CBA Certified AI Governance Professional

Foundations of AI Governance15%

• Distinguish AI governance from adjacent disciplines such as data protection, information security and model development quality assurance
• Identify the characteristics of AI systems that create distinct governance needs, including opacity, drift, scale of automated decisions and probabilistic outputs
• Classify organisational AI activity into common categories such as procured AI features, in-house models, general-purpose model use and shadow AI
• Select appropriate first steps for establishing governance in an organisation with no existing AI oversight, such as inventory building and use-case intake
• Interpret the roles of provider, deployer, and affected person as they recur across regulatory and framework language

Risk Classification and the Regulatory Landscape25%

• Classify described AI use cases into the EU AI Act's tiers of prohibited practice, high risk, transparency risk and minimal risk
• Distinguish the obligations that fall on providers from those that fall on deployers of high-risk AI systems
• Interpret the treatment of general-purpose AI models, including when additional obligations attach to models presenting systemic risk
• Evaluate the extraterritorial reach of AI regulation and its practical effect on organisations in the Middle East, Asia and other regions outside the EU
• Select the correct regulatory response to borderline cases, such as emotion recognition at work, biometric identification and credit scoring
• Identify the broad direction of AI rules in other jurisdictions, including sectoral approaches, national strategies and voluntary codes

Governance Frameworks and Management Systems20%

• Interpret the purpose and structure of the NIST AI Risk Management Framework, including its four functions and its trustworthiness characteristics
• Distinguish a certifiable management system standard such as ISO/IEC 42001 from a voluntary risk framework such as the NIST AI RMF
• Select framework elements appropriate to a given organisational need, such as risk identification, policy setting or supplier assurance
• Evaluate an organisation's AI policy against the elements a recognised framework would expect it to contain
• Interpret how the plan-do-check-act cycle applies to an AI management system, including internal audit and management review

Documentation, Transparency and Accountability15%

• Select the appropriate documentation artefact for a given purpose, such as a model card, data sheet, AI inventory entry or impact assessment
• Evaluate the completeness of a model card or system documentation against the questions a deployer or regulator would ask
• Interpret transparency obligations owed to end users and affected persons, including disclosure of AI interaction and synthetic content labelling
• Distinguish explainability of individual decisions from transparency about a system's existence, purpose and limits
• Calculate simple documentation coverage measures from an AI inventory, such as the proportion of high-risk systems with a completed impact assessment

Bias, Robustness and Testing Concepts15%

• Distinguish sources of bias across the lifecycle, including historical data bias, sampling bias, label bias and deployment drift
• Interpret basic fairness measures conceptually, such as comparing selection or error rates across groups, and recognise that fairness definitions can conflict
• Calculate simple disparity measures from a small results table, such as a selection-rate ratio between two groups
• Evaluate the design of a testing plan for an AI system, including test data independence, edge cases and human review checkpoints
• Select appropriate ongoing monitoring practices for a deployed system, including drift indicators, performance thresholds and re-validation triggers

Incident Handling and Organisational Structures10%

• Classify AI-related events by severity and type, distinguishing incidents, near misses and complaints
• Select the correct sequence of actions when a serious AI incident occurs, including containment, escalation, communication and regulator notification concepts
• Evaluate the design of an AI governance operating model, including board oversight, an AI governance committee and operational ownership
• Distinguish the responsibilities of first-line operators, second-line risk and compliance functions and third-line internal audit for AI systems
• Interpret post-incident review findings and select corrective actions that address root causes rather than symptoms