Roadmap · Specialise
AI governance
Opens with creditsFor engineers, data people and students from law, risk, audit or business who want to work on making AI systems accountable, safe and lawful. By the end you can read the main AI rules, build an AI inventory, check data and models, design human oversight, map a system to the EU AI Act and show a governance portfolio project.
Curated by Tauseef Fayyaz8 stages, 48 topics~6 months at a few hours a weekBy the end, you will be able to
- Explain the EU AI Act risk tiers and dated timeline, the NIST AI RMF, ISO/IEC 42001, the OECD principles and the AI policies of Pakistan, India, the UAE and Saudi Arabia, citing official sources
- Build an AI inventory that finds shadow AI, classifies each system, assigns a risk tier and names an owner
- Check the data behind an AI system for source, lineage, quality, freshness, bias and lawful, secure handling
- Assure a model with a model card, disaggregated evaluation, fairness tests, red-teaming and drift monitoring, or assess that evidence as a reviewer
- Design human oversight with clear decision review, escalation, override authority and accountability
- Map a system to its legal obligations, keep audit trails, handle incidents and show a portfolio project to employers
The path
8 stages, in the order to learn them. Open one to start.
1Why AI governance, and the rulesWhy organisations need AI governance, and the rules and frameworks that shape it: the EU AI Act and its 2026 timeline changes, the NIST AI RMF, ISO/IEC 42001, the OECD principles, and the AI policies of Pakistan, India, the UAE and Saudi Arabia. You learn what each one is, how binding it is and where to read the source.8 topics · ~4 weeks
- 1What AI governance is, and why it is a job nowAI governance is how an organisation decides which AI systems it may build or use, who owns each one, which risks it accepts and what evidence shows the…
- 2The EU AI Act: risk tiers and prohibited practicesThe EU AI Act (Regulation (EU) 2024/1689) sorts AI by risk.
- 3The EU AI Act timeline, including the 2026 delayThe Act entered into force on 1 August 2024 and applies in phases.
- 4General-purpose AI models under the ActA general-purpose AI model is one that can do many different tasks, such as a large language model.
- 5NIST AI RMF and its Generative AI ProfileThe NIST AI Risk Management Framework is free, voluntary guidance from the US National Institute of Standards and Technology.
- 6ISO/IEC 42001 and the OECD AI PrinciplesISO/IEC 42001:2023, published in December 2023, is the international standard for an AI management system.
- 7Pakistan, India, the UAE and Saudi ArabiaOutside Europe, most governments have chosen policies and principles rather than AI laws so far.
- 8What the rules mean for the people who buildFor an engineer, most legal requirements turn into concrete work.
8 in this stageOpen this stage2AI inventory: know what you runYou cannot govern what you cannot see. Find every AI system in an organisation, including shadow AI, describe and classify each one, assign a risk tier and a named owner, and keep models in a registry.6 topics · ~3 weeks
- 1What counts as an AI systemBefore you can list AI systems, you need a definition.
- 2Finding shadow AIShadow AI is AI that people use without the organisation knowing or approving it: an analyst pasting customer data into a public chatbot, a team wiring an LLM…
- 3Classifying systems and assigning a risk tierEach inventory entry needs a description and a classification.
- 4Ownership: every system has a named personEvery system in the inventory needs a named owner: a person, not a team or a vendor, who is accountable for its behaviour, approves changes, accepts residual…
- 5Model registries and the inventoryAn inventory lists systems; a model registry tracks the models inside them.
- 6Building the inventory into engineeringEngineers can make the inventory stay true instead of going stale.
6 in this stageOpen this stage- Data foundationMost AI failures start in the data. Track where data comes from and how it flows, check its quality and freshness, and screen it for bias before a model learns from it.6 topics · ~4 weeksOpens with credits
- Data security and accessProtect the data AI systems use: encryption and key management, anonymisation and pseudonymisation, role-based access and least privilege, and the GDPR basics that apply to most AI built on personal data.5 topics · ~3 weeksOpens with credits
- Model assuranceShow that a model does what it claims, for everyone it affects, and keeps doing it: model cards, benchmarks and disaggregated evaluation, fairness testing, red-teaming and drift detection.6 topics · ~4 weeksOpens with credits
- Human oversightDesign how people stay in charge of AI decisions: which decisions get reviewed, how cases escalate, who can override or stop the system, how outputs are validated and who is accountable for what.6 topics · ~2 weeksOpens with credits
- Compliance and auditPull it together into evidence: map a system to the EU AI Act, enforce policies, keep audit trails, report incidents and understand how conformity assessment works.6 topics · ~3 weeksOpens with credits
- A career in AI governanceThe roles that do this work, the certifications worth considering and when, and a portfolio project that shows employers you can do it: an AI inventory and risk assessment for a sample company.5 topics · ~3 weeksOpens with credits
6 more stages, 34 more topics, free with an account.
You have seen the open stages of the AI governance roadmap. Every topic it covers is listed above, and an account opens the rest: what each topic means, a question to check yourself, the courses, the practice and Tauseef's advice for every stage. Early access is open: sign up and your account is active shortly after.
Everything here is free to learn from. A few things, like adding a roadmap, keeping a cheat sheet or asking Tauseef a question, use credits. You get 15 when you join, your first roadmap is free, and if you are learning seriously and run out, you can ask for more. Credits only make sure the platform goes to people who are actually learning.
Build a project
A finished project proves more than a certificate.
- Start with this onebeginner1 semester · 1 to 2 studentsEU AI Act Risk Classification Questionnaire for Software Exporters
Turns the rules stage into a guided questionnaire that helps a software house outside the EU see where its AI features fall under the Act
- Next.js
- TypeScript
- JSON decision rules
- PostgreSQL or SQLite
- Playwright for tests
- beginner1 semester · 1 to 2 studentsModel Card and Datasheet Generator from Training Runs
Model assurance documentation drafted from real training runs, with gaps flagged instead of filled in
- Python
- MLflow
- pandas
- Jinja2 templates
- Hugging Face Hub
- intermediate2 semesters · 2 to 3 studentsPharmacy Demand Forecasting Service with Drift Monitoring and Automated Retraining
Drift monitoring with owners and actions, a core model assurance control
- Python
- scikit-learn or LightGBM
- DVC
- MLflow
- Prefect
- intermediate1 semester · 2 to 3 studentsAI System Inventory and Risk-Tier Register for Software Companies
The inventory stage as a working tool: find where AI is used, give each system an owner and assign a risk tier from a clear rubric
- Next.js
- TypeScript
- PostgreSQL
- Prisma or Drizzle
- GitHub API
Related on Sefism
Picked from the other libraries by shared topics.
Best practices
See all- Best Practices for Building LLM AppsHow to build LLM apps and agents that hold up in production: prompts, evals, prompt injection, tool permissions, cost, logging and privacy.
- Prompt Engineering Best PracticesHow to write prompts that work the same way on the hundredth input as on the first: clear instructions, structure, examples, reasoning, output control and testing.
- Best Practices for AI Coding AssistantsHow to get reliable code from AI coding assistants and agents: instruction files, task prompts, verification, review, security, dependencies and session hygiene.
Checklists
See all- EU AI Act Readiness ChecklistAn EU AI Act readiness checklist for teams building or deploying AI: scope and roles, prohibited practices, risk classification, transparency, GPAI duties, oversight and dates.
- RAG Production ChecklistA RAG production checklist: chunking, embeddings, hybrid search, reranking, per-user permissions, citations, evals, re-indexing and cost, with how to verify each check.
- LLM Evaluation ChecklistAn LLM evaluation checklist: success criteria, eval datasets, code and model graders, judge calibration, agent evals, safety tests and production monitoring, with how to verify each check.
Project structures
See all- GenAI RAG app (FastAPI) project structureFor developers turning a "chat with your documents" demo into an app people can rely on. A FastAPI backend where every layer has a home: ingestion workers, retrieval, prompts as versioned files, model clients with fallbacks and cost caps, guards, evals that gate CI, and tracing, so a wrong answer can be traced to the step that caused it.
- AI agent with an MCP server project structureFor developers who want to give AI assistants safe access to their own data or API. A TypeScript MCP server built on the official SDK, organised by feature (tasks, projects) with each feature owning its tools, resources and prompts, served over stdio for local hosts and Streamable HTTP with OAuth for remote ones, plus a small agent and the evals that prove a model can use it.
- Machine learning project project structureFor students and analysts whose model works in a notebook and now needs to be reproducible, reviewable, served and watched. It starts from the Cookiecutter Data Science v2 layout (immutable raw data, numbered notebooks, a real Python package) and grows into versioned data with DVC, typed parameters, data validation with pandera, experiment tracking and a model registry with MLflow, a FastAPI prediction service, drift monitoring and, for a team, scheduled retraining, model cards, fairness checks and shadow deployment.
Career questions
See all- Can I use AI coding tools at my internship, and what should I never paste into them?Usually yes, but only the tools your company has approved, on the code and data they allow, and in the way they allow. Ask in your first week. Never paste secrets, customer data or code you are not permitted to share, and review everything the tool writes as if your name is on it, because it is.
- I am good with computers but not good at math. Can I still have a successful career in software engineering or AI?Yes for most of software engineering, which needs logical thinking far more than advanced math. For AI it depends on the role: building products on top of models needs little math, while research and model training need a lot. Most people who say they are bad at math were taught badly, and the math you need can be learned.
- How do I get into AI security as a student or junior engineer?Build a normal security or software foundation first, then learn how LLM apps fail using the OWASP Top 10 for LLM Applications and MITRE ATLAS, and prove it by building, testing and hardening a small LLM app of your own. Most people reach AI security through AppSec, security engineering or ML engineering, not straight from university.
Cheat sheets
See allWork with me
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com