AI & Advanced
The frontier: LLM-assisted policy work, agentic evidence gathering, AI risk governance under NIST AI RMF and the EU AI Act, and the org design behind a real GRC engineering team.
9
rooms
2285
total XP
9h
est. time
What you'll be able to do
- ›Use LLMs safely for policy drafting and gap analysis
- ›Design agentic evidence-gathering workflows with human review gates
- ›Govern AI systems against NIST AI RMF and the EU AI Act
- ›Capstone: automate an entire SOC 2 control family end to end
Rooms
LLMs for Policy & Gap Analysis
Where LLMs genuinely help in GRC, where they hallucinate, and how to keep a human in the loop.
Governing AI Systems
NIST AI RMF and EU AI Act obligations translated into controls you can actually operate.
Agentic Evidence Workflows
Let an agent plan and collect, but never let it decide. Tool scoping, human gates, and provenance for machine-gathered evidence.
AI Risk Management with NIST AI RMF
Govern, Map, Measure, Manage turned into an operable control set with owners, evidence and metrics rather than a maturity poster.
EU AI Act Obligations as Controls
Classify a system, find the obligations that attach to that class, and turn each one into a control with an owner and an artefact.
Scaling a GRC Engineering Function
Team shape, intake, platform versus project work, and the metrics that tell you whether the function is compounding or just busy.
Incident Response as Code
Runbooks in version control, severity matrices that decide who gets paged, and postmortems that commit their own follow-ups.
Tabletop to Pipeline
An exercise finding without an owner never ships. Turn tabletop outcomes into tracked work that lands as controls, alerts and runbook edits.
Capstone: Automate a SOC 2 Control Family
End to end: control definitions, policy code, evidence pipeline, monitoring and auditor-ready reporting.