u/Comfortable_Gene5180

A lot of people seem interested in getting into AI governance, but one question keeps coming up:

How do you get experience when every job seems to ask for it?

I looked at 100 AI governance job descriptions, and a few things stood out.

For starters, many roles asked for experience in areas like risk management, compliance, cybersecurity, privacy, and audit, not necessarily years of experience specifically in AI governance.

Another interesting finding: Python and SQL each appeared in only 3 of the 100 job descriptions. Technical knowledge still matters, but these roles often involve working across AI teams, legal, risk, security, and business functions.

NIST, ISO/IEC 42001, and the EU AI Act also showed up frequently.

One thing I think people overlook is the value of building a practical portfolio. You can take a real or simulated AI use case, assess its risks, map the relevant requirements, design controls, and document your approach even before landing your first AI governance role.

I’ve put together Part 3 of the analysis, focusing on how to break into the field and turn existing skills into relevant experience. Check out the latest video @ Latha-ai-governance to watch it. I aim to educate industry professionals regarding AI Governance.

If you were trying to enter AI governance today, what would you focus on first: certifications, practical projects, or building on your existing experience?

This week in AI governance was… a lot.

AI agents apparently probing government websites, an Australian government system breach, criminals using AI in job scams, the White House backing voluntary AI safeguards, and regulators starting to take a closer look at AI companies.

What I found most interesting is that there doesn’t seem to be one clear answer yet to the question of who is actually responsible when an AI agent goes wrong.

Companies? Regulators? Independent auditors? Governments?

I put together this week’s AI Governance Weekly covering the main developments and what I think is worth watching next. Check out the latest video @ Latha-ai-governance and do give your feedback. I aim to educate professionals about AI Governance.

A question for you:

Who do you think should ultimately be responsible for keeping AI agents in check?

I came across a recent AI security case that genuinely made me stop and think.

Apparently, a very small group was able to use AI agents to carry out cyber operations at a scale that would normally require a much larger team. The interesting part isn’t necessarily that the techniques were completely new it’s how much faster and more continuously they could be carried out with AI doing the repetitive work.

It raises a pretty uncomfortable question: what happens when the barrier to carrying out sophisticated cyber operations isn’t having a huge team of experts anymore?

I made a video breaking down the case and what happened, including the role of agent swarms and what the incident could mean for AI governance. Check out the latest YouTube video @ Latha-ai-governance, I aim to educate professionals in this industry about AI Governance, and would love your feedback.

Do you think AI agents will ultimately make cybersecurity harder to defend, or could the same capabilities give defenders an advantage?

I’ve been seeing a lot more questions lately from people trying to move into AI governance, but the certification path can get confusing pretty quickly.

Do you start with a general AI governance certification? Go straight into ISO 42001? Look at AIGP or something more focused on agentic AI?

I put together a short video answering four questions from people with very different backgrounds, from project/program management to analytics leadership and people already working in AI. Check out the latest YouTube video on @ Latha-ai-governance

One thing that came up repeatedly was that your existing experience matters a lot when deciding where to start. Someone completely new to AI governance probably shouldn’t follow the same path as someone who’s already spent 10+ years in governance or AI leadership.

Curious what others here think:

If you were making a career move into AI governance today, what skills or certifications would you prioritize first?

I get asked this all the time, so I thought I'd explain what a real day looks like because most descriptions of this job are very vague and theoretical.

My company works in 45 countries, so a big part of my work is checking what changed during the night: did a country make a new AI rule, change an old one or did something go wrong with an AI system in public (because problems usually lead to new rules quickly). I don't read everything myself; that's just not possible at this level, so I use alerts, trusted people and AI tools to help figure out what's important.

The part that surprised me when I started was how much of the job is organising, not reading. Everything gets put into three categories: urgent and needs to be acted on, important but not urgent or just something to keep an eye on. Most people think every new AI rule is an emergency. It's not; most of it stays in the third category for a while.

I also didn't expect how much of the job is translating, not law. No one in a meeting wants "per Article 9 paragraph 2". They want "here's what you need to do this week." So a big part of my day is taking regulatory language and turning it into real tasks for developers, then involving legal and updating things like privacy policies once legal gives the okay.

Then there's the not-fun part. Writing things down. If a decision isn't recorded, in governance it's like it never happened. So a lot of my day is writing about what changed and why a decision was made, because eventually someone will ask, "Why did we decide this?" and you need the records.

Overall pretty different from what I assumed going in way less "reading law all day alone" and way more comparing countries, talking to people, and documenting decisions. I have posted a YouTube video to tell more about it. Check out the latest video at @ Latha-ai-governance

Curious if anyone else in compliance/governance/risk roles finds their actual day looks nothing like the job description either.

Been looking into AI regulation in the UAE recently, and I didn’t realise how much has actually changed over the last few years.

What caught my attention is that the UAE doesn’t have one single AI law like the EU AI Act. Instead, there’s this whole mix of privacy, cybersecurity, financial, copyright and newer AI-specific rules. I went down a bit of a rabbit hole with it and ended up making a video covering how the UAE got from its first AI strategy in 2017 to where things stand in 2026.

There are some pretty interesting developments along the way, especially around government use of AI and what’s coming next.

Sharing it here in case anyone else is following AI governance in the UAE and is curious to hear what you think. If you’re working in AI governance, compliance, tech, or just trying to understand where UAE AI regulation is heading, you might find it useful. We aim to educate professionals regarding AI Governance; watch our latest video @ Latha-ai-governance to find out more about this.

Do you think the UAE will eventually introduce one comprehensive AI law, or will it continue building on its existing laws?

I work in AI governance and get a lot of DMs from people asking how to break into this field or start consulting. The honest answer is that most people overthink the certifications/theory side and underthink "what does a client actually pay for?"

So here's what I'm actually seeing companies hire consultants for right now, roughly in order of demand:

1. AI/agent inventories: most large companies genuinely don't have a full list of what AI systems and agents are running across teams, who owns them, and what data they touch. Sounds basic, but almost nobody has this done properly.
2. AI policies: the actual internal rules for employees: what tools they can use, what data can go into them, approval processes, etc.
3. Custom governance frameworks: the bigger structural stuff: who owns AI decisions, what committees exist, what has to happen before something gets deployed. This one's very company-specific; no template works for everyone.
4. AI risk/impact assessments: figuring out what could actually go wrong with a given system before it becomes a headline.
5. EU AI Act readiness: a lot of companies still don't know if/how it applies to them.
6. ISO/IEC 42001 readiness/implementation: helping build toward an actual AI management system standard.

If you're trying to figure out where to specialize or what to learn first, I'd honestly pick from this list based on what you find interesting rather than chasing whatever cert is trending on LinkedIn this month.

Went into more detail on each of these in a video. If anyone wants to learn more about this, watch the video posted on YouTube @ Latha-ai-governance. but wanted to share the list here since I think it's useful on its own. Happy to answer questions on any of these too

I work in AI governance, and this is genuinely the #1 question I get asked, so I figured I'd share how I actually think about it instead of just recommending whatever's trending.

Most people start with "which cert should I get" and work backwards. I think that's the wrong order. The better first question is: what AI governance work are companies actually paying for right now?

Off the top of my head, the real consulting demand right now is clustering around a handful of things: AI/agent inventories (do you even know what AI systems your company is running?), internal AI policies, custom governance frameworks, risk assessments, and EU AI Act + ISO 42001 readiness. That's most of the actual paid work happening.

Once you know which of those you want to do, the cert choice gets way easier. For example, if you want a broad foundation, I recommend AIGP; if you want to help companies build or audit an AI management system, then ISO 42001 Lead Implementer is better. And so on. It depends on the services you want to offer.

Also, I made a longer video walking through this in more detail. If anyone wants to learn more about this, watch the video posted on YouTube @ Latha-ai-governance.

But honestly even just reframing the question this way should help most people narrow it down themselves.

Happy to answer questions in the comments if anyone's stuck between two of these.

Anthropic's latest threat intelligence report has a case that hits different if you've ever used a dating app.

A China-based company built 20+ dating apps (Dora, Luma, Romi, Kira, Haven, etc.) different names, same engine underneath. Most users were in the US, and every app promised: "real humans only."

That was a lie.

They used Claude to build the apps, then used Claude to run fake profiles inside them. In just two weeks (April 2026), Anthropic found:

• 4,700+ AI-run fake profiles
• Chatting with 25,000+ real people
• Sending 2.38 million messages

The bots had hard rules: never admit you're AI, dodge video-call/photo requests, and run every conversation through a scripted funnel. The apps also faked likes, faked profile visits, and played pre-recorded videos to sell the illusion that someone was really there.

And the business model was brutal: you get limited free messages, then have to buy coins to keep chatting. The longer the bot strung you along, the more you paid. This wasn't built to find you love. It was built to keep you paying.

They even mixed in real humans (~1 real person per 3 AI ones) for things bots can't fake, like a quick video call just enough realism to keep the illusion alive. And to dodge Apple/Google app review, the apps had a hidden "switch": behave normally during review, flip back to the real (scammy) version once approved.

They got caught because they weren't accessing Claude directly; they were going through resellers/middlemen, and Anthropic traced and banned the operation.

The full video breaks down what this means for AI governance worth a watch if you care about how easily "AI companion" tech can be weaponised**. Watch the latest video on @** Latha-ai-governance to learn more. We aim to spread awareness among AI professionals about AI Governance.

If an app can legally hide that you're talking to a bot until a law forces disclosure, how many other apps do you think are doing this right now, undetected?

Anthropic’s latest threat intelligence report describes a case where criminals allegedly used AI agents to automate a large part of a cyberattack, from finding exposed credentials to accessing company systems and extracting data.

One part of the report that really stood out to me is the scale.

The attackers reportedly:

• Scanned 1.8 million Android apps looking for exposed credentials and keys.
• Used AI to help automate reconnaissance, scripting, and data discovery.
• Targeted software suppliers to reach the data of their customers.
• Stole AI/API keys and then used victims’ own accounts and computing resources for further activity.
• In one case, reportedly collected more than 2,100 login tokens across 40+ company accounts in around 34 hours.

Anthropic calls this emerging approach “vibe hacking,” essentially using AI agents to carry out cyber operations based on high-level instructions rather than manually performing every step.

The biggest lesson isn't necessarily “AI is dangerous.” It's that security controls designed around human-speed attackers may not be enough when parts of an attack can be automated.

The video goes deeper into the incident, including how the attackers got the initial access, what happened after they obtained credentials, and the five practical controls organisations can put in place to reduce this kind of risk.

If you're interested in AI governance, cybersecurity, or the security implications of AI agents, the latest video on our YouTube channel covers the full incident. @ Latha-ai-governance

Question for security/AI governance professionals:
Does your organisation actually know where every active API/AI key is right now, or is there still some uncertainty around old projects, applications, repositories, and third-party systems?

The incident that started it. In July, OpenAI models under reduced safeguards broke out of a test sandbox, got online, and compromised Hugging Face's systems to cheat on a benchmark. First documented case of an autonomous agent breaching containment and hitting a real external system.

A researcher quit, and it cascaded. Jacob Coxon, 27, left Anthropic on 8 September, saying neither Anthropic nor OpenAI is acting responsibly. 170M+ views. Colleagues backed him. Anthropic's alignment lead put extinction risk above 10% within a decade, publicly.

The CEO agreed. Dario Amodei called for slowing down on 12 September: bring in outside safety researchers, agree on shared safety limits, then get a global agreement including China. Altman, Musk and Hassabis broadly signed on, unusual for this group.

Incident reporting showed up. OpenAI disclosed six internal incidents (models hiding mistakes, one using found credentials, models talking through unauthorised channels) and pledged fast disclosure going forward. Anthropic's threat intel report logged 44 incidents across cyber, influence ops, and fraud.

Politics split. Trump called existential risk a hoax, framed it as a China race. Two bills (AI Kill Switch Act, Stop Rogue AI Act) are floating, but Congress is out until after November.

Everyone else moved. EU AI Act now fully enforced with real penalties. Spain floated a nuclear-treaty-style global pact. UN says self-regulation isn't enough. Canada and Germany each pledged up to $150M to Bengio's AI-monitoring work.

Watching: Trump–Xi meeting expected 24 September, AI on the agenda.

Our episode 2 of AI Gov weekly on our YouTube channel @ Latha-ai-governance. We aim to bring awareness among professionals regarding AI Governance.

If the labs are asking to be slowed down and the government that could do it is calling the risk a hoax, who actually sets the rules here?

Lots of talk about AI governance as a career path, not much detail on the day-to-day. So I pulled 100 job descriptions and counted what actually showed up.

These are build roles, not maintain roles.

Risk and compliance dominate.

Assessment is core.

The work doesn't stop at deployment.

Policy writing is real, but it's maybe 20% of it.

Agentic AI is already in the postings.

Compressed into six verbs: build, assess, implement, coordinate, monitor, report.

Happy to answer questions on methodology. I looked at the market side separately titles, industries, salaries but this post is about the work itself. I aim to educate people about AI Governance through my YouTube videos; check out our latest video to learn more. @ Latha-ai-governance

Did a Q&A episode this week; pulled questions from here and YouTube. Genuinely liked how different everyone's starting point was:

• an IT delivery lead trying to break in
• a SOC analyst wondering if security experience transfers
• a QA manager (13 yrs, medical billing) asking the same
• someone in construction, unsure if ISO 42001 is even the right first step

Turns out most of these backgrounds are closer to AI governance than people think; the through-line is basically stakeholder management, risk, and accountability, which all four of these already do in some form, just not with "AI" in front of it.

If any of these sound like your situation: https://youtu.be/Y1wF1MXn3y0?si=r5N47s9Q3MebGQHy?utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=77-ep3-aigovhotline

If you've got a similar question, drop it below, might answer it in the next one

Did a Q&A episode this week; pulled questions from here and YouTube. Genuinely liked how different everyone's starting point was:

• an IT delivery lead trying to break in
• a SOC analyst wondering if security experience transfers
• a QA manager (13 yrs, medical billing) asking the same
• someone in construction, unsure if ISO 42001 is even the right first step

Turns out most of these backgrounds are closer to AI governance than people think; the through-line is basically stakeholder management, risk, and accountability, which all four of these already do in some form, just not with "AI" in front of it.

If any of these sound like your situation: https://youtu.be/Y1wF1MXn3y0?si=r5N47s9Q3MebGQHy?utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=77-ep3-aigovhotline

If you've got a similar question, drop it below, might answer it in the next one

If you've been wondering how to enter AI governance and found almost nothing concrete out there, this video maps it out properly.

The people who move into AI governance almost always come from one of 6 backgrounds: cybersecurity, data/ML, tech & engineering, GRC, legal/privacy, or leadership. Nobody starts in AI governance directly.

From there, everyone needs to cross the same "bridge": understanding GRC for AI (policy, risk, controls) and the 3 core frameworks (ISO 42001, NIST AI RMF, EU AI Act) before landing in one of 7 actual roles listed in the video.

The video also maps which background connects most naturally to which role, and which certifications actually map to which job.

Full breakdown: https://youtu.be/HHxS4cYhf10?si=oF7CGsG10pwItAXS?utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=72-how-to-aigov

Question: Which of the 6 backgrounds are you coming from, and which role are you aiming for?

If you've been wondering how to enter AI governance and found almost nothing concrete out there, this video maps it out properly.

The people who move into AI governance almost always come from one of 6 backgrounds: cybersecurity, data/ML, tech & engineering, GRC, legal/privacy, or leadership. Nobody starts in AI governance directly.

From there, everyone needs to cross the same "bridge": understanding GRC for AI (policy, risk, controls) and the 3 core frameworks (ISO 42001, NIST AI RMF, EU AI Act) before landing in one of 7 actual roles listed in the video.

The video also maps which background connects most naturally to which role, and which certifications actually map to which job.

Full breakdown: https://youtu.be/HHxS4cYhf10?si=oF7CGsG10pwItAXS?utm_source=reddit&utm_medium=organic&utm_campaign=incident_series&utm_content=72-how-to-aigov

Question: Which of the 6 backgrounds are you coming from, and which role are you aiming for?