AI Governance
What ISO 42001 Actually Requires: A Plain-Language Breakdown
The first management-system standard written for AI, broken into four things it actually asks an organization to do.
AI Governance Editorial Lead11 min read
BLG.00 / BLOG & KNOWLEDGE CENTRE
Governance, risk, and compliance thinking, published for Africa first.
Original analysis on governance, risk, compliance, privacy, cybersecurity, and AI governance — written for the people who carry the framework, not just the vendor selling against it.
2
Articles Published
With many more in progress.
12
Topic Hubs
From governance to digital transformation.
5
Knowledge Series
Multi-part deep dives, in progress.
4
Editorial Teams
Compliance, security, AI governance, and risk.
BLG.01 / FEATURED ARTICLES
Where to start.
Featured · Compliance
Building a Continuous Compliance Program: A Practical Framework
Why continuous compliance replaces the annual-audit cycle with an always-current instrument panel — and where to start.
Compliance Editorial Lead9 min read
BLG.02 / LATEST ARTICLES
Every article, most recent first.
16 articles catalogued so far — architecture built to scale to thousands.
Regulatory Updates
The Six Things a CBN Examiner Checks First
A field-level walkthrough of what a Central Bank of Nigeria cybersecurity examination actually inspects.
Compliance Editorial Lead8 min readComing Soon
Vendor Risk
A Defensible Vendor Risk Scoring Methodology
How to weight vendor risk so the score means the same thing to procurement, security, and the board.
Risk & Audit Editorial Lead10 min readComing Soon
Privacy
Data Protection Impact Assessments, in Practice
Where DPIAs actually break down in African organizations, and how to fix the process, not just the template.
Compliance Editorial Lead12 min readComing Soon
Audit
Building a Risk-Based Internal Audit Universe
A structured approach to deciding what your internal audit team actually reviews this year.
Risk & Audit Editorial Lead9 min readComing Soon
Risk
What a Board Actually Wants From a Risk Report
Translating a risk register into the four things a board and audit committee ask for every time.
Risk & Audit Editorial Lead7 min readComing Soon
Cybersecurity
Incident Response When the Clock Is Regulatory, Not Just Technical
Structuring incident response around regulator notification deadlines, not only technical containment.
Security Editorial Lead10 min readComing Soon
BLG.03 / TOPIC HUBS
Twelve hubs, one archive.
Governance
Board structure, accountability, and decision rights.
1 articlesRisk
Identification, scoring, and treatment of organizational risk.
1 articlesCompliance
Framework mapping, evidence, and regulator readiness.
2 articlesPrivacy
Data protection, consent, and cross-border transfer.
2 articlesCybersecurity
Security architecture, controls, and operations.
2 articlesAI Governance
Responsible AI, model oversight, and AI risk.
2 articlesAudit
Internal and external audit planning and evidence.
1 articlesVendor Risk
Third-party due diligence and continuous monitoring.
1 articlesBusiness Continuity
Continuity planning and disaster recovery.
1 articlesRegulatory Updates
What changed, and what it means for your program.
1 articlesEnterprise Architecture
How governance scales across systems and subsidiaries.
1 articlesDigital Transformation
Modernization without losing control of risk.
1 articles
BLG.04 / INDUSTRY INSIGHTS
Sector-specific risk and regulatory context.
Financial Services
Core banking risk, CBN alignment, and board-ready reporting for banks, microfinance institutions, and investment firms.
6 articlesFinTech
Certification speed without certification debt, for teams moving faster than their compliance program.
4 articlesInsurance
NAICOM-aligned risk and solvency reporting, evidenced continuously.
2 articlesTelecommunications
NCC compliance and subscriber-data protection for operators and MVNOs.
1 articlesGovernment
Sovereign hosting and procurement-ready documentation for public agencies.
Coming soonHealthcare
Patient-data governance across multi-facility networks.
1 articlesEnergy & Utilities
Critical-infrastructure risk and safety-compliance reporting.
Coming soonManufacturing
Supply-chain and operational risk governance for regulated manufacturers.
Coming soonEducation
Student-data protection for institutions handling records at scale.
Coming soon
BLG.05 / FRAMEWORK COLLECTIONS
Content organized by the framework you carry.
NDPA
Data protection
1 articlesPOPIA
Data protection
1 articlesISO 27001
Information security management
2 articlesISO 27701
Privacy information management
Coming soonISO 42001
AI management systems
1 articlesSOC 2
Trust services criteria
1 articlesPCI DSS
Payment card data security
1 articlesGDPR
Data protection
1 articlesNIST CSF
Cybersecurity risk management
1 articlesCBN
Banking cybersecurity & prudential risk
1 articlesOther African Regulations
Kenya DPA, Ghana DPA, Egypt PDPL, Rwanda DPPL, NAICOM, NCC, and more — already supported by the platform.
Coming soon
BLG.06 / KNOWLEDGE DISCOVERY
Find the article for your context.
Every selection is optional — answer as much or as little as you want.
Select any combination above — the more you tell us, the more specific the match.
BLG.07 / AUTHOR PROFILES
Who writes this — by role, not by name yet.
AfriGRC's public author program hasn't launched — these are the editorial teams publishing today.
BLG.08 / NEWSLETTER
New articles, before anyone else sees them.
Knowledge Centre Digest
A monthly summary of new articles, series updates, and events — direct to your inbox.
BLG.09 / READING JOURNEY
A recommended sequence: from compliance basics to AI governance.
Mark each step read as you go — nothing here is saved to an account yet.
- 1
Step 1 of 4
Building a Continuous Compliance Program: A Practical FrameworkWhy continuous compliance replaces the annual-audit cycle with an always-current instrument panel — and where to start.
- 2
Step 2 of 4
The Six Things a CBN Examiner Checks First
A field-level walkthrough of what a Central Bank of Nigeria cybersecurity examination actually inspects.
- 3
Step 3 of 4
What ISO 42001 Actually Requires: A Plain-Language BreakdownThe first management-system standard written for AI, broken into four things it actually asks an organization to do.
- 4
Step 4 of 4
AI Governance, Explained From First Principles
What governing an AI system actually means, before any specific framework enters the conversation.
0 of 4 read
BLG.10 / YOUR READING DASHBOARD
Recently viewed, bookmarked, and what's next.
A local, in-browser demonstration — nothing here is saved to an account yet.
Try it — click an article to view it, or bookmark it for later
Recently Viewed (0)
Nothing here yet.
Continue Reading (0)
Nothing here yet.
Bookmarked (0)
Nothing here yet.
Recommended (6)
- Building a Continuous Compliance Program: A Practical Framework
- What ISO 42001 Actually Requires: A Plain-Language Breakdown
- The Six Things a CBN Examiner Checks First
- A Defensible Vendor Risk Scoring Methodology
- Data Protection Impact Assessments, in Practice
- Building a Risk-Based Internal Audit Universe
BLG.11 / KNOWLEDGE SERIES
Multi-part deep dives, published as they're written.
Knowledge Series
AI Governance Explained
A ground-up series on what governing an AI system actually requires, independent of any one framework.
Coming Soon
Knowledge Series
ISO 42001 Series
A multi-part walkthrough of ISO 42001, from first inventory to ongoing model monitoring.
1 part published
Knowledge Series
Privacy Fundamentals
Core data protection concepts across NDPA, POPIA, and GDPR, explained once and applied throughout.
Coming Soon
Knowledge Series
Internal Audit Masterclass
A practitioner's series on planning, testing, and closing findings that actually stay closed.
Coming Soon
Knowledge Series
Enterprise Risk Series
Risk identification, scoring, and board reporting, built as one continuous discipline.
Coming Soon
BLG.12 / EVENTS & WEBINARS
Live sessions that pair with what you're reading.
The same events listed on the Resources hub — webinars, training, workshops, and more.
- Webinar
Continuous Compliance: Moving Beyond the Annual Audit
A live session on shifting from point-in-time evidence to continuous monitoring.
Schedule to be announced · VirtualDetails to be announced
- Webinar
ISO 42001 in Practice: Governing AI You Already Ship
What an AI management system looks like once it's actually running.
Schedule to be announced · VirtualDetails to be announced
- Training
GRC Fundamentals for New Compliance Hires
A structured onboarding session for teams building out their compliance function.
Schedule to be announced · VirtualDetails to be announced
- Workshop
Framework Mapping Workshop
Hands-on session mapping your control set across the frameworks you carry.
Schedule to be announced · VirtualDetails to be announced
- Conference
State of GRC in Africa
AfriGRC's annual gathering of compliance, risk, and security leaders across the continent.
Schedule to be announced · In-person — LagosDetails to be announced
- Office Hours
Security & Trust Office Hours
Open Q&A with AfriGRC's security team — bring your architecture questions.
Schedule to be announced · VirtualDetails to be announced
- Certification Session
ISO 27001 Certification Readiness Session
A guided walkthrough of what a certification audit actually examines.
Schedule to be announced · VirtualDetails to be announced
BLG.13 / FAQ
Frequently Asked Questions.
BLG.14 / GET STARTED
Put this thinking to work in your own program.
See the platform live, explore the wider Resources hub, or bring your team into the conversation.