Most weeks someone messages me to say they have finished an AI governance course and still can't get an interview. Some have finished two or three. The courses gave them the terms and the frameworks, but they still don't have anything to put in front of a hiring manager.

In the working groups I sit in, the same request keeps coming up. Organizations want people who can take ISO/IEC 42001, the NIST AI Risk Management Framework or the EU AI Act and turn it into documents and decisions a team can use. You can start building that on your own with three pieces of work.

1. Build an AI inventory
Pick a small business, a nonprofit you volunteer with, or a company you make up and describe in detail. List every AI tool it uses, including features that came switched on inside software it already pays for. For each one, write down what it does, what data it touches, who uses it and who decided to turn it on. Nearly every AI governance program starts here, and many organizations still haven't done it.

2. Create a risk register
Choose one system from your inventory and write a single complete entry for it. Describe the risk in plain language, rate its likelihood and impact, name the person who owns it, and record the control that reduces it. One finished entry tells a reader more about your judgment than a template with fifty blank rows.

3. Draft an AI use policy
Write a one-page policy for the staff of that same business. Say what they can use AI for, what is off limits, what data should never go into a prompt, and who to ask when they're unsure. If a new hire can read it in five minutes and know what to do, it's doing its job.

Together these make a small portfolio you can walk an interviewer through, add to your profile and keep building on as you learn.

If you already work in IT asset management, procurement, compliance or audit, a lot of this will feel familiar. Your asset register becomes an AI inventory, vendor intake becomes AI supplier review, and audit evidence becomes AI assurance evidence. Many of the people I've seen move into AI governance fastest came from these jobs, because they already know how an organization tracks what it owns and who answers for it.

As you put the pieces together, be open about what the work is. If the company is one you made up, say so, because a clearly marked practice case earns more trust than a vague reference to client work. It also helps to note which ISO/IEC 42001 clauses or NIST AI RMF functions each piece supports, so an interviewer can see that you understand how everyday tasks connect to the frameworks their organization is adopting. Add a few lines explaining your decisions, such as why you rated one risk high or kept a certain tool off limits, since that reasoning is usually what people want to talk about in an interview. Then come back to the portfolio every few months. The rules and the tools are changing quickly, and a record of what you updated and why shows people you're keeping up with the field.

Certifications still matter here. A recognized credential helps you get through screening, and structured training saves you a lot of time working things out alone. The portfolio sits alongside it and gives an interviewer something specific to discuss with you.

If you're not sure where to begin, start with the inventory. Everything else builds on it, and you can have a first version done in an afternoon.

By AD Edwards

Keywords: AI Governance, Careers, GRC

Follow Us On