Sefism AI Governance Cheat Sheet

What this cheat sheet is

The Sefism AI governance cheat sheet is a revision reference for the rules and the practical layers of AI governance. It is written for engineers, data people and people from policy, risk or audit working on accountable AI, and it follows the AI governance roadmap: one chapter on regulations and frameworks, then one per layer of governance.

It has 7 chapters and 63 concepts, in two editions (technical and policy) that share every concept and differ in their summary and one closing rule of thumb. Each concept is written the same way: what it is in plain words, why it matters, and, for many, an example or the mistake people make with it. Each chapter ends with up to three library resources, and a glossary covers about 47 smaller terms. Legal facts are dated as of October 2026.

Chapter by chapter

1. Regulations and frameworks

Ten concepts: the EU AI Act, its risk tiers, prohibited AI practices, obligations for general-purpose AI models, the NIST AI RMF, ISO/IEC 42001, the OECD AI Principles, the AI policies of Pakistan and India, the UAE and Saudi AI principles, and a framework comparison showing what each is for and how binding it is.

2. AI inventory and ownership

Ten concepts: AI governance itself, what counts as an AI system, the AI inventory, shadow AI, system classification, risk tiering, the system owner, provider and deployer roles, third-party AI and the model registry. You cannot govern what you cannot see.

3. Data foundation

Eight concepts on whether data is fit to learn from: data provenance, datasheets for datasets, data lineage, data quality checks, data freshness, representativeness, bias screening and proxy variables.

4. Data security and access

Ten concepts: encryption in transit and at rest, key management, pseudonymisation, anonymisation, PII detection and masking, role-based access control, least privilege, GDPR principles, lawful basis and the data protection impact assessment (DPIA).

5. Model assurance

Eight concepts: model cards, benchmarks, disaggregated evaluation, fairness metrics, red-teaming, data drift, concept drift and explainability. The theme is showing that a model works for everyone it affects, and keeps working after deployment.

6. Human oversight

Eight concepts: human in, on or out of the loop, automation bias, escalation paths, override authority, output validation, rights on automated decisions, the RACI accountability map and AI literacy.

7. Compliance and audit

Nine concepts that turn requirements into evidence: compliance mapping, policy enforcement, audit trails, technical documentation, serious incident reporting, conformity assessment, post-market monitoring, the three lines model and the AI impact assessment.

Rules of thumb

The sheet closes with nine rules per edition, among them: date every legal claim and the day you checked it; cite the article, not the blog; tier by impact on people, not by model size; give every AI system one named accountable person, never a committee; ask for evidence, not statements; treat zero overrides over months as a sign of rubber-stamping; and map once to the strictest source, then add columns for other frameworks. The technical edition adds "build evidence into the pipeline so audits take hours, not months"; the policy edition adds "test practice, not documents".

How to use it with the roadmap

• After each stage, read the matching chapter and see whether you can explain every concept without looking. Chapters 1 to 7 line up with the roadmap's first seven stages; the career stage has no chapter.
• Before you classify a system, reread chapters 1 and 2 together: the tiers in the Act and your own inventory rules.
• When reviewing a real system, use chapters 3 to 6 as a checklist of the evidence you should ask for.
• Before an audit or a compliance pack, chapter 7 is the last pass, along with the rule about dating every claim.

How it works on Sefism

Everything on Sefism is free to learn from. The public cheat sheet page shows every chapter title, with the first chapters open to read. Keeping the sheet uses credits and opens every chapter in your member area; if you add the AI governance roadmap to your dashboard, its cheat sheet comes with it, and the first roadmap you add is free. New members get starting credits, and if you have a question the sheet does not answer, you can send it to Tauseef.

Related on Sefism

• EU AI Act and the AI Act Service Desk for chapter 1, with the OECD AI Principles.
• Presidio for PII detection in chapter 4, Fairlearn and Model Cards for chapter 5.
• ISO/IEC 42001 and the NIST AI RMF for chapter 7.
• Related: the AI security cheat sheet and the AI security roadmap.

FAQ

Is this a substitute for the roadmap? No. The roadmap is the plan, with hours, milestones and a portfolio project; the sheet is what you revise from once you have done the work.

What are the EU AI Act risk tiers? Four levels: unacceptable risk (banned practices), high risk (strict requirements), transparency risk (disclose AI use or generated content) and minimal risk (no new duties), with separate obligations for general-purpose AI models. Chapter 1 explains each with the dates that apply, as of October 2026.

What is shadow AI? AI tools and features staff use without approval or record, such as a personal chatbot account or an AI feature switched on inside a vendor product. Chapter 2 covers how to find it.

What is the difference between anonymisation and pseudonymisation? Pseudonymised data can still be linked back to a person with extra information, so it remains personal data under the GDPR; truly anonymised data cannot. Chapter 4 explains why the difference matters.