AI governance is mostly judgement on paper: which tier a use case falls in, whether you are the provider or the deployer, which register entries would not survive a review, who could actually be harmed, and which control stops which AI-specific attack. Each scenario hands you a fictional organisation's records and asks you to make those calls with the EU AI Act, ISO/IEC 42001, ISO/IEC 27090 and NIST AI RMF in mind. Training material, not legal advice.
A diversified group operating in the EU has eight AI use cases on one spreadsheet. Place each in its EU AI Act tier - prohibited, high-risk, limited (transparency) or minimal - and decide whether the group is the provider or the deployer, then answer a vendor who says there is nothing left for you to do.
An insurer's AI use-case register looks complete until you read it against the change log and the egress proxy. Click the lines that would fail a governance review - no owner, no risk tier, a retrained model nobody re-assessed, a high-risk use with no human oversight, and a team using AI that was never registered.
A logistics firm wants AI to allocate shifts and score warehouse workers. Run the AI system impact assessment the way ISO/IEC 42001 intends: name the people and groups who could be harmed, not just the company, choose measures proportionate to those harms, and make the go-live call.
A health analytics firm runs a clinical triage model and an LLM assistant with tool access. Map six AI-specific threats - poisoning, a backdoored model, evasion, prompt injection, extraction and membership inference - to where in the lifecycle they strike and the control that actually counters them, using ISO/IEC 27090 as the threat guidance and NIST AI RMF to place the work.