SLScott's Lab Learn

Domain 2 · 24% of the exam · about 8 questions

2.1AI Strategic Planning and Organizational Alignment

AI strategy starts from business goals and a stated risk appetite, then turns them into policy, a phased roadmap and a culture that can carry them. Leaders measure whether governance works and improve it on a fixed cycle.

See this section as a mind map

What the blueprint lists for this section (4)
  • Strategy Development and Vision Setting
  • Governance Policies and Procedures
  • Change Management and Organizational Culture
  • Performance Measurement and Continuous Improvement

2.1 · lesson 1 of 5

AI strategy and vision setting

An AI strategy says why the organization uses AI, where it will and will not use it, and how much risk it will accept to get the value. Think of it as a city zoning plan: it decides what may be built where before anyone pours concrete. Governance then follows from that plan, not the other way round.

Strategy flows from business goals and an agreed risk appetite into a ranked portfolio of AI use cases. The AI policy, objectives and roadmap then put that portfolio into practice.

Key points

  • ISO/IEC 38507:2022 gives members of the governing body guidance to enable and govern AI use so that it is effective, efficient and acceptable within the organization.
  • In EC-Council's ADG (Adopt, Defend, Govern) framework, the GOVERN pillar sets AI risk appetite, decision rights, escalation paths, board reporting, investment criteria and the regulatory map.
  • ISO/IEC 42001 Clause 4 defines the context, interested parties and scope of the AI management system (AIMS); top management sets the AI policy (5.2), and AI objectives are set in planning (6.2).
  • NIST AI Risk Management Framework (AI RMF) GOVERN 1.3 sizes risk management to the organization's risk tolerance, and MAP 1.1 documents each system's intended purpose and context.
  • AI RMF MAP 3 compares a use case's capabilities, expected benefits and costs with benchmarks, which supports ranking the use-case portfolio by value against risk.
  • AI RMF MANAGE 1.1 asks whether a system meets its purpose and whether development or deployment should proceed at all, so not building it is a valid strategic outcome.
  • ISO/IEC 42001 Annex C lists potential AI-related organizational objectives and risk sources that help turn the vision into measurable AI objectives.

Exam tip

When a question asks what comes first, pick the answer that ties AI use to business objectives and an approved risk appetite before tools, vendors or models are chosen. Think like a governance lead, not an engineer.

Source: ISO/IEC 38507:2022 Governance implications of the use of AI by organizations

2.1 · lesson 2 of 5

ADG four-phase governance roadmap

ADG (Adopt, Defend, Govern) lays out a 24-month path from knowing what AI the organization has to proving, continuously, that it is under control. Like building a house, it pours the foundation first (inventory, owners, a governance council), then adds the rooms (controls), then the smart wiring (agent safeguards).

ADG moves an organization from inventory to continuous assurance in four phases over 24 months. Each phase builds on the evidence the previous one produced.

Key points

  • EC-Council's ADG (Adopt, Defend, Govern) framework stages adoption in four phases over 24 months: Foundation, Control Deployment, Agentic Readiness and Maturity.
  • Foundation (months 0 to 3) builds the AI inventory, names owners, assigns ADG roles, classifies criticality and charters the AI Governance Council, covering Minimum Controls MC-1 to MC-3.
  • Control Deployment (months 3 to 9) adds release gates, change control, context policies, monitoring, adversarial testing, fairness evaluation and vendor due diligence: MC-4 to MC-9, MC-11 and MC-12.
  • Agentic Readiness (months 9 to 15) adds agent authority statements, tool trust tiering, Model Context Protocol (MCP) governance, circuit breakers, multi-agent governance and forensic replay.
  • Maturity (months 15 to 24) brings continuous evaluation, persistent adversarial monitoring, drift governance, responsible AI measurement and board-level reporting.
  • ADG's worked example: quarter 1 publishes the inventory and charters the Council; quarters 6 to 8 run automated weekly red-team tests and a quarterly board AI risk review.
  • The order matters because controls cannot be assigned or audited until each AI system is inventoried with an accountable owner, risk classification and autonomy tier (MC-1).

Exam tip

If asked which phase builds the inventory or charters the AI Governance Council, the answer is Foundation. Agent controls such as kill switches and MCP trust tiers come later, in Agentic Readiness.

Source: EC-Council ADG (Adopt, Defend, Govern) AI security governance framework

2.1 · lesson 3 of 5

AI policies and procedures

Policies say what the organization requires of AI; procedures say exactly how people meet those requirements, step by step. A policy is the speed limit and a procedure is the driving test. Good AI policy is approved at the top, fits alongside existing security and privacy policy, and is reviewed on a schedule.

Leadership approves the AI policy, procedures and Minimum Controls carry it out, and each control leaves evidence. Any deviation is recorded as a time-limited exception rather than ignored.

Key points

  • ISO/IEC 42001 makes top management establish the AI policy (Clause 5.2); Annex A area A.2 covers the AI policy, its alignment with other organizational policies and its review.
  • NIST AI Risk Management Framework (AI RMF) GOVERN 1.1 requires that legal and regulatory requirements involving AI are understood, managed and documented.
  • AI RMF GOVERN 1.2 puts trustworthy AI characteristics into policies, GOVERN 1.4 sets the risk process through transparent policies and controls, and GOVERN 1.5 plans periodic review.
  • AI RMF GOVERN 1.6 requires mechanisms to inventory AI systems, and GOVERN 1.7 requires procedures to decommission and phase out AI systems safely.
  • EC-Council's ADG (Adopt, Defend, Govern) framework turns policy into 12 Minimum Controls (MC-1 to MC-12), each with a named evidence artifact an auditor can inspect.
  • Deviations go into ADG's Governance Exception Register with a justification, risk acceptance and expiry date; exceptions still open past expiry are a tracked outcome metric.
  • For AI agents, ADG adds an Agent Authority Statement that defines what an agent may access, decide, execute and escalate.

Exam tip

Policy is owned and approved by leadership; procedures and controls implement it. A common distractor puts the engineering team in charge of approving AI policy.

Governance Exception Register entry (illustrative) · json
{
  "exceptionId": "EXC-2026-014",
  "system": "contoso-support-copilot",
  "control": "MC-11 Fairness and bias evaluation",
  "justification": "Representative test set arrives next quarter",
  "compensatingControl": "Human review of every denial",
  "riskAcceptedBy": "AI Governance Council",
  "expires": "2027-03-31"
}

Source: NIST AI RMF Playbook

2.1 · lesson 4 of 5

Change management and AI culture

New AI tools change how people work, so governance fails if people do not understand or trust it. Like seat belts, a rule only works once people know why it exists and use it by habit. Training, open talk about risk and a safe way to raise concerns build that habit.

Culture change runs as a loop: literacy and training lead to everyday use with open discussion of risk, and reported concerns feed back into better practice.

Key points

  • NIST AI Risk Management Framework (AI RMF) GOVERN 4 calls for teams committed to a culture that considers and communicates AI risk, with a critical-thinking, safety-first mindset (GOVERN 4.1).
  • AI RMF GOVERN 4.2 has teams document and communicate the risks and impacts of the AI they build or use, and GOVERN 4.3 enables AI testing, incident identification and information sharing.
  • AI RMF GOVERN 2.2 requires AI risk management training for personnel and partners, and GOVERN 3.1 wants AI risk decisions informed by a diverse team.
  • EU AI Act Article 4, as amended by Regulation (EU) 2026/1744, requires providers and deployers to support AI literacy of their staff without guaranteeing any specific level.
  • AI literacy duties have applied since 2 February 2025, and the 2026 amendment gives the Commission and Member States a stronger role in promoting AI literacy.
  • ISO/IEC 42001 Annex A area A.3 (internal organization) covers AI roles and responsibilities and a process for reporting concerns about AI systems.
  • EC-Council's ADG (Adopt, Defend, Govern) framework treats workforce capability as the binding constraint and starts with a literacy baseline: a shared AI vocabulary for every role.

Exam tip

Culture questions reward leadership commitment, training and a safe channel to report concerns. A distractor offers a technical control, such as a new content filter, to fix a people problem.

Source: AI Act Service Desk: Article 4 AI literacy

2.1 · lesson 5 of 5

Measuring AI governance performance

What gets measured gets managed: governance needs numbers that show controls work, not just that they are written down. ADG (Adopt, Defend, Govern) stacks its metrics like a pyramid, from per-control counts at the base to a few board indicators at the top. ISO/IEC 42001 then runs a check-and-improve loop on the results.

ADG metrics roll up from control counts to outcomes to a few board indicators. Management review turns those results into decisions that improve the controls.

Key points

  • EC-Council's ADG (Adopt, Defend, Govern) framework uses three measurement tiers that roll upward: Tier 1 control effectiveness, Tier 2 outcome metrics and Tier 3 board-level indicators.
  • Tier 1 examples: share of systems with a completed risk classification or a RACI (responsible, accountable, consulted, informed) matrix, and uncontrolled production changes per quarter.
  • Tier 2 examples: mean time to detect (MTTD) and mean time to contain (MTTC) AI incidents, exceptions open past expiry, and systems running within approved configuration.
  • Tier 3 examples: a composite AI risk posture score, AI compliance coverage, exception backlog trend, AI incident trend, vendor AI exposure and responsible AI compliance rate.
  • ISO/IEC 42001 Clause 9 covers monitoring and measurement (9.1), internal audit (9.2) and management review (9.3); Clause 10 covers continual improvement and corrective action.
  • ISO/IEC 42001 follows Plan-Do-Check-Act (PDCA), so audit findings and review decisions flow back into AI objectives and controls.
  • NIST AI Risk Management Framework (AI RMF) MEASURE 4 checks whether measurement itself works, and MANAGE 4.2 builds measurable continual improvement into system updates.

Exam tip

Board-level questions want aggregated indicators and trends, not raw control counts. If asked which ISO/IEC 42001 clause holds internal audit and management review, the answer is Clause 9.

Source: EC-Council ADG (Adopt, Defend, Govern) AI security governance framework

Finished AI Strategy and Alignment?

Drill the flashcardsWatch the domain overview