THE INTELLIGENT AI GOVERNANCE LEADERSHIP PROGRAMME
Separate the claim from the permission.
20-Session Programme · 25 Minutes Per Day · Free · For leaders in Nigeria’s oil and gas sector
WEEK 1 OF 4 · THE LEADERSHIP DOCTRINE AND THE LAW · SESSIONS 1–5 · WORK AT YOUR OWN PACE
Orientation · The ThesisSESSION 1
The Decision That Requires Governance
Why This Matters
Most AI proposals reach an executive desk as a capability: the model can read, rank, predict or draft. What the proposal rarely states is the permission being sought, and the permission is the decision you will answer for. Over twenty sessions you will build a signed 90-Day AI Governance Plan for your own company, one section per session, around one real AI system or proposal. Today you choose that system and write down what it is claimed to do, what it would be allowed to do, and what you would do instead. If those cannot be separated cleanly, you have found your first governance finding, and far more cheaply now than after release.
25-Minute Module
0:00 – 5:00
The question this programme asks, and the finish line
- This programme is built on my book The Intelligent AI Governance. Its operating question is whether an organisation can justify the decisions it delegates to AI, observe what happens, and correct the system when the justification no longer holds.
- Week 1: The Leadership Doctrine and the Law. Week 2: Technical Evidence That Survives Challenge. Week 3: Generative Systems, Security and Operations. Week 4: Release Decisions, the Board and the Ninety Days.
- The finish line is a signed 90-Day AI Governance Plan for your own company, whether an operator, refiner, gas business, service company or regulator-facing function: nineteen sections written one per session, assembled and signed in Session 20.
- House rules: write about your own company; bring a real system or proposal; no claim without evidence; no permission without a named owner; report a blocker the same day. The pass mark is 70.
- Said once, plainly: this is leadership training, not legal, technical-assurance or investment advice. Obtain qualified legal advice for decisions that create legal obligations.
Read every number in this programme as a calculation to inspect, not a benchmark to copy.
5:00 – 10:00
One successful project, four failures
- The book's maintenance model looks impressive on retrospective accuracy. Underneath, four failures coexist:
What the book describes What fails Training records include a work-order field completed after the fault was discovered The data Alerts concern equipment already scheduled for repair The decision Economics count all avoided downtime, though another programme already reduced the same losses The value The model may defer inspections outside the engineering procedure The authority - THE DOCTRINE
Consequential authority must be matched by evidence, enforceable boundaries and an accountable owner. An organisation that cannot satisfy those conditions should narrow the use, gather more evidence or decline the delegation.
- This is not the same review for every tool. A drafting assistant handling public information differs from an agent that can approve payments. The interface can look identical while the authority behind it differs materially.
- The book puts our own setting this way: Nigeria's energy industry makes these distinctions concrete. Asset records may cross a licensee, service provider and joint venture. Documents may exist in successive controlled revisions. Sensors may have different calibration histories. Offshore communications may fail. An executive may face urgent commercial pressure while a technical authority is waiting for evidence. These are conditions to investigate in a specific deployment, not assumptions about every Nigerian company.
When a project looks successful, ask which of the four failures you have actually ruled out.
10:00 – 16:00
Govern the decision, and separate the claim from the permission
- The unit of governance is a system used to support or perform a decision in a defined setting. A model is a component; the deployment adds inputs, retrieval, prompts, interfaces, tools and people.
- Begin with a decision sentence. The book's example: the system ranks maintenance work orders for the next weekly planning meeting, using information available at the planning cutoff, and the maintenance superintendent approves the schedule. Object, time, information boundary, responsible person.
- THE DOCTRINE
A capability claim describes what a system can do under observed conditions. Permission specifies what an organisation allows it to do.
- OPERATIONS · THE WORKED CASE
- Operations. Change the sentence to: the system automatically closes work orders judged unnecessary. The model may be unchanged, but an incorrect closure may remove a task from the operating backlog and its audit trail.
ENTERPRISE · THE PARALLEL- Enterprise. Evidence that a model can identify relevant clauses does not authorise it to amend a contract. Evidence that an agent can assemble a payment pack does not authorise it to change a beneficiary account.
- The approval should state the permitted use, excluded use, user population, data scope and permitted actions. A vague approval for an enterprise AI platform creates a permission gap. The boundary also includes observed work practice: a read-only assistant whose rank managers routinely accept is influencing the decision.
If the approval paper names a platform and not a decision, send it back.
16:00 – 21:00
State the counterfactual, then build the record
- Compare the deployment with at least one plausible alternative: a rules engine, a process repair, a better report, a staffing change or the present method. Comparing AI with doing nothing can exaggerate value.
- The book's example: an assistant reduces time spent locating current policies, but a document-control repair might produce much of the same gain. Identify the contribution of the AI layer after the repair.
- The counterfactual also defines baseline risk. The existing process is not safe merely because it predates AI.
- The decision record: decision requested, alternatives considered, evidence supplied, uncertainty remaining, permitted authority, accountable owner and next review trigger. A reviewer should see which finding would have changed the decision.
- Record dissent. A technical reviewer may accept the ranking performance but reject the evidence for automated action. An advisory approval must not later be presented as approval of automation.
- THE DOCTRINE
When the system changes, ask whether the original decision sentence still describes it. If the answer is no, the approval has become an historical record rather than an active justification.
A decision record that cannot show the dissent was never really a record of a decision.
21:00 – 25:00
Write it down, and Section 1
- Before you close the laptop, write one decision sentence for the AI system you will carry through this programme. No AI system yet? Use a proposal under consideration or a tool staff already use informally.
- Section 1 of your plan is The AI decision our company faces, the claim, the permission sought and the counterfactual.
- Carry four questions from today: what the system knows, what the evidence supports, where it can fail and who will act when it does.
If you cannot name who would act when it fails, write that down. It is your first finding.
Key Terms
Decision sentence
What the system supports or performs, for whom, at what time, using what information, with what authority. It shows what the system may not decide.
Permission
What the organisation allows a system to do: permitted use, excluded use, user population, data scope and permitted actions. Evidence of capability never grants it.
Counterfactual
At least one plausible alternative to the deployment, used to measure value and baseline risk honestly.
Decision record
Decision requested, alternatives, evidence, remaining uncertainty, permitted authority, accountable owner and next review trigger, with any dissent.
Self-Check — Before You Submit
1. A vendor shows that its assistant can identify relevant clauses in a fictional gas business's supply contracts. The sponsor asks you to approve the enterprise AI platform. What do you do?
- A. Approve the platform, since the capability is proven
- B. Approve a stated use with permitted and excluded use, users, data scope and actions
- C. Decline until the vendor shows a higher benchmark
- D. Approve the platform and let each team decide its use
B. Approve a stated use with permitted and excluded use, users, data scope and actions — A vague platform approval creates a permission gap. Approving because the capability was shown is tempting, but evidence that a model can identify clauses does not authorise it to amend a contract.
2. The model is unchanged, but the team now wants it to close work orders judged unnecessary rather than rank them. What follows?
- A. Nothing, because the model file is the same
- B. Only the user guidance needs updating
- C. The approval stands if accuracy is unchanged
- D. Authority and potential harm have increased, so the use must be reassessed
D. Authority and potential harm have increased, so the use must be reassessed — Classification must follow the changed consequence. Unchanged accuracy is the trap: the original decision sentence no longer describes the system, so the approval is now only an historical record.
3. Why compare a policy-finding assistant with a document-control repair?
- A. Comparing AI with doing nothing can exaggerate value
- B. Document control is always cheaper than AI
- C. Assistants cannot be trusted with policies
- D. A regulator requires the repair first
A. Comparing AI with doing nothing can exaggerate value — The counterfactual shows what the AI layer adds after the simpler repair. Saying document control is always cheaper sounds prudent, but the book makes no such claim; it asks for the comparison.
Today’s Assignment
Name the one AI system or proposal in your company that you will carry through this programme, separate its claim from its permission, state the counterfactual and draft its decision record.
- The system. A real AI system, a proposal, or a tool staff use informally. Describe your company in a sentence; it need not be named.
- The decision sentence, then the capability claim, then the permission sought: permitted use, excluded use, users, data scope and actions.
- The counterfactual. At least one plausible alternative and the baseline risk of the present method.
- The draft decision record. All seven fields; write not known rather than invent.
- The honest part. What your company currently gets wrong in approving AI. Four hundred to nine hundred words.
YOUR 90-DAY PLAN
Section 1 — The AI decision our company faces, the claim, the permission sought and the counterfactual.
How this is marked — the rubric
| States a decision sentence with object, time, information boundary and a responsible person named by role | 25 |
| Separates the capability claim from a permission naming use, exclusions, users, data scope and actions | 25 |
| Names at least one plausible alternative and the baseline risk of the present method | 20 |
| Drafts all seven decision-record fields, with unknowns marked rather than invented | 15 |
| The honest paragraph names a current failing in the student's own company, not the industry | 15 |
| Total · pass mark 70 | 100 |
Submitting session 1
Write your answer in Word or Google Docs. The first line must read
Write your answer in Word or Google Docs. The first line must read
Session: 1, or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter, saved to your progress page. Do not submit until you have passed the self-check above.Capabilities Covered
Decision-first governanceClaim versus permissionCounterfactual reasoningDecision records with dissentPlan authorship
Leadership · Chapter 2SESSION 2
Accountability and Executive Authority
Why This Matters
A steering committee can review evidence and still be unable to tell you who, by name, can reverse the decision tomorrow morning. That gap matters to you personally, because when an AI-supported decision goes wrong in your company, the question will not be which committee met. It will be who owned the outcome, who accepted the risk, on what authority, and who could have stopped it. Today you separate five approvals that are routinely collapsed into one signature, you learn to write a risk acceptance that means something, and you name the person who holds the right to stop your system. Some of the answers will be uncomfortable. Write them anyway.
25-Minute Module
0:00 – 5:00
A named person who can reverse the decision
- THE DOCTRINE
Accountability becomes useful when a named person can make or reverse a decision. Committee membership alone does not identify who owns an operating outcome.
- Governance should allocate responsibility for the business result, the technical service and the independent challenge separately. The book assigns the roles this way:
Role What it holds Business owner Defines the purpose and accepts authorised residual risk Technical owner Maintains the implemented system and its records Domain authority Determines whether the use fits professional or engineering requirements Risk and legal specialists Challenge the assessment within their competence Independent assurance Examines whether the controls operate as represented - Notice that none of these is a committee. A committee can host the conversation; it cannot hold the outcome.
Ask your next steering committee who, by name, can reverse its last decision.
5:00 – 11:00
Five approvals that must remain distinct
- Keep five approvals distinguishable: purpose approval; permission to use data; technical readiness; authority to affect the business process; and acceptance of residual risk.
- One signatory may hold several roles in a small organisation, but the evidence for each decision should remain explicit.
- The record should name the source of delegated authority rather than infer it from seniority.
- OPERATIONS · THE WORKED CASE
- Operations. A fictional illustration: a project sponsor in a gas processing company funds an AI tool for maintenance planning. The book is clear that a sponsor's funding authority does not necessarily include authority to change an engineering limit. That sits with the domain authority.
ENTERPRISE · THE PARALLEL- Enterprise. The book's own example: a chief information officer's approval of a platform does not necessarily establish that a recruitment decision is appropriate. Nor does funding authority necessarily include authority to accept privacy risk.
- For high-consequence uses, independence matters. A reviewer who must meet the same launch target as the project team may be capable yet conflicted. Where you cannot fund a separate team, use documented external review or a cross-functional reviewer with a different reporting line.
Seniority is not a source of authority. A delegation is.
11:00 – 17:00
Make risk acceptance specific
- Residual risk means the risk remaining after the stated controls operate. It should not mean whatever the team has not measured.
- Distinguish uncertainty about the risk from an assessed residual risk. An unknown subgroup error rate is an evidence gap. It cannot be converted into low risk by giving it a low score.
- An acceptance statement should identify the exposure, rationale, limitations, duration and review triggers.
- The book's example: management authorises an advisory-only deployment for a bounded equipment family while engineers follow the existing inspection procedure. The remaining concern may be wasted review time or an incorrect advisory ranking. That acceptance does not authorise cancellation of a statutory or safety-related task.
- THE DOCTRINE
Make expiry meaningful. Without a service rule that enforces expiry, the date becomes decorative. An expired high-consequence system should enter the predetermined restricted mode while the evidence is reviewed.
If an acceptance has no expiry that a system enforces, it is a wish with a signature.
17:00 – 21:00
The board's questions, and the right to stop
- A board should ask four things: which systems can materially affect people, money, assets or obligations; what evidence supports their use; which controls failed during the period; and which risk decisions require board authority.
- The board also needs to know where management lacks visibility. A count of inventoried systems is incomplete if discovery coverage is unknown. A statement that all deployments are compliant is weak if the denominator excludes embedded vendor AI.
- The book does not assert one universal legal test for every board. Directors' duties depend on governing law and organisational circumstances; it recommends explicit board oversight because the consequences can be material.
- Stopping authority should exist at the operational level. An incident responder should not wait for a quarterly board meeting to revoke a compromised agent credential. Specify the authority for temporary containment and for permanent withdrawal, and record how urgent action is reviewed afterwards.
- THE DOCTRINE
A governance system that only confirms the sponsor's preferred result has no credible challenge function.
Make the consequence of an adverse result part of the launch plan, not a surprise after it.
21:00 – 25:00
Write it down, and Section 2
- Before you close the laptop, write the five approvals for your system and, against each, the person who holds it today. Where the honest answer is nobody, write nobody.
- Name who can stop the system this afternoon, and on what authority.
- Section 2 of your plan is Who owns, approves, accepts risk and can stop the system.
A blank against an approval is not a failure of the exercise. It is the exercise working.
Key Terms
Business owner
The named person who defines the purpose of an AI use and accepts authorised residual risk. Distinct from the technical owner, who maintains the system and its records.
Residual risk
The risk remaining after the stated controls operate. Not whatever the team has not measured; an unmeasured risk is an evidence gap.
Acceptance statement
A specific acceptance of residual risk that identifies the exposure, rationale, limitations, duration and review triggers, with an expiry that a service rule enforces.
Stopping authority
The operational authority to contain an AI use temporarily or withdraw it permanently, specified in advance, with urgent action reviewed afterwards.
Self-Check — Before You Submit
1. Your team cannot measure the error rate for one equipment subgroup, so it gives that subgroup a low risk score to finish the assessment. What is the right response?
- A. Accept the score, because the overall error rate is low
- B. Average the subgroup into the overall rating
- C. Record it as an evidence gap; an unknown subgroup error rate cannot be converted into low risk by a low score
- D. Ask the sponsor to accept the risk informally
C. Record it as an evidence gap; an unknown subgroup error rate cannot be converted into low risk by a low score — Residual risk is what remains after the stated controls operate, not whatever has not been measured. Leaning on the low overall rate is the trap: it hides the gap rather than resolving it, and the acceptance would rest on nothing.
2. A sponsor with funding authority signs the release of an AI tool. Which of the five approvals does that signature necessarily cover?
- A. None necessarily; the record should name the source of delegated authority for each approval
- B. All five, because the sponsor is the most senior signatory
- C. Purpose and technical readiness only
- D. Acceptance of residual risk, because the sponsor pays for the system
A. None necessarily; the record should name the source of delegated authority for each approval — A sponsor's funding authority does not necessarily include authority to accept privacy risk or change an engineering limit. Inferring authority from seniority is the tempting error; the book asks the record to name the delegation.
3. On a Tuesday, an agent's credential is found to be compromised. The board meets next quarter. What should already be in place?
- A. A rule that the board decides all withdrawals
- B. Operational authority for temporary containment, a separate authority for permanent withdrawal, and a review of the urgent action afterwards
- C. An instruction to wait until the vendor confirms the issue
- D. A committee vote before any action
B. Operational authority for temporary containment, a separate authority for permanent withdrawal, and a review of the urgent action afterwards — Stopping authority should exist at the operational level; an incident responder should not wait for a quarterly board meeting to revoke a compromised credential. A committee vote looks orderly, but it leaves the system running while people convene.
Today’s Assignment
Write the accountability map for the AI system or proposal in your company: who owns it, who approves each decision, who accepts residual risk and who can stop it.
- Roles. Name, by role, the business owner, technical owner, domain authority, risk and legal challengers and independent assurance for your system.
- The five approvals. For each, the holder and the source of delegated authority. Where nobody holds it, say so.
- Independence. Say whether the reviewer shares the project's launch target, and what you will do if so.
- A risk acceptance. Draft one acceptance statement with exposure, rationale, limitations, duration and review triggers, and the restricted mode on expiry.
- The right to stop. Who can contain the system temporarily, who can withdraw it, and how urgent action is reviewed.
- The honest part. Where your company currently lets seniority or a committee stand in for accountability. Four hundred to nine hundred words.
YOUR 90-DAY PLAN
Section 2 — Who owns, approves, accepts risk and can stop the system.
How this is marked — the rubric
| Names every role and all five approvals by role, each with its source of delegated authority or an honest gap | 30 |
| Drafts an acceptance statement with exposure, rationale, limitations, duration, review triggers and expiry consequence | 25 |
| Specifies temporary containment and permanent withdrawal authority and the after-action review | 25 |
| The honest paragraph names a specific accountability failing in the student's own company | 20 |
| Total · pass mark 70 | 100 |
Submitting session 2
Write your answer in Word or Google Docs. The first line must read
Write your answer in Word or Google Docs. The first line must read
Session: 2, or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter, saved to your progress page. Do not submit until you have passed the self-check above.Capabilities Covered
Named accountabilityDistinct approvalsSpecific risk acceptanceBoard questions with denominatorsThe right to stop
Leadership · Chapter 3SESSION 3
An Evidence Contract for Every Deployment
Why This Matters
An AI approval can rest on nothing more than a presentation. The slides were persuasive, the demonstration worked, and nobody wrote down what result would have proved the claim wrong. That is how a company ends up defending a decision with evidence it never really had. Today you write an evidence contract for your system: what must be demonstrated before permission is granted, and what must remain true afterwards. It is a management method, not a certification, and it is the single most useful document you can put in front of a sponsor who wants a release date. By the end of this session you will be able to tell, in a meeting, the difference between a report you possess and evidence you have accepted.
25-Minute Module
0:00 – 5:00
Four elements of an evidence contract
- The evidence contract is my proposed agreement between a sponsor, a delivery team and an approving authority. It is a management method, not a recognised certification scheme.
- It has four elements: the claim, the evidence, the decision rule and the validity boundary. The book's example:
Element The book's example Claim A ranking model improves early detection at a manageable review workload Evidence A prospective shadow trial Decision rule A minimum useful-alert precision and a maximum missed-failure rate, with uncertainty reported Validity boundary The equipment and operating modes represented in the trial - Read the last row twice. The approval stops where the trial stopped.
An approval without a validity boundary quietly approves everything the trial never saw.
5:00 – 10:00
Write falsifiable claims
- Improves decisions is too broad. A claim should describe the relevant action and outcome: a maintenance assistant might increase the proportion of actionable warnings delivered before the intervention deadline; a purchasing agent might reduce administrative preparation time while retaining approval and payment controls.
- Write a failure condition alongside each claim.
- THE DOCTRINE
If the trial cannot reveal whether the claim is wrong, it is a demonstration rather than a validation.
- A successful presentation to executives may establish usability, but cannot establish the reliability of rare safety-related recommendations.
- Pre-specify the primary metric, evaluation population, comparison method and relevant uncertainty before the final test. A team that selects whichever subgroup or threshold looks best will report optimistic performance.
Ask the team what result would have made them recommend against release. If there is none, there was no test.
10:00 – 16:00
Fit the evidence to the consequence, and use evidence states
- THE DOCTRINE
Evidence requirements should rise with plausible harm, autonomy, scale and difficulty of detecting error.
- OPERATIONS · THE WORKED CASE
- Operations. A system that acts on equipment needs a broader engineering assessment, including what happens when the model, communication link or sensor fails. Testing and containment solve different problems: where testing cannot resolve a failure mode, reduce the authority instead.
ENTERPRISE · THE PARALLEL- Enterprise. A low-consequence drafting use may be justified by bounded task tests and user review. But a vendor's foundation-model benchmark does not validate your retrieval permissions, production prompts or human workflow.
- Observational records may support prediction but be insufficient for a claim about the benefit of an intervention. The contract should make that limitation visible before finance capitalises the claimed benefit.
- The recommended evidence states are absent, supplied, checked, challenged and accepted for a defined claim. A report can be supplied but not checked. A result can be checked but not accepted for the proposed population.
- An acceptance record should identify defeats: findings that would invalidate the claim, such as a new operating mode, a revised target label, deteriorating calibration, a permission failure or a material change to a vendor model.
Document possession is not assurance. Ask which state each piece of evidence is actually in.
16:00 – 21:00
Release controls, intake and the meeting
- Store the approved configuration with the evidence: model version, data snapshot or query definition, feature logic, prompt and retrieval configuration, tool definitions, decision thresholds and deployment scope. An investigator should be able to compare the system that was tested with the system that produced an outcome.
- Appendix A's intake begins with a decision: the decision sentence, intended benefit, alternatives considered, then model, retrieval, tools, affected people, legal map, human review, fallback, stop authority and unknowns.
- Fields marked not known should remain visible as evidence gaps. Do not invent a figure or a legal conclusion to complete a form.
- In the meeting: the sponsor states the claim and requested authority; the technical team explains the protocol and result; the domain authority examines whether the action is professionally permissible; risk and legal identify unresolved obligations and harm; the approving authority decides what permission the evidence supports: accept, restrict, defer or decline.
- THE DOCTRINE
A statistical re-analysis cannot settle a lack of legal authority; an executive preference cannot repair leakage.
When the room disagrees, name the kind of disagreement first: fact, assumption, value trade-off or authority.
21:00 – 25:00
Write it down, Section 3 and Pop Quiz 1
- Before you close the laptop, write your system's main claim as one falsifiable sentence and, beneath it, the result that would prove it wrong.
- Section 3 of your plan is The evidence contract: falsifiable claims, evidence states and release controls.
- Pop Quiz 1 opens now: five questions on claims, permissions and evidence from Sessions 1 to 3, closed book. Sit it before Session 4.
Sit the quiz cold. The point is to learn what you would say in the meeting without notes.
Key Terms
Evidence contract
A proposed agreement between sponsor, delivery team and approving authority setting the claim, the evidence, the decision rule and the validity boundary. A management method, not a certification.
Falsifiable claim
A claim stated precisely enough, with a failure condition and pre-specified metric, that a trial could show it to be wrong.
Evidence states
Absent, supplied, checked, challenged and accepted for a defined claim. They stop possession of a document being mistaken for assurance.
Defeat
A finding or change that would invalidate an accepted claim, such as a new operating mode, a revised target label, deteriorating calibration, a permission failure or a material vendor model change.
Self-Check — Before You Submit
1. A team reports strong performance. You learn it chose the evaluation subgroup and threshold after seeing the results. What does that mean?
- A. The result is stronger, because the team found the best setting
- B. Nothing, provided the overall accuracy is high
- C. Only the threshold needs re-checking
- D. The reported performance is likely optimistic; the metric, population, comparison and uncertainty should have been pre-specified
D. The reported performance is likely optimistic; the metric, population, comparison and uncertainty should have been pre-specified — A team that selects whichever subgroup or threshold looks best will report optimistic performance. High overall accuracy is the tempting reassurance, but it does not repair a success criterion chosen after the results were seen.
2. The vendor has supplied a validation report for your use. Nobody in your company has examined it yet. Which evidence state is it in?
- A. Accepted
- B. Supplied
- C. Checked
- D. Challenged
B. Supplied — A report can be supplied but not checked. Treating it as accepted because it is on file is exactly the confusion the evidence states exist to prevent: possession is not assurance.
3. In the release meeting, the technical team offers a statistical re-analysis to answer the legal reviewer's concern that the company has no authority to make the proposed submissions. What should the approving authority do?
- A. Record the disagreement as one of authority, and resolve it through legal authority rather than further statistics
- B. Accept the re-analysis if it shows higher accuracy
- C. Let the sponsor decide, since the release date is near
- D. Average the two views into a moderate rating
A. Record the disagreement as one of authority, and resolve it through legal authority rather than further statistics — Different kinds of disagreement need different resolution; a statistical re-analysis cannot settle a lack of legal authority. Accepting better accuracy is the trap: it answers a question nobody asked.
Today’s Assignment
Write the evidence contract for the AI system or proposal in your company.
- Claims. Up to three falsifiable claims, each with a failure condition.
- For each claim. Evaluation population, prediction or action time, primary metric with its denominator, comparison, and the release rule fixed before the final test.
- Evidence states. List the evidence your company holds today and put each item in its honest state: absent, supplied, checked, challenged or accepted.
- Validity boundary and defeats. Where the approval stops, and the findings that would invalidate it.
- Release controls. Which configuration items your company records today and which it does not.
- The honest part. Where your company currently treats a demonstration as a validation. Mark unknowns not known. Four hundred to nine hundred words.
YOUR 90-DAY PLAN
Section 3 — The evidence contract: falsifiable claims, evidence states and release controls.
How this is marked — the rubric
| Writes at least one claim with a failure condition, pre-specified metric, population and release rule | 30 |
| Places each item of existing evidence in an honest evidence state | 25 |
| States a validity boundary and at least two defeats specific to the system | 25 |
| The honest paragraph names where the student's own company mistakes a demonstration for validation | 20 |
| Total · pass mark 70 | 100 |
Submitting session 3
Write your answer in Word or Google Docs. The first line must read
Write your answer in Word or Google Docs. The first line must read
Session: 3, or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter, saved to your progress page. Do not submit until you have passed the self-check above.ASSESSMENT NOW OPEN
Pop Quiz 1 — Claims, Permissions and Evidence opens now. Sit it before you start the next session — it is how you find out whether the doctrine landed, and the practice papers may be resat as often as you like.
Sit Pop Quiz 1 →Closed book, no notes, and Coach Ritchie switches himself off while you sit it.Capabilities Covered
Falsifiable claimsProportionate evidenceEvidence statesRelease controlsRunning the approval meeting
Leadership · Chapters 4 and 5SESSION 4
Value Without Exaggerated Promises, and Risk Classification
Why This Matters
Two numbers decide most AI approvals: the value the sponsor promises and the risk rating the committee assigns. Both are easy to inflate or to flatten. A time-saving demonstration becomes a cash saving on a slide; a risk score averages a serious hazard into a comfortable amber. Today you learn to read the economics as the book does, by working an illustrative case line by line, and to classify risk by consequence, with escalation rules applied before any score. If the honest economics for your system are negative in year one, that is not a reason to hide them. It may still be a defensible investment, provided you say plainly why.
25-Minute Module
0:00 – 5:00
Measure the complete decision process
- Governance can reduce uncertainty and clarify permissions, but it does not automatically make every AI programme faster or more profitable. The book treats that governance dividend as a proposition to measure.
- A model that reduces drafting time may increase review, correction or incident work. A tool that finds more anomalies may create a maintenance backlog without improving reliability.
- Write incremental net value as additional realised benefit less additional operating, capital, transition and risk-related costs, for a stated period, against a stated comparison case.
- Distinguish cash from capacity released. If an analyst saves two hours but remains fully employed, the benefit may be redeployed capacity, not payroll reduction. To call it cash, show which paid cost actually disappears.
When someone says hours saved, ask where the hours go and which cost disappears.
5:00 – 11:00
The book's illustrative economics test
- These figures are teaching assumptions, not market rates. They come from the book, in the book's currency.
Line Calculation Result Gross capacity released 12,000 documents × 12 minutes / 60 2,400 hours Added review 12,000 × 4 minutes / 60 800 hours Net capacity released 2,400 − 800 1,600 hours Potential capacity benefit 1,600 × $30 per hour $48,000, not a confirmed cash saving First-year value $48,000 − $22,000 recurring − $36,000 one-time −$10,000 Later annual value $48,000 − $22,000, if volume, savings and redeployment persist $26,000 If only 60% is redeployed 960 hours × $30; less $22,000; less $36,000 $28,800 benefit; $6,800 recurring; −$29,200 first year - The calculation shows why a time-saving demonstration is insufficient for an investment recommendation.
- THE DOCTRINE
The executive decision may still be to invest in a first-year negative case for strategic capability. State that rationale plainly. It is more defensible than labelling the same investment an immediate cost-saving success.
- Costs remain after launch: evaluation maintenance, incident response, model changes, source-document upkeep, access administration, logging, vendor management and user retraining. Do not assign all platform cost to the first pilot and then pretend later deployments are free.
- Finance should reconcile predicted with observed benefit after release, and preserve negative and inconclusive results.
Change one assumption and recompute. Where the answer flips, you know what evidence to buy.
11:00 – 17:00
Classify by consequence, with escalation rules first
- Internal classification establishes scrutiny and authority. It is distinct from legal classification under a statute; an internal low-risk label cannot exempt a system from applicable law.
- THE DOCTRINE
An arithmetic average can conceal a severe hazard. A safety-related system should not become low risk because its purchase cost is small and its user base limited.
- Mandatory escalation applies for plausible serious physical harm, legally prohibited uses, consequential decisions about people, material external commitments and uncontrolled access to sensitive information. Only then use a structured rubric with anchored descriptions.
Internal tier Typical decision boundary Minimum governance response Restricted Prohibited use or uncontrolled severe consequence Decline use or redesign the boundary High Serious harm, consequential personal decisions or material autonomous action Domain review, independent validation, tested containment and explicit acceptance Moderate Reversible operational influence within bounded authority Documented evaluation, owner, monitoring and change control Limited Public-information drafting with no external action Approved tool, user guidance and ordinary information controls - These tiers are the author's internal proposal, not the EU categories.
If the risk rating came out lower than your instinct, check whether an escalation rule was skipped.
17:00 – 21:00
Uncertainty, shared exposure and reclassification
- Treat uncertainty separately. No failures in a short trial may mean the system is reliable, or that the trial rarely encountered the relevant condition. A classification record should not turn absence of observation into a guarantee.
- OPERATIONS · THE WORKED CASE
- Operations. The book's point on correlated deployment, applied to a fictional gas business running one model across ten sites: the sites share exposure to the same erroneous feature definition. Ten separate site approvals do not remove the portfolio risk.
ENTERPRISE · THE PARALLEL- Enterprise. The book's example: a drafting assistant promoted into an agent that submits regulatory forms requires a new assessment, even if the model file is unchanged. A commercial deadline is a scheduling constraint, not evidence of lower risk.
- Appendix B records six dimensions: people, physical systems, data, external authority, scale and reversibility, and evidence uncertainty. The impact assessment then asks about purpose and necessity, affected parties, harm, data, technical evidence, control design, residual risk, and review and remedy.
- Review appeals through an authority independent of the sponsor, preserving the original rationale and the revised decision.
A colourful heat map without approvals, controls and triggers attached is not a classification.
21:00 – 25:00
Write it down, and Section 4
- Before you close the laptop, write which escalation rule, if any, your system triggers. Then write its internal tier and the one uncertainty most likely to change it.
- Section 4 of your plan is The incremental value case and the risk classification, with escalation rules.
- Use your own figures only where your company has verified them. Where it has not, write not known and say who would know.
An honest negative first year with a stated rationale will survive a board. A disguised one will not.
Key Terms
Incremental net value
Additional realised benefit less additional operating, capital, transition and risk-related costs, for a stated period, against a stated comparison case.
Capacity released
Time freed by a system. It is not a cash saving unless a paid cost disappears, and not throughput unless it reaches a binding operational constraint.
Escalation rule
A mandatory route to higher scrutiny, applied before any score, for serious physical harm, prohibited uses, consequential decisions about people, material external commitments or uncontrolled access to sensitive information.
Internal tier
The book's proposed Restricted, High, Moderate or Limited classification, which sets scrutiny and authority inside the company. Distinct from any legal classification under a statute.
Self-Check — Before You Submit
1. In the book's illustrative test, only 60% of the 1,600 net released hours can be redeployed productively. What is the first-year figure?
- A. −$10,000
- B. $6,800
- C. −$29,200
- D. $28,800
C. −$29,200 — 960 hours × $30 is $28,800; less $22,000 recurring gives $6,800; less $36,000 one-time gives −$29,200. $6,800 is the tempting answer, but it is the recurring figure and leaves out the one-time implementation cost.
2. A safety-related system for a fictional gas plant scores low on a weighted rubric because it is cheap and has few users. What should happen?
- A. Apply the escalation rule for plausible serious physical harm before relying on the score
- B. Accept the low rating, because the rubric was applied correctly
- C. Average in a higher safety score to reach Moderate
- D. Defer classification until after release
A. Apply the escalation rule for plausible serious physical harm before relying on the score — An arithmetic average can conceal a severe hazard; escalation rules come before scores. Adjusting the average to Moderate is the tempting compromise, but it still lets the arithmetic decide what a mandatory rule should.
3. Which statement about the book's four internal tiers is accurate?
- A. They are the EU AI Act categories
- B. An internal Limited label exempts a system from applicable law
- C. They replace the need for a legal classification
- D. They are the author's internal proposal; any legal classification must be recorded separately
D. They are the author's internal proposal; any legal classification must be recorded separately — Internal classification is an operating decision distinct from legal classification under a statute, and Appendix B asks that the two remain distinguishable. Assuming the tiers mirror the EU categories is the common error; the book says plainly they do not.
Today’s Assignment
Write the incremental value case and the risk classification for the AI system or proposal in your company.
- The comparison case. Carry forward your counterfactual from Section 1.
- Incremental value. Benefit and costs for a stated period, separating cash from capacity released, with post-launch costs listed. Label every assumption; write not known where your company has no verified figure.
- Sensitivity. Change the one assumption you trust least and show the effect.
- Classification. Escalation rules checked first, then the internal tier with its rationale, and whether a legal classification is separately required and who would supply it.
- Uncertainty and shared exposure. What the evidence cannot yet support, and any common model, data feed or vendor.
- The honest part. Where your company currently overstates AI value or averages away harm. Four hundred to nine hundred words.
YOUR 90-DAY PLAN
Section 4 — The incremental value case and the risk classification, with escalation rules.
How this is marked — the rubric
| States incremental value against a comparison case, separating cash from capacity, with labelled assumptions and post-launch costs | 30 |
| Shows a sensitivity test on one named assumption with the recomputed result | 15 |
| Applies escalation rules before assigning a tier, and keeps any legal classification separate | 30 |
| The honest paragraph names a specific overstatement or averaging habit in the student's own company | 25 |
| Total · pass mark 70 | 100 |
Submitting session 4
Write your answer in Word or Google Docs. The first line must read
Write your answer in Word or Google Docs. The first line must read
Session: 4, or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter, saved to your progress page. Do not submit until you have passed the self-check above.Capabilities Covered
Incremental economicsCash versus capacityEscalation before scoresInternal risk tiersReclassification triggers
Law and Standards · Chapters 6 and 7SESSION 5
Map Obligations, and Standards as Evidence Architecture
Why This Matters
Sooner or later someone in your company will say that an AI system is compliant. Your task is to ask: with what, on whose reading, and with what evidence? Today we close Week 1 with the law and the standards, stated only as precisely as the book can verify them. You will see where Nigerian law sits, why a petroleum licence is not an AI approval, how to read foreign instruments without importing them as Nigerian law, and why an ISO certificate is evidence about a management system rather than a guarantee about your deployment. Then you will build the obligation map and the assurance crosswalk your company will actually evidence, not the one it would like to claim.
25-Minute Module
0:00 – 6:00
Map obligations before claiming compliance
- Legal mapping begins with where the organisation acts, who is affected, what data it processes and which role it performs.
- Keep separate registers for binding law, contractual requirements, voluntary frameworks, organisational policies and proposed instruments. A draft consultation does not become binding because it appears on a regulator's website.
- The Nigeria Data Protection Act 2023 provides the country's statutory data-protection framework, and the Nigeria Data Protection Commission publishes implementation resources [S04]. Establish your processing role, lawful basis, purpose, rights handling and applicable assessment and transfer obligations from the actual instruments. The book does not infer a blanket permission to train a model from possession of a dataset.
- THE DOCTRINE
The Petroleum Industry Act 2021 establishes sector governance and institutions. It does not make every AI recommendation acceptable merely because a company operates under a petroleum licence [S05].
- OPERATIONS · THE WORKED CASE
- Operations. For petroleum uses, identify the relevant licensee, regulator, licence terms and technical obligations, then connect each proposed AI action with the existing authority and evidence required for that activity. Applied to a fictional operator: the licence frames the activity; it does not approve the model.
ENTERPRISE · THE PARALLEL- Enterprise. The book's examples: a personal-data obligation may require a documented purpose and retention rule; a controlled technical submission may require an authorised signatory and verified underlying records. Each line names a clause or section, role, control, evidence and owner. No generic compliance checkbox.
If your compliance register has one column for everything, it cannot tell law from aspiration.
6:00 – 11:00
Foreign instruments, stated as foreign
- Regulation (EU) 2024/1689 is the EU AI Act. Applicability is role- and use-dependent, including specified connections with the EU. Its categories are legal classifications, not interchangeable with the book's internal tiers [S01]. It is not Nigerian law.
Date As the European Commission states it, checked for the book's edition [S02, S03] 2 February 2025 Prohibited practices and literacy obligations 2 August 2025 Governance and general-purpose AI obligations 2 August 2026 General application, including relevant transparency provisions 2 December 2027 Relevant Annex III high-risk uses, following the AI Omnibus 2 August 2028 High-risk systems embedded in regulated products, following the AI Omnibus - These dates do not by themselves settle transitional treatment of a particular system. A deployer should not assume the provider's obligations discharge its own.
- The United States needs a federal, state, local and sector map. The Colorado Attorney General states that Senate Bill 26-189 takes effect on 1 January 2027; its October 2026 rulemaking materials include proposed and interim drafts [S06]. Treat drafts as drafts.
The method matters more than the dates: operative text, effective date, amendment and implementing-rule status.
11:00 – 15:00
A legal currency control
- Assign a legal owner to each relevant jurisdiction and sector.
- Use trigger reviews when the organisation enters a new market, changes its processing role or gives a system new authority. Periodic review supplements triggers; it cannot replace them.
- Record the review date and the action arising from each change.
- THE DOCTRINE
Remove a claim when its source cannot be verified at the level of precision asserted. It is better to describe an unresolved legal question than to publish an impressive but untraceable section number, penalty or court outcome.
The book applies that rule to itself. So does this programme.
15:00 – 21:00
Standards as evidence architecture
- NIST's AI Risk Management Framework 1.0 is a voluntary framework organised around Govern, Map, Measure and Manage; NIST's Generative AI Profile adds considerations for generative systems. ISO/IEC 42001:2023 specifies an AI management system; ISO/IEC 23894:2023 provides AI risk-management guidance. Their purposes differ [S07, S08, S09, S10].
- For each framework outcome you adopt, identify an owner, an implemented control, a test and a retained record. Keep one common control catalogue and map external requirements to it.
- Read certification claims precisely: which organisation, sites and activities; which standard and edition; who issued it; what the audit covered. ISO certification is not a guarantee of accuracy, fairness, security or legal compliance.
Assurance question Operating evidence Limitation to record Who governs the use Charter and delegated authority Formal authority may differ from practice What the system can affect Decision boundary and impact assessment Foreseeable secondary uses may remain How performance was tested Frozen evaluation plan and results Evidence applies to a defined distribution How changes are controlled Release record and regression tests Vendor changes may reduce reproducibility How failures are handled Containment drill and incident record A drill does not establish universal recovery - The crosswalk is the author's synthesis. The research of Sculley and of Breck and their colleagues explains why a trained model is insufficient as the unit of release, not a universal passing score [S11, S12]. The evidence burden remains local.
If the last column of your crosswalk is empty, you may be confusing assurance with certainty.
21:00 – 25:00
Write it down, Section 5 and Practice Exam 1
- Before you close the laptop, list the instruments you believe apply to your system and mark each as binding law, contract, voluntary framework, policy or proposal.
- Section 5 of your plan is Our obligation map and the assurance crosswalk we will actually evidence.
- This closes Week 1. Practice Exam 1 opens now: fifteen questions on the leadership doctrine and the law, covering Sessions 1 to 5, closed book.
Where you are unsure an obligation applies, write the question and the legal owner who must answer it.
Key Terms
Obligation map
A record linking each clause or section to the applicable role, operational control, evidence and owner, with binding law, contracts, voluntary frameworks, policies and proposals kept in separate registers.
Legal currency control
A legal owner per jurisdiction and sector, trigger reviews on new markets, roles or authority, and a recorded review date and action for every change.
Certification scope
The organisation, sites, activities, standard edition and audit coverage a certificate actually covers. It must be read before the certificate supports any claim.
Assurance crosswalk
The author's synthesis tracing each assurance question to its operating evidence and the limitation that evidence leaves.
Self-Check — Before You Submit
1. A project lead says the AI tool is acceptable because the company operates under a petroleum licence. How does the book frame the Petroleum Industry Act 2021?
- A. As the approval standard for AI in petroleum operations
- B. As sector governance and institutions, not an AI approval
- C. As a data-protection statute that governs model training
- D. As equivalent to the EU AI Act for Nigerian operators
B. As sector governance and institutions, not an AI approval — The book cites the Act as sector governance context, not an AI approval standard [S05]. Treating the licence as approval is the tempting shortcut; the book requires each proposed AI action to be linked to the existing authority and evidence for that activity.
2. A vendor presents an ISO/IEC 42001:2023 certificate as proof that its predictive tool will perform well in your plant. What should you ask first?
- A. Whether the certificate is recent
- B. Whether a competitor holds the same certificate
- C. Which organisation, sites, activities, edition and audit the certificate covers
- D. Whether the certificate replaces local testing
C. Which organisation, sites, activities, edition and audit the certificate covers — A management-system audit and a task-specific evaluation provide different evidence, and ISO certification is not a guarantee of accuracy. Asking only whether it is recent is the trap: a current certificate can still cover nothing about your use.
3. A trade article gives a confident EU AI Act timetable that differs from your register. What does a legal currency control require?
- A. Adopt the article's dates, since they are more recent
- B. Ignore foreign law entirely
- C. Wait for the annual review
- D. Check the operative text, effective date, amendment and rule status, and record the review
D. Check the operative text, effective date, amendment and rule status, and record the review — A publication that confidently repeats an old timetable can misdirect a programme; the method is to verify the current status and record it. Waiting for the annual review is tempting, but routine review cannot replace trigger reviews.
Today’s Assignment
Write the obligation map and the assurance crosswalk for the AI system or proposal in your company.
- Context. Where your company acts for this system, who is affected, what data it processes and which role it performs.
- Registers. Separate binding law, contractual requirements, voluntary frameworks, organisational policies and proposed instruments. State only what you can verify; write not known otherwise.
- Obligation lines. At least three, each naming the instrument, the role, the operational control, the evidence and the owner by role. Include the Nigeria Data Protection Act 2023 where personal data is involved, and the Petroleum Industry Act 2021 only as the book frames it.
- Legal currency. The legal owner per jurisdiction and the triggers for review.
- Crosswalk. The five assurance questions, the evidence your company actually holds, and the limitation.
- The honest part. Where your company currently claims compliance or certification beyond what its evidence shows. Four hundred to nine hundred words.
YOUR 90-DAY PLAN
Section 5 — Our obligation map and the assurance crosswalk we will actually evidence.
How this is marked — the rubric
| Separates the five registers and states obligations only at verifiable precision, with unknowns marked | 25 |
| Gives at least three obligation lines, each naming instrument, role, control, evidence and an owner by role | 30 |
| Completes the crosswalk with evidence actually held and a limitation for each question | 25 |
| The honest paragraph names a specific over-claim of compliance or certification in the student's own company | 20 |
| Total · pass mark 70 | 100 |
Submitting session 5
Write your answer in Word or Google Docs. The first line must read
Write your answer in Word or Google Docs. The first line must read
Session: 5, or the submission is refused. Upload the Word file (.docx), or switch to the Google Doc tab and paste your document’s share link.Marked against the rubric above and returned as a written letter, saved to your progress page. Do not submit until you have passed the self-check above.ASSESSMENT NOW OPEN
Practice Exam 1 — The Leadership Doctrine and the Law opens now. Sit it before you start the next session — it is how you find out whether the doctrine landed, and the practice papers may be resat as often as you like.
Sit Practice Exam 1 →Closed book, no notes, and Coach Ritchie switches himself off while you sit it.Capabilities Covered
Obligation mappingNigerian law stated preciselyForeign instruments in their placeReading certification scopeAssurance crosswalk