Cheat sheet · Specialise
AI governance cheat sheet (Policy and compliance)
Opens with creditsFor people from law, risk, audit or business moving into AI governance. Revise the rules, then each layer as evidence you assess: AI registers, data reviews, DPIAs, model assurance reviews, oversight checks, compliance mapping and audits.
Curated by Tauseef Fayyaz7 chapters63 concepts110 glossary termsChapters
7 chapters · 63 concepts
1Regulations and frameworksThe laws, standards and principles that shape AI governance, what each one is for, how binding it is and the dates that matter, as of October 2026.10 concepts
- 1EU AI ActThe EU law that regulates AI by risk, with duties for providers and deployers.
- 2AI Act risk tiersFour levels: unacceptable (banned), high risk (strict requirements such as risk management, data governance, logging, oversight and accuracy), transparency risk…
- 3Prohibited AI practicesUses banned since 2 February 2025, such as harmful manipulation, exploiting vulnerabilities, social scoring, crime prediction from profiling alone, untargeted…
- 4General-purpose AI model obligationsDuties for providers of models that can do many tasks: technical documentation, information for downstream builders, a copyright policy and a public training…
- 5NIST AI RMFA free, voluntary US framework (version 1.0, January 2023, under revision as of 2026) with four functions: Govern, Map, Measure and Manage.
- 6ISO/IEC 42001The international standard (December 2023) for an AI management system: policies, roles, risk and impact assessment, Annex A controls, internal audit and…
- 7OECD AI PrinciplesThe first intergovernmental AI standard, adopted 2019 and updated May 2024: five values (inclusive growth, human rights and fairness, transparency, robustness…
- 8Pakistan and India AI policiesPakistan's National AI Policy 2025 (cabinet approval July 2025) focuses on adoption, skills and a secure AI ecosystem.
- 9UAE and Saudi AI principlesThe UAE Charter for the Development and Use of AI sets twelve principles, including safety, algorithmic bias, privacy, transparency and human oversight.
- 10Framework comparisonA side-by-side view of the main AI rules by type, scope and whether they can be certified, as of October 2026.
10 in this chapterOpen this chapter2AI inventory and ownershipFinding every AI system, describing and classifying it, assigning a risk tier and a named owner, and tracking the models inside.10 concepts
- 1AI governanceHow an organisation decides which AI it builds or uses, who owns each system, which risks it accepts and what evidence shows its controls work.
- 2AI systemIn the EU AI Act, following the OECD: a machine-based system that works with some autonomy and infers from inputs how to produce outputs such as predictions…
- 3AI inventoryA maintained list of every AI system an organisation builds, buys or uses, with purpose, owner, data, vendor, affected people, legal role, risk tier and review…
- 4Shadow AIAI that staff use without the organisation knowing or approving: public chatbots, personal API keys in scripts, AI browser extensions.
- 5System classificationDescribing an AI system by purpose, users, affected people, decisions supported, data, model and deployment, then labelling its type and legal category.
- 6Risk tieringAssigning each system an internal tier, often low, medium or high, from its impact on people and how much a human checks its output, alongside its legal tier.
- 7System ownerThe named person accountable for an AI system's behaviour, changes and residual risk, usually supported by a technical owner who runs it day to day.
- 8Provider and deployerUnder the EU AI Act, the provider develops a system or model and places it on the market under its name; the deployer uses it under its authority.
- 9Third-party AIAI that arrives through vendors: API models, AI features inside SaaS products and open models you download.
- 10Model registryA store of model versions with training data reference, code version, parameters, evaluation results, approver and stage (staging, production, archived).
10 in this chapterOpen this chapter- Data foundationWhere data comes from, how it flows, whether it is fit and fresh, and whether it is biased before a model learns from it.8 conceptsOpens with credits
- Data security and accessProtecting the data AI systems use: encryption and keys, anonymisation and pseudonymisation, access control, and the GDPR basics behind most of it.10 conceptsOpens with credits
- Model assuranceShowing that a model does what it claims, for everyone it affects, and keeps doing it after deployment.8 conceptsOpens with credits
- Human oversightHow people stay in charge: who reviews decisions, how cases escalate, who can override or stop the system, and who is accountable.8 conceptsOpens with credits
- Compliance and auditTurning requirements into evidence: mapping, policy enforcement, audit trails, incident reporting and conformity assessment.9 conceptsOpens with credits
- 8Glossary, A to ZEvery concept in the sheet and the smaller terms it uses, in one list.110 terms
About this sheet
Inventory, oversight, EU AI Act, ISO 42001.
Related on Sefism
Picked from the other libraries by shared topics.
Roadmaps
See allBest practices
See all- Best Practices for Building LLM AppsHow to build LLM apps and agents that hold up in production: prompts, evals, prompt injection, tool permissions, cost, logging and privacy.
- Prompt Engineering Best PracticesHow to write prompts that work the same way on the hundredth input as on the first: clear instructions, structure, examples, reasoning, output control and testing.
- Best Practices for AI Coding AssistantsHow to get reliable code from AI coding assistants and agents: instruction files, task prompts, verification, review, security, dependencies and session hygiene.
Checklists
See all- EU AI Act Readiness ChecklistAn EU AI Act readiness checklist for teams building or deploying AI: scope and roles, prohibited practices, risk classification, transparency, GPAI duties, oversight and dates.
- RAG Production ChecklistA RAG production checklist: chunking, embeddings, hybrid search, reranking, per-user permissions, citations, evals, re-indexing and cost, with how to verify each check.
- LLM Evaluation ChecklistAn LLM evaluation checklist: success criteria, eval datasets, code and model graders, judge calibration, agent evals, safety tests and production monitoring, with how to verify each check.
Project structures
See all- GenAI RAG app (FastAPI) project structureFor developers turning a "chat with your documents" demo into an app people can rely on. A FastAPI backend where every layer has a home: ingestion workers, retrieval, prompts as versioned files, model clients with fallbacks and cost caps, guards, evals that gate CI, and tracing, so a wrong answer can be traced to the step that caused it.
- AI agent with an MCP server project structureFor developers who want to give AI assistants safe access to their own data or API. A TypeScript MCP server built on the official SDK, organised by feature (tasks, projects) with each feature owning its tools, resources and prompts, served over stdio for local hosts and Streamable HTTP with OAuth for remote ones, plus a small agent and the evals that prove a model can use it.
- Machine learning project project structureFor students and analysts whose model works in a notebook and now needs to be reproducible, reviewable, served and watched. It starts from the Cookiecutter Data Science v2 layout (immutable raw data, numbered notebooks, a real Python package) and grows into versioned data with DVC, typed parameters, data validation with pandera, experiment tracking and a model registry with MLflow, a FastAPI prediction service, drift monitoring and, for a team, scheduled retraining, model cards, fairness checks and shadow deployment.
Career questions
See all- Can I use AI coding tools at my internship, and what should I never paste into them?Usually yes, but only the tools your company has approved, on the code and data they allow, and in the way they allow. Ask in your first week. Never paste secrets, customer data or code you are not permitted to share, and review everything the tool writes as if your name is on it, because it is.
- I am good with computers but not good at math. Can I still have a successful career in software engineering or AI?Yes for most of software engineering, which needs logical thinking far more than advanced math. For AI it depends on the role: building products on top of models needs little math, while research and model training need a lot. Most people who say they are bad at math were taught badly, and the math you need can be learned.
- How do I get into AI security as a student or junior engineer?Build a normal security or software foundation first, then learn how LLM apps fail using the OWASP Top 10 for LLM Applications and MITRE ATLAS, and prove it by building, testing and hardening a small LLM app of your own. Most people reach AI security through AppSec, security engineering or ML engineering, not straight from university.
Work with me
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com