AI Governance and Responsible AI for Organizations is a course in governing AI use with reference to the NIST AI RMF, ISO/IEC 42001 and the EU AI Act, linked to Thai PDPA, covering risk assessment, bias, transparency and audit readiness. It suits executives, governance, risk and internal audit teams and DPOs, and you leave with a draft AI use policy for your organisation.
In most organizations staff are already using AI, but there is no policy saying how far they may go, what data must never be entered, who is accountable when the output is wrong, or how the company would show an auditor that controls actually exist. That gap becomes a data leakage risk, a legal risk and a reputational risk, particularly now that international rules are taking effect and business partners are beginning to ask for governance documentation. This course is built for executives, governance teams and anyone who has to set AI policy. It
connects the frameworks you can genuinely cite, NIST AI Risk Management Framework, ISO/IEC 42001 and the EU AI Act, to Thai legal context and the Personal Data Protection Act. It covers identifying and assessing the risk of each AI use case, grading risk and choosing proportionate controls, writing an AI usage policy staff will actually follow, governing the data fed to models, handling bias, transparency and explainability, and finally establishing ongoing oversight and audit-ready documentation. Learners draft their own organizational policy in the workshop. (1 day, 6 hours, no technical background required.)
Course Details
A 1-day course, 6 hours (09:00-16:00), delivered as lectures with group workshops. No technical background required. The content follows the latest international frameworks adapted to Thai organizational context. Learners take home a ready-to-use template set covering AI usage policy, risk assessment forms and an AI system register, plus the draft policy they wrote in class, ready to put in front of management. The material is management guidance, not case-specific legal advice.
Morning: Risk and International Governance Frameworks
The risks that actually occur: data leakage, wrong output, bias and copyright exposure
The risk of staff adopting AI tools on their own without the organization knowing
Case studies from real incidents and the lessons worth adopting
Why an outright ban fails and why a safe-use framework works better
The framework structure: govern, map, measure and manage
The characteristics of trustworthy AI and what they mean in practice
Applying the framework in a mid-sized organization with no dedicated governance team
Connecting it to the risk management system the organization already runs
What an AI management system is and how it differs from a security standard
The core requirements and the documentation certification would demand
Running it alongside existing standards without duplicating work
Deciding whether to pursue certification or use it as internal guidance
EU AI Act risk tiers with examples of each
Obligations on providers and deployers, and the impact on Thai firms trading with Europe
Transparency requirements and telling users they are interacting with AI
The direction of AI law and practice in Thailand and what to watch
Afternoon: From Risk Assessment to Workable Policy
Building a register of the AI systems in use and grouping them by impact
Risk criteria: impact on individuals, on the business and on legal compliance
Choosing controls proportionate to the risk without blocking the work
Workshop: assess the risk of a real AI use case from your own organization
What a complete policy contains: scope, roles, prohibitions and approval steps
Defining which data categories must never be entered into external AI tools
Defining the review step before output is used and who is accountable at each stage
Workshop: draft your own organizational AI policy from the provided template
The lawful basis for processing personal data through AI systems
Purpose notification and consent when data is used with AI
Data subject rights and responding to requests involving automated decisions
Managing external AI vendors and the contract terms you should have
Where bias comes from and its impact on decisions affecting individuals
Testing outputs for fairness before the system goes live
Explaining to affected people what the system based its decision on
Defining where a human must always remain in the decision loop
The oversight structure: working group, roles and review cycle
Monitoring AI systems after go-live and handling incidents
The documentation and evidence to retain for internal and partner audits
Workshop: plan the first 90 days of policy rollout and present it
No public rounds are open right now. Join the waiting list and we will contact you first when the next round opens, or ask us on LINE. Or call 02-570-8449 or 088-807-9770
The NIST AI Risk Management Framework is a voluntary framework for managing AI risk, published by the US National Institute of Standards and Technology. It has four functions: Govern, which sets up oversight structures and culture; Map, which identifies the context and risks of each system; Measure, which assesses those risks; and Manage, which prioritises and treats them. It can be scaled to any organisation and linked to existing risk management.
The EU AI Act sets four levels. Unacceptable-risk uses, such as social scoring, are banned. High-risk systems, such as recruitment screening or credit assessment, must meet strict requirements. Limited-risk systems carry transparency duties, such as telling users they are talking to a chatbot, and minimal-risk systems face almost no extra rules. Thai organisations offering AI services or AI outputs in the European market may also fall within its scope.
Start with a register of the AI tools the organisation uses and a case-by-case risk assessment. Then define the policy's scope, the roles responsible, approved tools and prohibitions, especially which types of data must never be entered into external AI tools. Add an approval process, a review step for outputs before use and a schedule for revisiting the policy. This course has you draft your own organisation's policy from a prepared template.
It suits executives and department heads deciding how to adopt AI, governance, risk and internal audit teams, data protection officers and legal teams, and IT or HR leaders who must issue AI usage policies. No technical or programming knowledge is needed, though experience of AI tools at work and an understanding of how data flows in your organisation will let you go further in the workshops.
You will be able to identify and assess AI risks case by case, apply the NIST AI RMF, ISO/IEC 42001 and the EU AI Act, link them to Thai PDPA, set checkpoints for bias, transparency and human oversight, draft an AI use policy for your organisation, and prepare a 90-day plan for rolling it out with audit-ready evidence. Participants who complete the training receive a Certificate of Completion with its own number, which can be verified online.
Yes. It can be run in-house for your team, with examples adapted to your own work, such as assessing the AI use cases your organisation already has and drafting the policy together as a team. You can request a quotation from this page, or contact us on LINE @itgenius or by phone on 02-570-8449.
Thailand's Personal Data Protection Act B.E. 2562 (PDPA) is now fully in force, and most of the day-to-day workload falls on IT teams and data custodians: knowing what personal data the organization holds and where, maintaining records of processing…
AI has become a basic workplace tool, yet many employees still do not know how to start, what work it fits, or what to watch out for. This one-day (6-hour) course is designed for people in every function who have no IT background: understand how AI works…
