March 2026 · · iIA Specialized Courses
Data Governance, Privacy and AI Risk (policy + controls + compliance)
Implement AI with public trust: real policies, impact assessments and operational controls adapted to your library.
Your team builds the governance foundation to use AI with institutional responsibility: usage policy, privacy impact assessment, risk matrix and checklist to evaluate vendors.
Problems it solves
- AI use without policy or defined owners.
- Lack of awareness of privacy risks in commercial tools.
- No criteria to evaluate or contract AI vendors.
- Reputational and legal exposure due to lack of controls.
Results achieved
- Brief AI usage policy (ready for institutional approval).
- Privacy Impact Assessment (PIA/DPIA) for current services.
- Risk matrix with assigned controls and owners.
- Reusable vendor checklist for future contracting.
Course structure
What AI governance is and why it matters in libraries. Applicable regulatory framework (GDPR, local data protection laws). Roles and responsibilities in the AI lifecycle. Exercise: mapping AI tools currently in use.
Privacy principles applied to AI services: data minimization, consent, retention and traceability. Workshop: completing a simplified Privacy Impact Assessment (PIA) for a concrete service.
Types of AI risks for libraries: biases, hallucinations, vendor dependency, misinformation. Workshop: building the risk matrix with controls, probability and assigned impact.
Criteria to evaluate AI vendors: security, data retention, processing agreements, auditing. Workshop: vendor checklist. Close: AI usage policy structure with guided drafting.
Frequently asked questions
No. It is designed for librarians, coordinators and directors; no technical knowledge is required.
Not required. Having taken C1 or the iIA001 micro-course is recommended, but it is not an excluding prerequisite.
AI usage policy v1, completed Privacy Impact Assessment, risk matrix with controls, and vendor checklist.
Library director, digital services coordinators, IT manager and anyone who makes decisions about AI tools.
At least 4 hours of individual work to complete and contextualize the deliverables for your institution.
