Generate custom courses on any topic — with hands-on practice, AI guidance, and visuals built in.
Already have an account?
You are going to stand up a minimal, auditable AI governance and risk program that can scale across your organization in 2026.
We will use one operating model and one example organization, NorthBridge Credit Union, so every later lesson builds on the same structure instead of restarting from scratch.
By the end of this course, you should be able to point to a small set of living artifacts and say who owns each one, where the evidence lives, and how often it gets reviewed.
A risk manager at NorthBridge Credit Union asks a support team how they are handling ticket backlogs.
An agent replies that they paste customer chats into a free web based chatbot to draft responses, and HR has been using another tool to screen resumes faster.
Nobody can name who approved these tools, what data was shared, whether outputs are used for decisions, or whether any logs exist to show what happened.
Start with evidence
Before policies and frameworks, capture what is happening, where, and with what data.
Unapproved AI use is any use of an AI system for business work that has no recorded owner, no documented purpose, and no agreed controls.
It becomes risk because it creates exposure you cannot see or prove you managed.
At NorthBridge, the common paths are data leaving approved systems, unofficial connections that pull or push data, and staff using AI outputs as if they were verified decisions.
Let’s visualize where those exposure points usually sit in day to day workflows.
Auditable governance means you can trace from a requirement or policy, to a repeatable process, to records showing the process ran, and to an accountable owner who reviews it over time.
For NorthBridge, the defensible outputs look like a tight loop rather than a big document dump.
Next, we will look at what these artifacts feel like in practice for NorthBridge.