How Priya rebuilt her career around an AI compliance framework.

The compliance officer who realized her playbook was outdated.

It was a Tuesday in March 2025 when Priya, a senior compliance officer at one of the world's largest banks, opened a Slack thread that would change her career. The thread was simple: "We're piloting a generative model for fraud detection — what's our risk framework?" She had no good answer.

Priya had spent twelve years building expertise in traditional financial-services compliance. She knew Basel III. She knew Sarbanes-Oxley. She had architected anti-money-laundering programs that auditors praised. But the question on her screen used words her existing playbook didn't cover — model hallucination, prompt injection, data lineage in a vector store.

"I had built my career on knowing the answers. For the first time, I didn't even know the questions."

She did what any senior practitioner does when the floor shifts: she went looking for an AI compliance framework. Not a marketing whitepaper. Not a vendor pitch. A real, structured way of thinking about generative AI in compliance that would survive a regulator's audit.

What's inside the framework Priya built.

The phrase AI compliance framework has been used carelessly enough that it now means almost anything. Priya needed something specific. What she emerged with — and what the GSDC program is structured to teach — is a four-layer model that maps to real regulatory questions.

Layer one: model lineage and provenance. Where did the model come from? What was it trained on? Who is accountable? This is the territory of AI model risk management, and it draws directly on Module 5 of the syllabus.

Layer two: input/output controls. Prompt-injection protection, output filtering, PII detection — the day-to-day plumbing of generative AI in compliance. The Learn-by-Doing labs include a working PII-detection agent and a Microsoft 365 Copilot risk-review workflow.

Layer three: ethical and regulatory alignment. The intersection of an AI ethics certification and an AI risk management certification — covered in Module 7 — that lets you map your AI system to EU AI Act articles, NIST AI RMF, and sectoral rules in finance and healthcare.

Layer four: continuous assurance. Drift detection, post-deployment auditing, and the kind of AI risk assessment tools that turn a one-time certification into a living governance program.