This module shows how to decide which AI risks deserve attention first when time and budget are limited. You will learn how likelihood and impact are rated on five-point scales, how they combine into a single risk score, and how to read the low, medium, and high zones of a 5x5 risk matrix. You will see how to build a simple risk register and heat map in Google Sheets, and how to use written rating scales and a few practical habits to reduce common scoring biases. These skills help you turn a long list of risks into a clear order of priorities.

This module focuses on gathering evidence about how a generative AI chatbot actually behaves, rather than relying on demos or vendor claims. You will explore three common failure modes: hallucination, where the chatbot invents information; bias, where it treats people differently for reasons that should not matter; and prompt injection, where a user’s message gets around its instructions. You will see how to design simple, plain-language tests for each, set pass and fail criteria in advance, and record the results in a structured test log. No technical background is needed to run these tests.

This module introduces the risk-based approach of the EU AI Act and shows how to make a first classification of an AI system using the text of the law itself. You will explore the four risk tiers, from prohibited to minimal risk, and learn why the tier depends on how a system is used rather than on the technology alone. You will see how to check a use case against the Act’s lists of prohibited practices, high-risk areas, and transparency duties, and how to tell whether your organization acts as a provider, deployer, importer, or distributor. The module is designed for orientation and does not replace legal advice.

This module covers the final step of an AI risk assessment: deciding what to do about the risks and communicating that decision clearly. You will explore four ways to respond to a risk, namely avoid, mitigate, transfer, and accept, along with common types of controls for AI systems and the idea of residual risk. You will see how to use the NIST AI RMF Playbook to find suggested actions and turn them into specific controls with owners and deadlines. You will also learn how to structure a one-page report that leads with a go, conditional go, or no-go recommendation that decision-makers can act on.