# AI Governance and Adoption for Leaders | Aiqbee Academy

AI Governance and Adoption for Leaders

Choose a sectionUnderstand AI risk in contextConsumer, business and enterprise tiersCreate an acceptable-use guideDesign human accountabilityThe EU AI Act’s literacy dutyNIST and ISO 42001, without the price tagDevelop skills and championsMeasure adoption and outcomesGovern shared AI knowledgeGovern agents before they actAiqbee Platform or Hive ServerBuild your governance playbookFinal quiz

# Understand AI risk in context

## What you'll learn

Estimated time: 9 minutes

This course assumes the AI-usage concepts covered in Practical AI Foundations and builds governance on top of them. AI risk is not one number. A use case is low, medium or high risk depending on three things acting together: how sensitive the data is, how much is at stake in the decision, and how much the system can do without a person checking first.

-   Name the three dimensions that drive AI risk.
-   Score a real use case against those dimensions.
-   Match the review requirement to the resulting tier.

Video lesson

The animation scores a public newsletter draft against an unsupervised payroll change using the same three-question rubric.

## Three questions, not one score

Data sensitivity asks what the AI is reading: public information, internal notes, confidential client material, or regulated personal data. Decision stakes asks what happens if the output is wrong: an ignorable draft, or a decision that affects money, safety or someone’s employment. Autonomy asks whether a person checks the result before it takes effect, or whether the system acts on its own.

A use case only needs one of these to be high for the whole thing to need a closer look. A confidential file summarised for internal review only is lower risk than a public press release drafted and posted by an agent (AI acting on systems, not just drafting) with no review step, because autonomy carries most of the weight in the second case.

## Score real use cases, not categories

Generic labels like “marketing” or “HR” do not tell you the risk; the specific task does. Score the actual request your team wants to run.

-   Data: public, internal, confidential, or regulated.
-   Stakes: reversible and low-cost, or affects money, rights, safety or reputation.
-   Autonomy: advisory only, drafts for review, or acts and writes without a check.

## Worked example: rating two requests

Prompt: “Score this use case against our risk rubric – data: internal HR notes; stakes: irreversible, affects an employee’s pay; autonomy: the agent updates the payroll system directly with no review. Give a tier and the single biggest driver.”

Excerpted response: “Tier: high. Data sensitivity is only medium (internal, not regulated), but the driver is autonomy: the system writes directly to payroll before an irreversible pay change with no human check. Add a review step before the write action, or restrict the agent to draft-only until one exists.”

## Use the tier to set the review bar

The tier is not the end of the exercise; it decides how much review a task gets before it runs, which is exactly what the next three lessons build on.

## Put it into practice

1\. Prepare your practice material

Write three to five sentences describing a real or fictional situation in which you need to classify use cases by data sensitivity, decision stakes and autonomy. Include the intended user, one constraint and how you will check the result.

2\. Choose your AI tool

Choose one tool for this exercise. The remaining steps will adapt to it.

ChatGPTClaudeMicrosoft Copilot

3\. Copy the prompt

Prompt you will use

Pick three real or planned AI use cases from your organisation. For each, state the data sensitivity, decision stakes and autonomy level, then ask an AI to assign a tier and name the single biggest risk driver. Do not accept a tier without a stated driver.

4\. Open ChatGPT · Paste the prompt into a new chat

Open a new chat in ChatGPT and paste the copied prompt into the message box.

[Open ChatGPT](https://chatgpt.com/)

5\. Add your practice material

Paste your prepared scenario beneath the prompt, separated by a heading such as “Practice scenario”.

6\. Send, then review the result

Answer any clarifying questions. Before using the result, check it against your source and the completion checks below.

## Before you continue

The three risk dimensions are named for a real use case.

A use case has been scored, with the biggest driver identified.

A review requirement has been matched to the resulting tier.

* * *

Source: https://www.aiqbee.com/learning/en/course/ai-governance-and-adoption