Training Module
AI Risk Management
Assess AI risks across use context, affected parties, GenAI and agency, then turn findings into treatment, monitoring and residual risk
Overview
Generic statements about AI risk rarely improve decisions. Effective governance requires a structured understanding of what is being assessed, who may be affected, how harm can occur, and when an AI system no longer behaves like passive software.
This module teaches practical AI risk management for management-system environments. Participants define assessment units and intended use, identify affected parties, build harm pathways, use FRIA-style prompts, stress-test GenAI and agentic risk sources, apply risk criteria, compare treatment and deployment-gate options, and document residual-risk, monitoring and assurance decisions.
The focus is on producing assessment evidence that is traceable, defensible and useful to governance, legal, risk, audit, customer assurance and operational stakeholders, without pretending that the module replaces legal advice, technical red teaming or operational-control design.
Applicable environments
This module applies to organisations implementing or operating a AI Management System (AIMS) in line with ISO/IEC 42001. It focuses on how the standard’s requirements are interpreted and applied in practice within real organisational contexts.
The content is relevant for organisations seeking certification as well as for those using ISO/IEC 42001 as a reference framework to structure responsibilities, processes, and controls in the AI management domain.
Target audience
People involved in designing, building, operating, or improving an AIMS aligned with ISO/IEC 42001
Executives and department heads accountable for the effectiveness and performance of an AIMS
Those responsible for processes, policies, applications, risks or risk controls related to AI
Auditors of ISO/IEC 42001 who want to deepen their understanding of management-side best practices (not audit technique)
Decision support
Is this module for you?
Agenda
Assessment frame, intended use and role assumptions
Affected parties and FRIA-style impact prompts
Harm pathways and decision-ready risk statements
GenAI, agency and capability-control stress testing
Criteria, uncertainty and evidence confidence
Treatment, usage conditions and deployment gates
Residual risk, monitoring, assurance and currency
Show detailed agenda...
Learning outcomes
Key outcomes
Define AI system impact assessment units across intended use, context, role assumptions, affected parties and lifecycle state
Build credible harm pathways and risk statements using affected-party, FRIA-style and evidence-confidence reasoning
Stress-test GenAI, agency, optimisation and capability-control risks before deployment or continuation decisions
Additional capabilities
Translate assessment findings into treatment, usage conditions, deployment gates and residual-risk decisions
Separate deployer monitoring, provider post-market information needs, reassessment triggers and assurance evidence
Maintain assessment practice as AI law, standards, guidance, incident patterns and model capabilities evolve
Materials
Learning materials
Slide deck
Participant workbook
Templates & tools
Practical, reusable artefacts to apply the module directly to your organisation.
AI assessment scope and intended-use worksheet
Affected-party and harm pathway canvas
AI harm scenario and risk statement builder
GenAI and capability-control stress-test checklist
Risk criteria, treatment and deployment-decision worksheet set
Residual-risk acceptance and monitoring record template
AI-assisted assessment review prompts and safeguards guide
Confirmation
Certificate of completion
Overview
Dates
Bespoke
Module ID
HAM-AI-S-02
Discipline
ISO standard
Standard clause
6: Planning
Target audience
Delivery
Live virtual delivery
This module is delivered live online and combines conceptual framing, discussion, case work and direct interaction with the instructor.
Custom delivery options
For organisations with specific constraints or learning objectives, the module can be adapted in format or scope, including in-house delivery and contextualised case material.
Upcoming course runs
A public cohort is currently not scheduled. If you register your interest, we will notify you when a new public cohort is scheduled or suitable delivery options become available.
For an optimal learning experience
Prerequisites & preparation
This module is designed as part of a modular training approach. Topics are deliberately distributed across modules and are not repeated in full, in order to avoid unnecessary redundancy. Each module is self-contained and can be taken on its own. Where prior knowledge or experience is helpful, this is indicated below so you can decide whether any preparation is useful for you.
Assumed background
No formal prerequisites. Participants should be ready to work with basic risk-management, AI-system and lifecycle concepts at the practical level needed for the assessment work.
Helpful background includes:
Familiarity with management system roles, responsibilities and documented information practices
Practical comfort with basic risk concepts such as causes, consequences, controls, criteria, acceptance and review triggers
Practical awareness of AI system behaviour, limitations, failure modes and the need to recognise when specialist input is required
Preparatory modules
Foundational modules (depending on background)
Useful if you are new to the underlying concepts or want a shared baseline before attending this module.
Supporting modules (optional)
Helpful if you want to deepen related skills, but not required to participate effectively.
