak statement	Operational control
Human in the loop	Named reviewer, decision criteria, required evidence, review timing, authority, and recorded decision
Use responsibly	Data classes, prohibited uses, least privilege, logging, monitoring, and enforced stop rules
Verify output	Defined claim checks, authoritative sources, test cases, thresholds, and retained results
We can turn it off	Named stop authority, tested kill path, schedule/connection revocation, and recovery procedure

Step 4 of 5 · Run it

Apply it before you move on

Do this

1Choose layered controls: data minimization, least privilege, read-only access, allowlists, deterministic validation, approval gates, rate or scope limits, isolation, monitoring, and fallback procedures.
2Assign each residual risk to accept, mitigate, transfer, avoid, or escalate—with an accountable human and rationale.
3Define monitoring signals, incident severity, containment, notification, evidence preservation, recovery, and post-incident review.
4Set change triggers for new model versions, sources, tools, permissions, users, jurisdictions, or consequences. Require regression testing before material changes enter use.
5Define retirement: revoke connections, stop schedules, archive required evidence, delete data under policy, and inform affected users when appropriate.

Remember: Controls must be tested in the system where they matter. Written policy without enforcement or evidence is an intention, not proof of operation.

Build the control plan

Create the Manage section of an AI risk-control record. For each material risk, list prevention, detection, human review, response, evidence, owner, residual risk, and accept/mitigate/transfer/avoid/escalate decision. Add monitoring, incident, change-regression, and retirement procedures. Reject controls that are only disclaimers.

Mapped risks and test results: [paste]

What you leave with

Layered control table

Residual-risk decisions

Incident and change plan

Retirement plan

Practice evidence target

Every material risk has an operating control or explicit acceptance/escalation decision, monitoring signal, incident response, change trigger, and retirement action.

Step 4 checkpoint

Manage risk with layered controls: practice checkpoint

Practice evidence target

Every material risk has an operating control or explicit acceptance/escalation decision, monitoring signal, incident response, change trigger, and retirement action.

Step 5 of 5 · 18 min

Recognize where professional authority, rights, safety, or irreversible consequences require qualified review.

Stop and escalate high-stakes work

AI can organize facts and surface questions without possessing licensure, fiduciary duty, privilege, clinical responsibility, security authority, or the relationship needed to make a consequential decision. The competence is knowing where assistance ends and accountable professional judgment begins.

Do this

1Classify the consequence of error and identify whether the work affects legal rights, finances, health, safety, employment, education, security, privacy, benefits, or another high-stakes interest.
2Use AI for bounded preparation—organizing provided sources, extracting terms, identifying questions, or drafting for review—only when data and use are authorized.
3Do not claim to be a lawyer, clinician, financial professional, security authority, or other licensed expert. Do not label output privileged, approved, compliant, or professionally reviewed unless a qualified person actually made that determination.
4Require authoritative source verification, jurisdiction and date checks, uncertainty disclosure, and qualified review before reliance or external action.
5Stop when authority, consent, facts, source currency, policy, jurisdiction, reviewer availability, or the ability to contest a decision is unclear. Record the escalation and do not continue by assumption.

Remember: A qualified reviewer must have relevant authority and evidence. Adding 'consult a professional' after an AI-made conclusion does not transfer the decision back to the professional.

What you leave with

High-stakes classification

Qualified-review requirement

Stop and escalation record

Professional boundary examples

Context	AI may assist with	Qualified person must decide
Legal	Extract terms, compare with an approved playbook, list issues and source questions	Legal interpretation, privilege, advice, negotiation authority, filing, or final approval
Financial	Organize provided data, test formulas, draft variance questions	Fiduciary decision, filing, assurance, tax or investment advice, approval
Medical	Organize authorized information and prepare questions	Diagnosis, treatment, clinical triage, consent, or patient-specific advice
Security/privacy	Inventory controls and evidence, flag gaps	Risk acceptance, incident authority, compliance determination, or disclosure decision

Step 5 of 5 · Run it

Apply it before you move on

Do this

1Classify the consequence of error and identify whether the work affects legal rights, finances, health, safety, employment, education, security, privacy, benefits, or another high-stakes interest.
2Use AI for bounded preparation—organizing provided sources, extracting terms, identifying questions, or drafting for review—only when data and use are authorized.
3Do not claim to be a lawyer, clinician, financial professional, security authority, or other licensed expert. Do not label output privileged, approved, compliant, or professionally reviewed unless a qualified person actually made that determination.
4Require authoritative source verification, jurisdiction and date checks, uncertainty disclosure, and qualified review before reliance or external action.
5Stop when authority, consent, facts, source currency, policy, jurisdiction, reviewer availability, or the ability to contest a decision is unclear. Record the escalation and do not continue by assumption.

Remember: A qualified reviewer must have relevant authority and evidence. Adding 'consult a professional' after an AI-made conclusion does not transfer the decision back to the professional.

Write the escalation record

Review this proposed AI workflow for high-stakes boundaries. Identify affected rights or consequences, what bounded preparation AI may perform, required authoritative sources, qualified professional review, prohibited representations or actions, stop conditions, and the escalation record. Do not provide the professional conclusion itself.

Workflow: [paste]

What you leave with

High-stakes classification

Qualified-review requirement

Stop and escalation record

Practice evidence target

You can identify a high-stakes boundary, name the qualified review required, state what AI may prepare, and define the facts or authority whose absence stops the work.

Step 5 checkpoint

Stop and escalate high-stakes work: practice checkpoint

Practice evidence target

You can identify a high-stakes boundary, name the qualified review required, state what AI may prepare, and define the facts or authority whose absence stops the work.

Formative practice complete

You have a risk-control record—not a responsible-AI slogan.

Keep the Govern, Map, Measure, Manage, and escalation evidence with the workflow. The planned capstone will score safety and governance as a critical dimension that cannot be averaged away.

Next course

Return to the AI Gear Audit

Use the formative ratings to choose the next lesson. Green remains self-reported until performance evidence is evaluated.

Open training

Review your gaps

Return to the AI Gear Audit

Update your formative self-rating and open the next direct lesson. Green remains self-reported, not certified.

Open training