AI Governance for Companies (AI Act)
AI literacy prepares people; governance prepares the organisation. This programme is the management and control layer: it defines how your company decides on, oversees and documents its use of artificial intelligence, in line with the AI Act (Regulation (EU) 2024/1689).
Who is it for
Leadership and control functions in companies and the public sector that already use or will deploy AI: management and the executive committee, legal/compliance, the data protection officer (DPO), IT and security, HR, procurement and AI system owners. This is the management layer: it complements AI Literacy, which trains the whole workforce.
Learning objectives
Design the AI governance operating model: committee, roles, responsibilities and review cadence
Build an inventory of the organisation's AI systems (in-house and third-party, incl. ChatGPT/Claude/Copilot)
Classify each use case by the AI Act's risk tiers (prohibited, high-risk, limited, minimal)
Draft an acceptable-use policy for AI and define effective human-oversight mechanisms
Establish vendor due diligence and an incident and escalation process
Build the documentation/evidence roadmap and a 90-day implementation plan
Course programme
Module 1: Governance and regulatory framework (4h)
- Why govern AI: operational, reputational and regulatory risks for an SME
- The AI Act (Regulation (EU) 2024/1689) for leadership: the risk-based approach and application timeline
- The difference between AI literacy (workforce) and AI governance (leadership and control): complementary layers
- Fitting it with what you already have: GDPR, information security and internal policies
Module 2: Inventory and risk classification (4h)
- How to build the AI system inventory: who uses them, for what and with which data
- Classification by the AI Act's risk tiers with examples from your sector
- Identifying prohibited and high-risk uses within the organisation
- Guided exercise: classifying 5-8 real use cases from your company
Module 3: Operating model, policies and human oversight (4h)
- AI governance committee: composition, roles (RACI) and meeting cadence
- Acceptable-use policy for AI: an adaptable template and approval criteria for new uses
- Effective human oversight: when and how a person reviews and can override AI
- Personal data, intellectual property, confidentiality and transparency towards clients
Module 4: Vendors, incidents, evidence and the 90-day plan (4h)
- AI vendor due diligence: what to ask and what to require by contract
- Incident and escalation process: detection, logging, response and communication
- Documentation/evidence roadmap to demonstrate compliance
- 90-day implementation plan with owners, milestones and tracking indicators
Methodology
A hands-on 16-hour workshop (usually 2 days) aimed at producing deliverables, not just explaining theory. We work on your organisation's reality: by the end you leave with an inventory started, a risk matrix, a draft use policy, a committee structure and a 90-day implementation plan. It includes reusable templates (policy, inventory, vendor due diligence, incident log) and a follow-up mentoring session to support the first steps of the rollout. Delivered by people experienced in AI adoption and compliance, adapting each exercise to your sector and maturity. Note: this training is informational and practical; it does not constitute legal advice. For specific legal decisions, consult your adviser. Delivered on-site in Catalonia (Banyeres del Penedès or your office) with follow-up mentoring.
Over 16 hours, the leadership team and key functions (legal/compliance, DPO, IT/security, HR, procurement and AI system owners) build a real operating model: an AI system inventory, risk classification, an acceptable-use policy, human-oversight mechanisms, vendor due diligence, an incident and escalation process, and a documentation/evidence roadmap. You leave with a 90-day implementation plan ready to execute.
This is not a theory course nor a legal advisory service: it is a hands-on, guided workshop that leaves a way of working installed. Delivered on-site in Catalonia (Banyeres del Penedès or the client's office) with follow-up mentoring. Request a quote: 100% FUNDAE-fundable for companies with code Nº 9900033425.
Frequently asked questions
They are complementary, not substitutes. AI Literacy (AI Act Article 4) is the workforce layer: it trains all staff in the safe, responsible use of AI. AI Governance is the leadership and control layer: it defines how the organisation decides on, oversees and documents that use (inventory, risk, policies, human oversight, vendors, incidents). The usual path is to train the workforce first with Literacy and, in parallel or afterwards, roll out Governance with leadership and control functions.
No. It is practical training that helps you build your own governance model and prepare compliance documentation, but it does not constitute legal advice and does not replace review by a specialised lawyer or consultant. We work with the current framework and point you to the official European Commission page on the AI Act (https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai). Note that the timeline and obligations may evolve: the Regulation entered into force on 1 August 2024, prohibited practices and AI literacy have applied since 2 February 2025, governance rules and general-purpose AI models since 2 August 2025, and most remaining obligations from 2 August 2026, with exceptions and transition periods.
Request a quote based on team size and scope. The training is 100% fundable for companies via FUNDAE with our code Nº 9900033425: the company recovers the cost through its Social Security contributions. Request a quote via the contact form and we prepare the proposal with all the FUNDAE paperwork included.
It is designed for SMEs and public-sector organisations that want a governance model proportionate to their size, without unnecessary bureaucracy. The people who decide and control should attend: management, legal or compliance, the DPO, the IT/security lead, HR, procurement and the owners of the AI systems already in use. A small, cross-functional group works best.
Complementary training
These courses work together: each covers a different layer of AI adoption in your organisation.