Chapter 4 of 4 · CompTIA SecAI+ CY0-001
AI Governance, Risk, and Compliance
AI roles, responsible AI, shadow AI, EU AI Act, ISO, NIST AI RMF and AI policy.
- 3topics
- 18 minfast track
- 19%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1AI Governance Structures and RolesLearn AI governance structures: AI Center of Excellence, AI policies and procedures, and roles from data scientist and MLOps…5 min
- 2Responsible AI and AI RisksResponsible AI principles, differential privacy and awareness training, plus AI risks: bias, data leakage, IP, autonomous…6 min
- 3AI Compliance Frameworks and Corporate AI PolicyCompare the EU AI Act, OECD principles, ISO/IEC 42001 and the NIST AI RMF, and set corporate AI policy on models, sensitive data…7 min
About this chapter
What this chapter covers
AI Governance, Risk, and Compliance is 19% of the CompTIA SecAI+ CY0-001 exam. It covers who is responsible for artificial intelligence (AI) in an organisation, what can go wrong, and which laws, standards and internal policies shape how AI is used and built.
It covers governance structures (an AI Center of Excellence, AI policies and procedures, and roles from data scientist and machine learning engineer to AI security architect, AI risk analyst and AI auditor), AI risks (responsible AI principles such as fairness, transparency, explainability and differential privacy, and risks such as bias, data leakage, intellectual property, autonomous systems, shadow information technology (IT) and shadow AI) and compliance (the European Union (EU) AI Act, Organisation for Economic Co-operation and Development (OECD) standards, International Organization for Standardization (ISO) AI standards, the National Institute of Standards and Technology (NIST) AI Risk Management Framework (AI RMF), and corporate policies on sanctioned tools, public and private models, sensitive data, third-party evaluations and data sovereignty).
The exam has a maximum of 60 multiple-choice and performance-based questions in 60 minutes. Questions are vendor-neutral and usually close with "Which of the following ...?". Here they often describe a situation and ask which role is responsible, which principle is at stake or which framework applies.
How the topics fit together
Governance sets up the people and processes, risk work tells them what to watch, and compliance turns outside rules into internal policy. Findings from audits and incidents flow back into governance as updated policies.
Learn each framework by its job. The EU AI Act is law with risk tiers, ISO/IEC 42001, published by ISO with the International Electrotechnical Commission (IEC), is a certifiable management system, the NIST AI RMF is voluntary guidance with four functions, and the OECD principles are high-level values.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and code examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full CompTIA SecAI+ CY0-001 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.