This course walks MSPs through building a real, working AI risk management program —
from recognizing where AI already operates inside day-to-day operations, through governance,
acceptable use, risk mapping and classification, measuring and testing controls, managing AI
across its full lifecycle, incident response, vendor and third-party risk, staff and end-user
training, and finally audit readiness and program maturity. Each module builds on the last,
moving from "why this matters" to a program a client or auditor can actually see evidence of.
Written and taught by Tim Golden — 30 years building software, founder-level experience in MSP compliance and risk. See his awards & accolades or the full link tree.
Module 1 · AI Risk Reality for MSPs
1.1
Where AI Already Exists in MSP Environments
Watch ►
AI is already running inside most MSP environments — embedded, indirect, and often invisible until someone looks.
1.2
Why AI Risk Is Operational, Not Theoretical
Watch ►
AI risk shows up in day-to-day operations long before it shows up in a policy document.
1.3
Why AI Governance Is Accelerating
Watch ►
Why the pressure to govern AI is building faster than most MSPs expect, and what's driving it.
Module 2 · Understanding NIST AI RMF
2.1
NIST AI RMF Explained in Plain Language
Watch ►
What the NIST AI Risk Management Framework actually is — voluntary, risk-based, and not the compliance mandate people assume.
2.2
The Four Functions of NIST AI RMF
Watch ►
Govern, Map, Measure, Manage — the four functions that run continuously, not in sequence.
2.3
How NIST AI RMF Aligns with Global Standards
Watch ►
One framework as a translation layer across ISO, EU, and UK approaches to AI risk.
Module 3 · AI Governance and Accountability
3.1
Establishing AI Governance Structures
Watch ►
Clear ownership of AI risk decisions — who decides, who approves, who's accountable.
3.2
Executive Accountability and Decision Authority
Watch ►
Why AI risk is a business risk that has to sit at the executive level, not just the technical team.
3.3
Governing AI Policies as a Living Program
Watch ►
AI usage moves faster than a static policy document — governance has to evolve with it.
Module 4 · Acceptable, Ethical, and Responsible AI Use
4.1
Defining Acceptable AI Use
Watch ►
Guardrails that guide AI use instead of blocking it — and cut down on shadow AI.
4.2
Ethical Use and Societal Impact
Watch ►
Ethics as an operational concern — how AI misuse erodes trust faster than a technical failure.
4.3
Bias, Fairness, and Human Oversight
Watch ►
Where bias actually enters an AI system, and why keeping a human in the loop is the strongest control you have.
Module 5 · Mapping AI Systems, Data, and Risk
5.1
Identifying AI Systems and Use Cases
Watch ►
You can't govern what you can't see — building a real inventory of where AI is actually running.
5.2
Data Flows, Sensitivity, and Provenance
Watch ►
AI risk tracks data sensitivity — understanding what goes in, what comes out, and where it came from.
5.3
Classifying AI Risk
Watch ►
Not every AI use case carries the same risk — a practical tier model for what deserves attention first.
Module 6 · Measuring AI Risk Controls
6.1
What AI Risk Can Be Measured
Watch ►
AI risk can't be eliminated, but it can be evaluated — a structured, repeatable way to do it.
6.2
Risk Scoring and Control Assessment
Watch ►
A simple scoring model that two people can apply and land in the same place.
6.3
Testing, Evaluation, and Validation
Watch ►
Testing that validates what you assumed an AI system would do, before it becomes an incident.
Module 7 · Managing AI Across Its Lifecycle
7.1
AI Lifecycle Management
Watch ►
AI risk isn't static — why governance has to follow a system past deployment, all the way to retirement.
7.2
Monitoring, Drift, and Performance
Watch ►
AI performance drifts quietly over time — the simple signals that catch it before it becomes a loss.
7.3
Logging, Audit Trails, and Continuous Improvement
Watch ►
When something goes wrong, records matter more than intentions — building a trail someone can actually follow.
Module 8 · AI Incidents and Failure Response
8.1
Common AI Failure Scenarios
Watch ►
The failure patterns that show up most — confident wrong answers, data exposure, automation errors.
8.2
Incident Response and Escalation
Watch ►
AI incidents plug into the response plan you already have — speed, clarity, and clear authority to act.
8.3
Post-Incident Review and Lessons Learned
Watch ►
Incidents aren't just problems — they're signals, if the review stays focused on process, not blame.
Module 9 · Vendor and Third-Party AI Risk
9.1
Understanding Vendor AI Risk
Watch ►
Most AI risk is inherited from a vendor's tools — and responsibility doesn't transfer with the tooling.
9.2
AI Procurement and Due Diligence
Watch ►
The plain questions to ask before an AI feature gets bolted onto a tool you're about to buy.
9.3
Ongoing Vendor AI Oversight
Watch ►
Vendor risk doesn't stay still after onboarding — why oversight has to be continuous, not one-time.
Module 10 · Training, Awareness, and Adoption
10.1
Training MSP Staff on AI Risk
Watch ►
Policy alone doesn't change behavior — role-based training that actually reflects how people work.
10.2
End-User Awareness and Signoff
Watch ►
Clear expectations and a real signoff — protection, not punishment.
10.3
Making AI Governance Sustainable
Watch ►
The governance program people actually follow is the one that fits how they already work.
Module 11 · Audit Readiness and Program Maturity
11.1
What Auditors and Clients Will Expect
Watch ►
Audits focus on evidence, not intent — what reviewers actually ask, and what they expect to see.
11.2
Governance Reporting and Metrics
Watch ►
A good report answers a leader's question in seconds — not forty slides that never quite do.
11.3
Scaling AI Governance Without Slowing Delivery
Watch ►
Governance that scales with the business instead of becoming friction everyone routes around.