Compliance Was Part of Your Job. That Experience Counts in AI Governance.

Pull up an old job description of yours and look for the words ensure compliance with. Maybe they were buried in the eighth bullet, in the part of the job nobody wanted. If they were there, and you actually did it, you have experience that AI governance employers are looking for, even if your title never had the word compliance in it.

Plenty of people did compliance work without being compliance professionals. The HR manager who kept hiring practices inside employment law. The finance director who got a federal grant through its audit. The program manager who wrote the reports a funder required. The practice administrator who handled HIPAA, the operations lead who owned OSHA, the IT manager who wrote the security policy, the school administrator who answered for student privacy. They may never have called it GRC. The experience still counts.

Why that experience matters now

AI governance often sits within established business functions. The IAPP's AI Governance Profession Report 2025 places half of AI governance professionals in ethics, compliance, privacy or legal teams. Organisations are handing the work to people who already know how to take a rule, turn it into a practice, and prove the practice is being followed.

That last part is the skill. It is not the regulation you happened to work under. A person who kept a nonprofit inside its grant terms has practiced a discipline that AI governance also needs: read the requirement, decide what it means for this organisation, put a process in place, keep records, and answer for it when someone asks.

Translate what you did

The hardest part for most people in this position is describing their experience in a way an AI governance hiring manager recognizes. A few examples of the translation:

If you handled hiring compliance in HR, you understand fairness rules and adverse impact. That is the core of reviewing an AI hiring tool, and the EU AI Act lists AI used in hiring as high-risk.

If you managed grant or contract compliance, you know how to track obligations and produce evidence for an auditor. AI governance programs run on exactly that kind of evidence.

If you dealt with patient or student privacy, you know the rules on handling personal data and who may see it. Most AI governance questions start with the data: what went into the model and what happens to the data we put in.

If you owned vendor contracts or procurement, you have done due diligence. AI vendor review asks new questions (what trained this model, who is accountable when it is wrong) but the discipline is the same.

If you wrote or enforced an IT or security policy, you know how to set a rule people will follow and how to check whether they do. An AI use policy is that job with a new subject.

On your resume, lead with the work itself. "Kept a $4 million federal grant audit-ready for three years" tells a hiring manager more than a title like Program Manager ever will. Write each compliance duty as what you did and what it protected.

Fill the gap honestly

You will need to learn the frameworks. The EU AI Act sorts AI systems by risk and puts duties on the organisations that build them and the ones that use them. The NIST AI Risk Management Framework organizes the work into govern, map, measure and manage. ISO/IEC 42001 sets out an AI management system. Our free study companions walk through each one at your own pace: the EU AI Act readiness companion, the NIST AI RMF readiness companion and the ISO 42001 readiness companion. You will also need enough technical literacy to ask good questions about how a model was trained and how it fails. You do not need to build one.

Certification can help you learn this in an orderly way, and some employers screen for it. If you go that route, our AIGP study guide and the free practice questions are a good place to start, and the Certification Academy covers the other credentials employers ask for. Article 4's AI literacy obligation does not require an individual professional certification. The European Commission's guidance on that rule says there is no need for a certificate; organisations can document their training internally. The amended Article 4, in force since July 27, 2026, requires providers and deployers to take measures supporting AI literacy, taking account of people's knowledge, experience, training and the context of use. It does not require them to guarantee a specific level of literacy for each individual. What hiring managers want to see is that you can do the work, and the fastest way to show that is one piece of it: a short risk assessment of an AI tool your organisation already uses, or the vendor questions you would send before buying one.

Where to start

Read our guide to moving into AI governance from the job you already have, which walks through it by background. If compliance or legal work was your whole job, You May Already Be Qualified for AI Governance Jobs covers your path.

For the frameworks, start with NIST AI RMF explained and ISO 42001 explained. To see what employers ask for, browse the AI governance job descriptions and the open AI governance jobs.

Start with the responsibility you already carried. Learn what changes when AI enters the picture, and show how you would handle it.

Sources

• IAPP and Credo AI, AI Governance Profession Report 2025 (April 16, 2025): https://iapp.org/resources/article/ai-governance-profession-report/
• European Commission, AI Literacy: Questions and Answers (Article 4, AI Act).
• Regulation (EU) 2024/1689 (AI Act), as amended by Regulation (EU) 2026/1744.
• NIST AI Risk Management Framework (AI RMF 1.0).
• ISO/IEC 42001:2023, Artificial intelligence management system.