AI-GR601 — AI Governance, Security & Moral Reasoning
Institute: Institute for AI Governance, Cybersecurity & Risk Management (IAIGCRM)
Status: Academic model syllabus — v0.1 editorial draft; not accredited or approved by a degree-granting institution
Format: 15 weeks; proposed 3 semester credits; 3 contact hours/week plus independent work
Academic calendar: Instructor to supply dates, location, office hours, accessibility office, institutional policies and official credit-hour equivalence.
Academic standards and responsible AI policy
Students may use AI tools for formative explanation, brainstorming, debugging, or critique where authorized, but must disclose meaningful assistance, verify claims and citations, protect sensitive data, and independently explain submitted work. Fabricated references, undisclosed generated submissions, and submission of code or reasoning students cannot defend violate course expectations. Instructors must offer an equivalent non-AI route when necessary for accessibility, privacy, or equitable access. Research involving human participants, sensitive data, or live systems requires appropriate approvals. All security exercises use owned or expressly authorized environments.
Inclusive teaching and assessment
Use accessible readings, captioned media, reproducible notebooks or non-programming alternatives as appropriate, formative feedback, transparent rubrics, and documented accommodations. Assess conceptual understanding separately from AI-assisted output quality. A final oral defense or live demonstration tests authorship and comprehension.
General grading principles
Each assessment receives a rubric for technical accuracy, evidence, reasoning, reproducibility, ethical awareness, and communication. Late work, attendance, reassessment, academic integrity, and accessibility procedures must be finalized by the adopting institution.
Editorial notes
All readings are indicative; the instructor must verify editions, licensing, links, publication status, and accessibility before adoption. Course credits and prerequisites are proposals rather than institutional approvals.
Course profile
Level: Graduate interdisciplinary
Prerequisites: Graduate standing or equivalent professional preparation; familiarity with AI fundamentals recommended. Technical and policy students work in mixed teams.
Catalog description: A graduate seminar and applied governance laboratory examining institutional accountability, risk management, regulation, AI cybersecurity, moral philosophy, human rights, agency, existential risk claims, assurance evidence and operational decision-making across the AI lifecycle.
Measurable learning outcomes
- Critically compare ethical theories and explain disagreements about moral agency and AI authority.
- Map AI system stakeholders, harms, accountability and applicable governance obligations.
- Apply NIST AI RMF, ISO/IEC 42001 and ISO/IEC 27002 control concepts to a concrete AI use case.
- Develop threat models, control tests and evidence requirements for AI/ML and RAG systems.
- Design human oversight, contestability, incident response and independent assurance mechanisms.
- Evaluate contested systemic and existential risk claims with calibrated evidence and uncertainty.
- Defend an auditable governance decision using a risk register, documented tradeoffs and release criteria.
Assessment and weighting
| Component | Weight |
| Seminar leadership and analytical briefs | 20% |
| Comparative ethics and regulatory memorandum | 15% |
| Threat model, controls and assurance evidence | 25% |
| Midterm governance hearing | 15% |
| Final board-level risk dossier and oral defense | 25% |
Total: 100%. The capstone must include an individually attributable contribution, documentation and a defense.
Detailed 15-week instructional plan
Each week specifies measurable objectives, instructional activities, laboratory or seminar requirements, security integration and assessment evidence. Faculty must assign exact chapters and articles before delivery.
Week 01 — Theories of moral reasoning: virtue, duty, consequence and care
Weekly objectives: (1) Explain the principal concepts, assumptions and limitations of theories of moral reasoning: virtue, duty, consequence and care. (2) Apply the week's methods in pluralistic ethics memo. (3) Assess regulatory, ethical, cybersecurity and assurance implications with documented evidence. (4) Interpret evidence and communicate at least one limitation or trade-off.
Instructional plan: Instructor-led conceptual seminar; guided worked example; structured discussion or peer review; independent reading and preparation.
Laboratory / seminar requirements: Pluralistic ethics memo. A governance memo, risk register, control mapping or simulated review hearing. Use only synthetic, public, or explicitly approved data; record procedures and limitations.
Security & governance checkpoint: SEC-01–SEC-08; identify at least one relevant control, potential misuse or failure mode, and proportionate safeguard.
Assessment evidence: Submit a dated lab log or seminar brief with objective, methods, results, references, limitations and reflection.
Reading assignment: Relevant selections from the course reading list, assigned and verified by the instructor before the term.
Week 02 — Human agency, rights, dignity and moral status
Weekly objectives: (1) Explain the principal concepts, assumptions and limitations of human agency, rights, dignity and moral status. (2) Apply the week's methods in case comparison and conceptual critique. (3) Assess regulatory, ethical, cybersecurity and assurance implications with documented evidence. (4) Interpret evidence and communicate at least one limitation or trade-off.
Instructional plan: Instructor-led conceptual seminar; guided worked example; structured discussion or peer review; independent reading and preparation.
Laboratory / seminar requirements: Case comparison and conceptual critique. A governance memo, risk register, control mapping or simulated review hearing. Use only synthetic, public, or explicitly approved data; record procedures and limitations.
Security & governance checkpoint: SEC-01–SEC-08; identify at least one relevant control, potential misuse or failure mode, and proportionate safeguard.
Assessment evidence: Submit a dated lab log or seminar brief with objective, methods, results, references, limitations and reflection.
Reading assignment: Relevant selections from the course reading list, assigned and verified by the instructor before the term.
Week 03 — AI governance institutions and accountability
Weekly objectives: (1) Explain the principal concepts, assumptions and limitations of ai governance institutions and accountability. (2) Apply the week's methods in raci and stakeholder map. (3) Assess regulatory, ethical, cybersecurity and assurance implications with documented evidence. (4) Interpret evidence and communicate at least one limitation or trade-off.
Instructional plan: Instructor-led conceptual seminar; guided worked example; structured discussion or peer review; independent reading and preparation.
Laboratory / seminar requirements: RACI and stakeholder map. A governance memo, risk register, control mapping or simulated review hearing. Use only synthetic, public, or explicitly approved data; record procedures and limitations.
Security & governance checkpoint: SEC-01–SEC-08; identify at least one relevant control, potential misuse or failure mode, and proportionate safeguard.
Assessment evidence: Submit a dated lab log or seminar brief with objective, methods, results, references, limitations and reflection.
Reading assignment: Relevant selections from the course reading list, assigned and verified by the instructor before the term.
Week 04 — Risk concepts, uncertainty and socio-technical systems
Weekly objectives: (1) Explain the principal concepts, assumptions and limitations of risk concepts, uncertainty and socio-technical systems. (2) Apply the week's methods in risk register with evidence grades. (3) Assess regulatory, ethical, cybersecurity and assurance implications with documented evidence. (4) Interpret evidence and communicate at least one limitation or trade-off.
Instructional plan: Instructor-led conceptual seminar; guided worked example; structured discussion or peer review; independent reading and preparation.
Laboratory / seminar requirements: Risk register with evidence grades. A governance memo, risk register, control mapping or simulated review hearing. Use only synthetic, public, or explicitly approved data; record procedures and limitations.
Security & governance checkpoint: SEC-01–SEC-08; identify at least one relevant control, potential misuse or failure mode, and proportionate safeguard.
Assessment evidence: Submit a dated lab log or seminar brief with objective, methods, results, references, limitations and reflection.
Reading assignment: Relevant selections from the course reading list, assigned and verified by the instructor before the term.
Week 05 — NIST AI RMF and governance processes
Weekly objectives: (1) Explain the principal concepts, assumptions and limitations of nist ai rmf and governance processes. (2) Apply the week's methods in govern/map/measure/manage workshop. (3) Assess regulatory, ethical, cybersecurity and assurance implications with documented evidence. (4) Interpret evidence and communicate at least one limitation or trade-off.
Instructional plan: Instructor-led conceptual seminar; guided worked example; structured discussion or peer review; independent reading and preparation.
Laboratory / seminar requirements: Govern/map/measure/manage workshop. A governance memo, risk register, control mapping or simulated review hearing. Use only synthetic, public, or explicitly approved data; record procedures and limitations.
Security & governance checkpoint: SEC-01–SEC-08; identify at least one relevant control, potential misuse or failure mode, and proportionate safeguard.
Assessment evidence: Submit a dated lab log or seminar brief with objective, methods, results, references, limitations and reflection.
Reading assignment: Relevant selections from the course reading list, assigned and verified by the instructor before the term.
Week 06 — ISO/IEC 42001, 23894 and management systems
Weekly objectives: (1) Explain the principal concepts, assumptions and limitations of iso/iec 42001, 23894 and management systems. (2) Apply the week's methods in ai management-system control mapping. (3) Assess regulatory, ethical, cybersecurity and assurance implications with documented evidence. (4) Interpret evidence and communicate at least one limitation or trade-off.
Instructional plan: Instructor-led conceptual seminar; guided worked example; structured discussion or peer review; independent reading and preparation.
Laboratory / seminar requirements: AI management-system control mapping. A governance memo, risk register, control mapping or simulated review hearing. Use only synthetic, public, or explicitly approved data; record procedures and limitations.
Security & governance checkpoint: SEC-01–SEC-08; identify at least one relevant control, potential misuse or failure mode, and proportionate safeguard.
Assessment evidence: Submit a dated lab log or seminar brief with objective, methods, results, references, limitations and reflection.
Reading assignment: Relevant selections from the course reading list, assigned and verified by the instructor before the term.
Week 07 — EU AI Act and cross-border regulatory obligations
Weekly objectives: (1) Explain the principal concepts, assumptions and limitations of eu ai act and cross-border regulatory obligations. (2) Apply the week's methods in jurisdiction and applicability analysis. (3) Assess regulatory, ethical, cybersecurity and assurance implications with documented evidence. (4) Interpret evidence and communicate at least one limitation or trade-off.
Instructional plan: Instructor-led conceptual seminar; guided worked example; structured discussion or peer review; independent reading and preparation.
Laboratory / seminar requirements: Jurisdiction and applicability analysis. A governance memo, risk register, control mapping or simulated review hearing. Use only synthetic, public, or explicitly approved data; record procedures and limitations.
Security & governance checkpoint: SEC-01–SEC-08; identify at least one relevant control, potential misuse or failure mode, and proportionate safeguard.
Assessment evidence: Submit a dated lab log or seminar brief with objective, methods, results, references, limitations and reflection.
Reading assignment: Relevant selections from the course reading list, assigned and verified by the instructor before the term.
Week 08 — Midterm governance hearing
Weekly objectives: (1) Explain the principal concepts, assumptions and limitations of midterm governance hearing. (2) Apply the week's methods in risk acceptance hearing. (3) Assess regulatory, ethical, cybersecurity and assurance implications with documented evidence. (4) Interpret evidence and communicate at least one limitation or trade-off.
Instructional plan: Instructor-led conceptual seminar; guided worked example; structured discussion or peer review; independent reading and preparation.
Laboratory / seminar requirements: Risk acceptance hearing. A governance memo, risk register, control mapping or simulated review hearing. Use only synthetic, public, or explicitly approved data; record procedures and limitations.
Security & governance checkpoint: SEC-01–SEC-08; identify at least one relevant control, potential misuse or failure mode, and proportionate safeguard.
Assessment evidence: Submit a dated lab log or seminar brief with objective, methods, results, references, limitations and reflection.
Reading assignment: Relevant selections from the course reading list, assigned and verified by the instructor before the term.
Week 09 — AI system architecture, RAG and model supply chain
Weekly objectives: (1) Explain the principal concepts, assumptions and limitations of ai system architecture, rag and model supply chain. (2) Apply the week's methods in architecture and trust boundaries. (3) Assess regulatory, ethical, cybersecurity and assurance implications with documented evidence. (4) Interpret evidence and communicate at least one limitation or trade-off.
Instructional plan: Instructor-led conceptual seminar; guided worked example; structured discussion or peer review; independent reading and preparation.
Laboratory / seminar requirements: Architecture and trust boundaries. A governance memo, risk register, control mapping or simulated review hearing. Use only synthetic, public, or explicitly approved data; record procedures and limitations.
Security & governance checkpoint: SEC-01–SEC-08; identify at least one relevant control, potential misuse or failure mode, and proportionate safeguard.
Assessment evidence: Submit a dated lab log or seminar brief with objective, methods, results, references, limitations and reflection.
Reading assignment: Relevant selections from the course reading list, assigned and verified by the instructor before the term.
Week 10 — Adversarial ML, prompt injection and red teaming
Weekly objectives: (1) Explain the principal concepts, assumptions and limitations of adversarial ml, prompt injection and red teaming. (2) Apply the week's methods in authorized assurance test plan. (3) Assess regulatory, ethical, cybersecurity and assurance implications with documented evidence. (4) Interpret evidence and communicate at least one limitation or trade-off.
Instructional plan: Instructor-led conceptual seminar; guided worked example; structured discussion or peer review; independent reading and preparation.
Laboratory / seminar requirements: Authorized assurance test plan. A governance memo, risk register, control mapping or simulated review hearing. Use only synthetic, public, or explicitly approved data; record procedures and limitations.
Security & governance checkpoint: SEC-01–SEC-08; identify at least one relevant control, potential misuse or failure mode, and proportionate safeguard.
Assessment evidence: Submit a dated lab log or seminar brief with objective, methods, results, references, limitations and reflection.
Reading assignment: Relevant selections from the course reading list, assigned and verified by the instructor before the term.
Week 11 — Security controls, privacy and operational telemetry
Weekly objectives: (1) Explain the principal concepts, assumptions and limitations of security controls, privacy and operational telemetry. (2) Apply the week's methods in iso 27002/nist 800-53 evidence mapping. (3) Assess regulatory, ethical, cybersecurity and assurance implications with documented evidence. (4) Interpret evidence and communicate at least one limitation or trade-off.
Instructional plan: Instructor-led conceptual seminar; guided worked example; structured discussion or peer review; independent reading and preparation.
Laboratory / seminar requirements: ISO 27002/NIST 800-53 evidence mapping. A governance memo, risk register, control mapping or simulated review hearing. Use only synthetic, public, or explicitly approved data; record procedures and limitations.
Security & governance checkpoint: SEC-01–SEC-08; identify at least one relevant control, potential misuse or failure mode, and proportionate safeguard.
Assessment evidence: Submit a dated lab log or seminar brief with objective, methods, results, references, limitations and reflection.
Reading assignment: Relevant selections from the course reading list, assigned and verified by the instructor before the term.
Week 12 — Explainability, auditability and human oversight
Weekly objectives: (1) Explain the principal concepts, assumptions and limitations of explainability, auditability and human oversight. (2) Apply the week's methods in contestability and intervention design. (3) Assess regulatory, ethical, cybersecurity and assurance implications with documented evidence. (4) Interpret evidence and communicate at least one limitation or trade-off.
Instructional plan: Instructor-led conceptual seminar; guided worked example; structured discussion or peer review; independent reading and preparation.
Laboratory / seminar requirements: Contestability and intervention design. A governance memo, risk register, control mapping or simulated review hearing. Use only synthetic, public, or explicitly approved data; record procedures and limitations.
Security & governance checkpoint: SEC-01–SEC-08; identify at least one relevant control, potential misuse or failure mode, and proportionate safeguard.
Assessment evidence: Submit a dated lab log or seminar brief with objective, methods, results, references, limitations and reflection.
Reading assignment: Relevant selections from the course reading list, assigned and verified by the instructor before the term.
Week 13 — Safety, critical infrastructure and existential risk research
Weekly objectives: (1) Explain the principal concepts, assumptions and limitations of safety, critical infrastructure and existential risk research. (2) Apply the week's methods in competing claims and evidence review. (3) Assess regulatory, ethical, cybersecurity and assurance implications with documented evidence. (4) Interpret evidence and communicate at least one limitation or trade-off.
Instructional plan: Instructor-led conceptual seminar; guided worked example; structured discussion or peer review; independent reading and preparation.
Laboratory / seminar requirements: Competing claims and evidence review. A governance memo, risk register, control mapping or simulated review hearing. Use only synthetic, public, or explicitly approved data; record procedures and limitations.
Security & governance checkpoint: SEC-01–SEC-08; identify at least one relevant control, potential misuse or failure mode, and proportionate safeguard.
Assessment evidence: Submit a dated lab log or seminar brief with objective, methods, results, references, limitations and reflection.
Reading assignment: Relevant selections from the course reading list, assigned and verified by the instructor before the term.
Week 14 — Incident management, drift and lifecycle assurance
Weekly objectives: (1) Explain the principal concepts, assumptions and limitations of incident management, drift and lifecycle assurance. (2) Apply the week's methods in post-deployment monitoring and stop criteria. (3) Assess regulatory, ethical, cybersecurity and assurance implications with documented evidence. (4) Interpret evidence and communicate at least one limitation or trade-off.
Instructional plan: Instructor-led conceptual seminar; guided worked example; structured discussion or peer review; independent reading and preparation.
Laboratory / seminar requirements: Post-deployment monitoring and stop criteria. A governance memo, risk register, control mapping or simulated review hearing. Use only synthetic, public, or explicitly approved data; record procedures and limitations.
Security & governance checkpoint: SEC-01–SEC-08; identify at least one relevant control, potential misuse or failure mode, and proportionate safeguard.
Assessment evidence: Submit a dated lab log or seminar brief with objective, methods, results, references, limitations and reflection.
Reading assignment: Relevant selections from the course reading list, assigned and verified by the instructor before the term.
Week 15 — Governance board simulation and final defense
Weekly objectives: (1) Explain the principal concepts, assumptions and limitations of governance board simulation and final defense. (2) Apply the week's methods in board dossier, decision record and oral defense. (3) Assess regulatory, ethical, cybersecurity and assurance implications with documented evidence. (4) Interpret evidence and communicate at least one limitation or trade-off.
Instructional plan: Instructor-led conceptual seminar; guided worked example; structured discussion or peer review; independent reading and preparation.
Laboratory / seminar requirements: Board dossier, decision record and oral defense. A governance memo, risk register, control mapping or simulated review hearing. Use only synthetic, public, or explicitly approved data; record procedures and limitations.
Security & governance checkpoint: SEC-01–SEC-08; identify at least one relevant control, potential misuse or failure mode, and proportionate safeguard.
Assessment evidence: Submit a dated lab log or seminar brief with objective, methods, results, references, limitations and reflection.
Reading assignment: Relevant selections from the course reading list, assigned and verified by the instructor before the term.
Indicative reading list
- Aristotle, Nicomachean Ethics; Kant, Groundwork; Mill, Utilitarianism (selected excerpts and scholarly commentary).
- Floridi et al. (2018), “AI4People—An Ethical Framework for a Good AI Society.”
- NIST AI RMF 1.0 (2023) and NIST AI 600-1 (2024).
- ISO/IEC 42001:2023, ISO/IEC 23894:2023, ISO/IEC 27002:2022 (licensed access as appropriate).
- Regulation (EU) 2024/1689 (EU AI Act), official consolidated/current text as available.
- MITRE ATLAS, OWASP GenAI guidance and selected scholarly AI safety literature representing differing perspectives.
Capstone and evaluation evidence
The final submission must state the problem and constraints, method and baseline, data/source provenance, reproducible procedures, quantitative or qualitative evaluation, limitations, ethical and security implications, and evidence supporting conclusions. Include a short individual oral defense. Instructor will publish detailed rubrics and resource/accessibility alternatives before enrollment.
Quality assurance before academic adoption
Faculty peer review; verification of reading accessibility and rights; learning-outcome-to-assessment mapping; workload and credit-hour calibration; disciplinary prerequisites; inclusive pedagogy review; and alignment with the adopting institution's academic governance process.
Curriculum alignment and instructor delivery
This course is part of the proposed IAIGCRM Secure & Governed AI Development Curriculum. It is designed for potential delivery by IAIGCRM faculty or the Institute's founder, subject to final staffing, scheduling, enrollment, institutional agreements and resource availability. No enrollment, credits or accreditation are currently offered by this draft. The graduate integrative capstone is AI-GR551. Security baseline: SEC-01–SEC-08.
Weekly teaching preparation and laboratory quality gate
For each class, prepare slides, instructor demonstration, learner instructions, environment setup, starter files, a marking rubric, accessibility alternatives, and a verified reading packet. Labs must include a learning objective, prerequisites, data provenance, stepwise tasks, tests, expected outputs, failure cases, evidence submission and cleanup procedure. Students may not attack real systems or use non-consensual personal data.