AI Governance & Model-Risk Auditing · Hacking Project

Give organizations a single auditable system of record that continuously measures AI/ML model risk against recognized governance frameworks.

**The problem**
Enterprises are deploying ML and LLM systems faster than they can govern them, leaving models undocumented, unmonitored, and non-compliant with emerging regulation (EU AI Act, NIST AI RMF, ISO/IEC 42001). When a model drifts, discriminates, or leaks data, organizations often cannot prove what data trained it, who approved it, or how risk was assessed. This governance gap creates legal, ethical, and security liability that traditional GRC tooling was never built to measure.

**What you'll build**
Build an AI governance and model-risk auditing platform that inventories every deployed model, generates model cards and datasheets, and scores each system against a control catalog derived from NIST AI RMF, ISO/IEC 42001, and the EU AI Act risk tiers. The system ingests evaluation evidence (bias metrics, robustness tests, data lineage) and produces auditable risk registers, approval workflows, and continuous-compliance dashboards. Findings map to remediation owners with SLA tracking, turning AI governance into a repeatable, evidence-backed process.

**Objective** — Give organizations a single auditable system of record that continuously measures AI/ML model risk against recognized governance frameworks.

**Expected outcome** — A working model-risk audit platform plus a sample audit report and populated risk register for at least two deployed models, mapped to NIST AI RMF and EU AI Act controls.

**Difficulty** — Enterprise/Professional — requires synthesizing multiple regulatory frameworks, ML evaluation methods, and workflow engineering into one auditable system.

**Primary category** — GRC; Secondary = AI/ML Security, Compliance Automation, MLOps Governance

**Security domains** — Primary = GRC; Secondary = AI Security, Security Research, DevSecOps

**Technical focus** — Model risk management, AI compliance mapping, model cards/datasheets, bias & fairness auditing, data lineage, evidence collection, risk registers, control automation, policy-as-code, audit workflow

**Core technologies** — Languages: Python, SQL, TypeScript; Frameworks/Libraries: FastAPI, React, Pydantic, Fairlearn, AI Fairness 360, Evidently; Security Tools: OPA/Rego for policy-as-code, OpenSCAP-style control mapping; Cloud/Infra: Docker, Kubernetes, Terraform, cloud model registries (SageMaker/Vertex/Azure ML); AI/Data: MLflow, model cards toolkit, drift/bias evaluators; Databases: PostgreSQL, object storage for evidence artifacts

**Where it's valued** — Banking and insurance, healthcare, government, hiring/HR tech, any regulated enterprise deploying AI

**Careers it builds toward** — AI Governance Lead, Model Risk Manager, AI Compliance Analyst, Responsible AI Engineer, GRC Analyst (AI focus)

**Framework alignment**
• MITRE ATT&CK: N/A (governance project) — reference MITRE ATLAS as the threat catalog whose mitigations the governance controls should cover
• NIST CSF 2.0: Govern (primary), Identify, Detect
• OWASP: OWASP LLM Top 10 as a control checklist (LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM04 Data & Model Poisoning) referenced in the risk catalog
• CIS Controls v8: 1 (Inventory of Enterprise Assets, extended to models), 3 (Data Protection), 14 (Security Awareness), 17 (Incident Response mapping)

**Innovation** — Startup Potential — AI governance tooling is an emerging, well-funded market and a framework-driven model-risk auditor with continuous evidence collection is genuinely differentiated. Scores: Innovation 7/10, Startup 8/10, Enterprise-Readiness 8/10, Patent = Possible.