Sefism AI Governance Roadmap

What this roadmap is

AI governance is Sefism's eight-stage path into the work of making AI systems accountable, safe and lawful. It is written for two kinds of people who increasingly end up in the same meetings: engineers and data people who build AI systems, and people from law, risk, audit or business who have to judge them. You choose your background when you add the roadmap, and the stages adjust: the technical edition builds controls into pipelines and products, the policy edition learns to read the rules, review evidence and run audits.

The roadmap follows the layers of governance in the order you would put them in place: the rules, an inventory of what you run, the data underneath, how that data is protected, assurance for the models, human oversight, and compliance and audit. By the end you should be able to:

• explain the EU AI Act risk tiers and its dated timeline, the NIST AI RMF, ISO/IEC 42001, the OECD principles and the AI policies of Pakistan, India, the UAE and Saudi Arabia, citing official sources
• build an AI inventory that finds shadow AI, classifies each system, assigns a risk tier and names an owner
• check the data behind an AI system for source, lineage, quality, freshness, bias and lawful, secure handling
• assure a model with a model card, disaggregated evaluation, fairness tests, red-teaming and drift monitoring, or assess that evidence as a reviewer
• design human oversight with clear decision review, escalation, override authority and accountability
• map a system to its legal obligations, keep audit trails, handle incidents and show a governance portfolio project

Who it suits, and who should start elsewhere

It suits engineers, data scientists and ML engineers who are asked to "make the AI compliant", and law, compliance, risk, audit and business graduates who want a technical-enough specialism. It also suits students in either group looking for a direction where AI creates work rather than removing it.

It is not a course in building AI systems. If you are technical and want to secure LLM apps hands on, AI security is the closer fit. If you want to build the systems themselves, see AI engineering or MLOps and LLMOps. If you are coming from a non-tech career and still deciding on a direction, Switch into tech and Tech roles beyond coding help you decide first.

Editions, prerequisites and time

You choose one of two backgrounds: Technical (engineering, data or ML, the default) or Policy and compliance (law, risk, audit or business). The eight stages and their hours are the same in both, with 48 topics each; what changes is the angle of some topics, summaries and milestones. Technical learners wire data checks, assurance and evidence into pipelines; policy learners read source texts, write DPIAs and run an AI audit.

The estimate is about 114 hours across 8 stages. How that turns into weeks depends on the hours you set on your dashboard:

• A student with about 10 hours a week finishes in around 11 to 12 weeks. A sensible week is two evenings reading the source texts and topics, and one longer block on the milestone, which is usually a document you could show an employer.
• Someone working full time with about 5 hours a week should plan for around 23 weeks. If your job already touches data, risk or compliance, use a real (anonymised) system from work as your example, with permission.

The first stage, on the rules, is a foundation stage: if you already know the main frameworks, it can be skipped. You need no programming for the policy edition; the technical edition assumes you can read Python and SQL.

Stage by stage

1. Why AI governance, and the rules (16 hours)

What AI governance is and why it is a job now, the EU AI Act risk tiers and prohibited practices, its timeline including the 2026 delay, general-purpose AI models under the Act, the NIST AI RMF and its Generative AI Profile, ISO/IEC 42001 and the OECD AI Principles, and the policies of Pakistan, India, the UAE and Saudi Arabia. Milestone: a two-page rules brief in your own words, every claim with an official source and the date you checked it. Tauseef's note: AI rules changed several times between 2024 and 2026, so write every date down with the day you checked it.

2. AI inventory: know what you run (12 hours)

What counts as an AI system, finding shadow AI, classifying systems and assigning a risk tier, naming an owner for every system, and model registries. Milestone: an AI inventory for a sample company of about 50 staff, with at least eight systems including two shadow AI uses and two vendor features, each with purpose, owner, data, EU AI Act role and tier, and a written reason.

3. Data foundation (16 hours)

Most AI failures start in the data. Topics: source tracking and provenance, data lineage, quality validation, freshness, and bias screening, either wired into the pipeline (technical) or assessed as a reviewer (policy). Milestone: a datasheet for one public dataset about people, with a data quality report or list of required checks, a lineage sketch, a freshness target and a bias screen across groups.

4. Data security and access (14 hours)

Encryption and key management, anonymisation and pseudonymisation, role-based access and least privilege, and the GDPR basics that apply to most AI built on personal data, with the DPIA as the policy edition's main tool. Milestone: a data protection plan for one AI system that uses personal data, ending in a short DPIA outline with the lawful basis and the top risks.

5. Model assurance (18 hours)

Model cards, benchmarks and disaggregated evaluation, fairness testing, red-teaming, and drift detection and monitoring. Milestone: for the technical edition, an assurance pack for one model with an honest model card, results by group, a fairness assessment, a red-team log and a drift plan; for the policy edition, an assurance review of a public model or AI product with approval conditions, owners and dates.

6. Human oversight (10 hours)

Decision review (in, on or out of the loop), escalation paths, override authority and the stop button, output validation and accountability mapping, either built into the product or assessed for whether it is real. Milestone: an oversight design for one high-risk system with escalation triggers, override and stop authority, validation rules and a RACI table naming one accountable role per activity.

7. Compliance and audit (14 hours)

Mapping a system to the EU AI Act, policy enforcement, audit trails, incident reporting and conformity assessment basics, with automated compliance evidence for technical learners and running an AI audit for policy learners. Milestone: a compliance pack for one AI system with a requirement-by-requirement mapping, controls, evidence and owners, an incident response plan with reporting deadlines and a note on its conformity assessment route.

8. A career in AI governance (14 hours)

The roles, honestly; certifications and when they help; your portfolio project; staying current; and the route in from a technical or a policy background. Milestone: a published portfolio project, an AI inventory and full risk assessment for a sample company with a one-page executive summary and dated sources, plus ten real job postings and the adjacent role you will target first.

Projects that fit

The roadmap suggests two final year project ideas for both editions and three more for the technical edition:

• Thin-file credit scoring with a fairness audit for digital lenders, a high-risk use under the EU AI Act, built or assessed end to end
• Explainable resume and job description matching, a hiring system for practising oversight, explanations and bias testing
• For the technical edition: a synthetic patient records generator with a privacy attack report, a demand forecasting service with drift monitoring and a tamper-evident audit log service

How it works on Sefism

Everything on Sefism is free to learn from. The public page at AI governance shows the full list of eight stages for your chosen edition, with the first two stages open: their topics, milestones and recommended material. Later stages show their title, summary, hours and topic count.

To open every stage, add the roadmap to your dashboard. Adding a roadmap uses credits, new members get starting credits when they join, and your first roadmap is free. Once it is on your dashboard you can:

• open every stage, its topics, checks, AI study prompts and recommended material
• tick stages off and track your progress, at a pace set by the hours you have each week
• keep the companion AI governance cheat sheet, which comes with the roadmap
• ask Tauseef a question about any stage, or book a 1:1 session if you want to talk your plan through

If you are new, create a free account first. Credits are there so the platform goes to people who are actually learning, and if you run out while learning seriously, you can ask for more.

The companion cheat sheet

The AI governance cheat sheet covers the rules and the six layers of governance in seven chapters and 63 concepts, from the AI Act risk tiers and ISO/IEC 42001 to DPIAs, drift, RACI maps and conformity assessment. It comes in two editions, technical and policy. Use it to revise after each stage and as a checklist when you review a real system.

Related on Sefism

• I feel AI is moving too fast to keep up. What should I focus on?
• How do I become a business analyst in tech?, a nearby route for people coming from business
• Library picks used in the stages: EU AI Act, AI Act Service Desk, NIST AI RMF, ISO/IEC 42001, AI Incident Database, Fairlearn and IAPP AIGP
• Related roadmaps: AI security, Tech roles beyond coding and MLOps and LLMOps

What you can do afterwards

You can walk into a team that runs AI and produce the documents governance depends on: an inventory, a risk tier with reasons, a DPIA outline, an assurance pack or review, an oversight design and a compliance mapping with dated sources. From here, AI security adds hands-on technical controls, and the career stage points you to the adjacent role where you can start doing this work for real.

Frequently asked questions

Do I need to code to work in AI governance? No. The policy edition needs no programming. Technical skills help you read evidence and talk to engineers, which is why the technical edition exists for people who already have them.

How long does the roadmap take? About 114 hours. At 10 hours a week that is around 11 to 12 weeks; at 5 hours a week, around 23.

Does the EU AI Act matter if I live in Pakistan, India or the Gulf? It applies to anyone whose AI is used in the EU, wherever they are based, so it matters for anyone building for European clients. Stage 1 also covers the policies in Pakistan, India, the UAE and Saudi Arabia, with official sources and dates.

Which certification should I get? The roadmap's advice is to show applied work first: one sample company assessed end to end says more than a certificate. Stage 8 discusses certifications such as the IAPP AIGP and when they help.

Why does the roadmap keep asking me to date things? Because AI rules changed several times between 2024 and 2026, including a delay to parts of the EU AI Act timeline. Quoting a deadline that has moved is the fastest way to lose trust in a governance meeting.