Concept library
1134 concepts across 20 domains and 101 tracks. Each track is a coherent sequence — read it top to bottom or dip in wherever the gap is.
All domains
01Foundations
02Transformer Internals
03Training & Fine-Tuning
04Reinforcement Learning
05Inference, Systems & Hardware
06Applied LLM Engineering
07Reasoning, Evaluation & Safety
08Multimodal & Applications
09Classical ML & Statistical Learning
10Causal Inference & Experimentation
11Time Series & Forecasting
12Graphs, Recommenders & Structured Data
13Generative Modelling Beyond Transformers
14Efficiency, Compression & Edge AI
15Search & Information Retrieval
16Data & Feature Engineering
17MLOps & Platform Engineering
18Security, Privacy & Adversarial ML
19Governance, Risk & Responsible AI
20Human-AI Interaction, Product & Economics
19
Governance, Risk & Responsible AI
Frameworks, regulation and audit evidence, treated as engineering rather than paperwork.
5tracks
38concepts
370cards
4.8hreading
AI Governance Frameworks NIST AI RMF, ISO/IEC 42001, internal review boards, and turning principles into gates that actually block. 7 concepts · 68 cards
- 01 ISO/IEC 42001 and Certifiable Management Systems What a management system standard certifies, why certification is about process consistency rather than model quality, and where it fits alongside a risk framework.
- 02 Risk Tiering and Impact Assessment How to classify AI systems by consequence rather than by technology, what an impact assessment should establish before a system is built, and why the affected-population question is the one that changes designs.
- 03 The NIST AI Risk Management Framework What the four functions of the AI RMF actually ask an organisation to do, why Govern is the one that determines whether the rest happens, and what a voluntary framework can and cannot deliver.
- 04 Third-Party AI Vendor Risk Management Why buying AI moves the risk without moving the accountability, what due diligence can and cannot learn from a model vendor, and the contract and monitoring controls that make a hosted model governable.
- 05 Incident Response for AI Systems Why an AI incident often has no error to page on, what detection has to rely on instead, and the response steps that differ from a conventional outage.
- 06 Model Risk Management from SR 11-7 to SR 26-2 How bank model risk management built validation around effective challenge, why the 2026 rewrite made it principles-based and pushed generative AI out of scope, and how its three validation components still carry over to LLM systems.
- 07 Turning Principles into Gates That Block Why AI principles documents change nothing on their own, the properties a gate needs to have force, and the design that keeps a review board from becoming either a bottleneck or a formality.
AI Regulation & Compliance The EU AI Act risk tiers, sectoral rules, transparency obligations and evidence a regulator will accept. 7 concepts · 66 cards
- 01 The AI Act Compliance Timeline as It Now Stands The phased application dates, the deferral of high-risk obligations agreed in 2026, and what remained on the original schedule when the rest moved.
- 02 The EU AI Act Risk Tiers How the Act classifies systems into prohibited, high-risk, transparency-obligated and minimal, why the classification turns on use rather than technology, and where the boundaries are genuinely unclear.
- 03 US State and Local AI Laws How New York City's bias-audit law, Colorado's rewritten AI Act and California's frontier-model and automated-decision rules create a moving patchwork, and why federal preemption pressure makes the effective dates less stable than the statutes suggest.
- 04 Evidence a Regulator Will Accept The difference between a policy and evidence of its operation, what an assessor actually asks for, and how to instrument a system so compliance artefacts are produced automatically rather than assembled retrospectively.
- 05 General-Purpose AI Model Obligations and the Code of Practice The two-tier regime the EU AI Act applies to general-purpose AI models, how a training-compute number triggers the systemic-risk tier, and what signing the July 2025 Code of Practice does and does not buy a provider now that enforcement has begun.
- 06 Provider and Deployer Obligations Why the same system carries different duties depending on your role, the actions that turn a deployer into a provider, and how the split shapes contracts between the two.
- 07 Sectoral Rules and Overlapping Regimes Why the AI Act is rarely the only regime applying, how data protection, sector rules and product safety interact with it, and the practical approach to satisfying several at once.
Fairness & Bias Group and individual criteria, impossibility results, measurement under missing attributes, and mitigation costs. 11 concepts · 97 cards
- 01 Discrimination in LLM-Mediated Decisions The correspondence-study design adapted to prompted models, what Anthropic's discrim-eval and the realistic-context follow-up measured, and why an anti-bias prompt that passes a clean evaluation fails once the prompt looks like production.
- 02 Disparate Impact and the Legal Frame How US anti-discrimination doctrine actually assigns liability, why the four-fifths rule is a screening heuristic rather than a standard, and the places where a passing fairness metric and a successful legal defence come apart.
- 03 Where Bias Enters the Pipeline The six distinct points at which disparity is introduced, why calling them all "biased data" prevents fixing them, and which stage each mitigation actually addresses.
- 04 Bias in Generative Models Why classification fairness metrics do not transfer to open-ended generation, the harm categories that appear instead, and the evaluation approaches that produce actionable findings.
- 05 Fairness Dynamics and Delayed Impact Why a constraint that equalises a decision has no built-in relationship to the outcome it is meant to improve, how deployed predictors reshape the distribution they are scored against, and what fairness transfer failures look like in real deployments.
- 06 Fairness of Exposure in Ranking Why a two-point difference in estimated relevance becomes a 37 percent difference in attention, how exposure constraints and stochastic rankings redistribute it, and what amortising fairness across many queries costs.
- 07 Group Fairness Criteria and Why They Conflict Demographic parity, equalised odds and calibration stated precisely, the impossibility result showing you cannot have all three, and what choosing between them commits you to.
- 08 Individual and Counterfactual Fairness Two attempts to define fairness for a person rather than a group, the Lipschitz condition that treats similar people similarly and the causal condition that asks what the decision would have been had the person's group been different, and why each relocates the value judgement into an object someone must build.
- 09 Measuring Fairness Without the Attribute The methods for estimating disparity when group membership is unavailable, why proxy inference introduces error in a direction that matters, and how to report a result built on an estimate.
- 10 Mitigation at Pre-, In- and Post-Processing The three points at which a fairness intervention can act, what each costs in accuracy and in flexibility, and the legal constraint that decides which are available.
- 11 Multicalibration and Subgroup Guarantees Why satisfying a fairness constraint on each protected attribute separately leaves intersections unprotected, what it means to ask for calibration on every computationally identifiable subgroup at once, and how a post-processing loop achieves it.
Transparency & Documentation Model and system cards, datasheets, disclosure of evaluations, and documentation that survives an audit. 7 concepts · 74 cards
- 01 Datasheets for Datasets The questions a dataset's documentation has to answer for someone deciding whether to use it, why the composition and collection sections carry the weight, and what happens when a dataset outlives the answers.
- 02 Disclosure Without Overclaiming What honest capability communication looks like, why published evaluation numbers mislead by default, and the specific claims that most often outrun their evidence.
- 03 Counterfactual Explanations and Algorithmic Recourse How a counterfactual explanation is computed as a constrained optimisation, why the nearest counterfactual is often the wrong advice once features cause one another, and how recourse breaks when constraints are missing, the model is retrained, or the explanation is gamed.
- 04 Documentation That Survives an Audit The properties that separate documentation an assessor accepts from documentation they discount, why generated beats written, and how to structure a technical file so it stays true as the system changes.
- 05 Explaining a Decision to the Person Affected Why feature attributions are not explanations for a subject, what a counterfactual explanation provides instead, and the gap between technical interpretability and the account a person is owed.
- 06 Local Explanations: LIME, SHAP and Their Limits How the two dominant model-agnostic explainers turn one prediction into feature weights, the axioms that make Shapley values attractive and the sampling that makes KernelSHAP an approximation, and the evidence that both can be unstable, contradictory and deliberately fooled.
- 07 System Cards and Documenting the Whole Pipeline Why documenting a model is insufficient when behaviour is produced by a pipeline, what a system card adds, and how to keep documentation current when the system changes weekly.
AI Assurance & Audit Third-party evaluation, red-team evidence, incident reporting, and control testing for AI systems. 6 concepts · 65 cards
- 01 Assurance for Continuously Changing Systems Why point-in-time assurance is a poor fit for systems that retrain weekly, what continuous assurance requires instead, and how to define the change that resets the conclusion.
- 02 Conformity Assessment and Third-Party Certification Who is allowed to declare an AI system compliant under the EU AI Act, why most high-risk systems are self-assessed while biometrics can need a notified body, how harmonised standards create a presumption of conformity that did not yet exist as of September 2026, and how this differs from ISO/IEC 42001 certification audited under ISO/IEC 42006.
- 03 Control Testing for AI Systems How to test whether a stated control actually operates, the difference between design and operating effectiveness, and the AI-specific controls whose testing is unfamiliar to conventional auditors.
- 04 Independent Evaluation and Structured Access Why external scrutiny requires access that providers have reasons to withhold, the mechanisms proposed to reconcile the two, and what safe harbour would need to cover.
- 05 Red-Team Evidence and Its Limits What a red-team exercise contributes to an assurance case, why coverage cannot be quantified, and how to report results so they inform a decision rather than reassuring the reader.
- 06 What an AI Audit Can and Cannot Establish The three things an audit might mean, why access level determines what conclusions are available, and the gap between certifying a process and certifying an outcome.