# AI Governance, Compliance and Audit Trails: EU AI Act, NIST AI RMF and ISO/IEC 42001 > Cybersecurity · ibl.ai > Source: https://ibl.ai/courses/cybersecurity/ai-compliance-and-audit-trails > Last updated: 2026-11-14 *Read what the EU AI Act, NIST, ISO/IEC 42001 and SOC 2 ask for, then build a tamper-evident audit log for an AI agent and the plan that turns it into evidence* **A cybersecurity course from ibl.ai (self-paced, 10 to 12 hours, free).** A hands-on, self-paced course for security, platform and compliance teams on AI governance evidence: the EU AI Act as amended in July 2026, the NIST AI RMF and Generative AI Profile, ISO/IEC 42001 and SOC 2 at the level their publishers describe, and five local labs that build and test a tamper-evident audit log for an AI agent. - **Price:** Free - **Format:** Self-paced, online - **Time:** 10 to 12 hours - **Pace:** 3 hours per week - **Level:** Intermediate - **Language:** English - **Subject:** Information Technology [Enroll](https://lms.ibl.ai/platform/cybersecurity/courses/course-v1:cybersecurity+ai-compliance-and-audit-trails+self-paced) ## Course description AI Governance, Compliance and Audit Trails teaches security engineers, platform teams, ML engineers and compliance leads to read what the governing texts require of AI systems and to produce evidence that stands up. You will read the EU AI Act's roles, risk tiers, high-risk obligations, record-keeping duties in Articles 12, 19 and 26, general-purpose AI obligations and the timeline after the Digital Omnibus of July 2026; map the NIST AI RMF and Generative AI Profile, ISO/IEC 42001 and SOC 2 to the records each expects; and record bias and robustness tests properly. In five local Python labs you build an append-only, hash-chained audit log that records the prompt, retrieved context, tool calls, approvals and output of every agent action, a verifier that detects tampering, signed checkpoints that catch truncation and rewriting, privacy and retention controls that expire content without breaking the chain, and a coverage check that maps log fields to requirements. The course ends with a compliance and audit-evidence plan for one AI system in your organisation. It states what the texts say and is not legal advice. Last verified 2026-11-03. ### About this course When a customer, an auditor or a regulator asks what an AI system did, the answer has to come from records you can show were not changed. This course teaches security, platform and compliance teams to read what the governing texts require and to build those records. You will read the [EU AI Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng) as amended by the [Digital Omnibus on AI](https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng), the [NIST AI Risk Management Framework](https://doi.org/10.6028/NIST.AI.100-1) and its [Generative AI Profile](https://doi.org/10.6028/NIST.AI.600-1), and what ISO and the AICPA say publicly about ISO/IEC 42001 and SOC 2. Then you will build a tamper-evident, append-only audit log for a sample agent, a verifier that detects tampering, signed checkpoints, privacy and retention controls, and a coverage check that maps log fields to record-keeping requirements. The course states what the texts say; it is not legal advice. ### What you will be able to do - Classify an AI system under the EU AI Act as amended by the Digital Omnibus (Regulation (EU) 2026/1744): your role as provider or deployer, its risk tier, the articles that apply and the dates from which they apply. - State what Articles 12, 19 and 26 require of logs and record-keeping for high-risk systems, and what Articles 53 and 55 require of general-purpose AI model providers, citing the official text. - Map the NIST AI RMF functions, the NIST Generative AI Profile and the publicly described scope of ISO/IEC 42001 and SOC 2 to the evidence each one expects, in a single crosswalk. - Design an audit record for an AI agent that captures the prompt, retrieved context, tool calls requested and executed, approvals and output, and keeps secrets and unnecessary personal data out. - Build and test a tamper-evident, append-only audit log with a verifier and signed checkpoints, and show which kinds of tampering each mechanism detects. - Write a compliance and audit-evidence plan for one AI system, with retention and privacy controls, bias and robustness test records, monitoring of the log, and a procedure for answering evidence requests. ### Who this course is for **Roles:** security engineers, AppSec and platform teams, ML engineers, compliance and risk leads, internal auditors and security leaders who build, run or assure LLM applications and agents. **Organisations:** any sector that builds, buys or deploys AI systems and must answer to the EU AI Act, a customer's SOC 2 requirements or an internal AI governance programme. **Before you start:** basic Python and the command line for the labs, and familiarity with logging and access control. All lab data is synthetic and supplied in the course; the labs run on your own machine. ### Format **Time:** about 10 to 12 hours, self-paced. **Level:** intermediate. **Hands-on:** five local Python labs, tested on Python 3.12 and 3.15, with an AI tutor that coaches each step from the output you paste. **Structure:** a Start here section, four content sections of readings, worked examples, templates and hands-on labs, each ending in an AI assessment, and a capstone in which you write a compliance and audit-evidence plan for one AI system in your organisation, followed by a reading list. **Grading:** the four section AI assessments count for 60 percent of the grade and the capstone assessment for 40 percent. The pass mark is 70 percent. ### Currency **Last verified 2026-11-03** against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (in force 27 July 2026), the European Commission's AI Act pages, NIST AI 100-1, NIST AI 600-1, NIST AI 100-2e2025, NIST SP 800-53 Rev. 5, ISO's ISO/IEC 42001 page, the AICPA's SOC 2 pages, the OWASP Logging Cheat Sheet, MITRE ATLAS release 2026.10 and the ibl.ai documentation. These rules are still changing. The Commission expects more harmonised standards and guidance, the AICPA has proposed 2027 Trust Services Criteria, and NIST and ISO revise their publications. Check the current texts before relying on any page or template. ## Outline ### Section 0 · Start here - 0.1 Welcome and orientation ### Section 1 · Read what the EU AI Act requires - 1.1 Scope, risk tiers and the timeline - 1.2 Record-keeping and general-purpose AI - 1.3 Section 1 assessment ### Section 2 · Map NIST, ISO/IEC 42001 and SOC 2 to evidence - 2.1 The NIST AI RMF, the Generative AI Profile and test records - 2.2 ISO/IEC 42001, SOC 2 and one evidence base - 2.3 Section 2 assessment ### Section 3 · Build a tamper-evident audit log for an agent - 3.1 Design the record and its protection - 3.2 Write, verify and anchor the log - 3.3 Section 3 assessment ### Section 4 · Retain, protect and present the evidence - 4.1 Retention, privacy and evidence requests - 4.2 Coverage, monitoring and the evidence plan - 4.3 Section 4 assessment ### Section 5 · Capstone and wrap-up - 5.1 Capstone: a compliance and audit-evidence plan for your AI system - 5.2 Capstone assessment - 5.3 Reading list and next steps ## Instructors - ibl.ai Cybersecurity, Course team (ibl.ai) ## More cybersecurity courses - [Identity and Delegated Access for AI Agents: OAuth, Scoped Tokens and Human Approval](https://ibl.ai/courses/cybersecurity/identity-and-delegated-access-for-agents) - [Securing Agent Tools and MCP Servers](https://ibl.ai/courses/cybersecurity/securing-mcp-servers-and-agent-tools) - [Securing RAG: Access Control, Provenance and Poisoning Defenses](https://ibl.ai/courses/cybersecurity/securing-rag-pipelines) - [Continuous Security Testing for LLM Apps: Automated Evaluation and CI Gates](https://ibl.ai/courses/cybersecurity/continuous-security-testing-for-llm-apps)