An AI governance portfolio, in the sense this page uses, is a job seeker’s set of work samples that proves you can do AI governance work. It is not an organization’s portfolio of AI systems, and not a governance framework. The strongest version holds five records built on ISO/IEC 42001, the AI management system standard published on 18 December 2023. They are an AI system register, an AI system impact assessment, a risk register with treatment, a Statement of Applicability extract, and an AI policy or an internal audit finding with corrective action.
Those five map straight onto what US employers ask for. In the 179 AI governance postings in our Pay Index (collected in early October 2026), 48% asked the hire to write policies, 47% to support audits and evidence and 46% to run risk assessments. A portfolio lets you show that work before anyone has paid you to do it.
What an AI Governance Portfolio Proves That a Resume Cannot
A resume claims a skill; a portfolio shows the record the skill produces. A career portfolio documents education, work samples and skills, and goes deeper than a one- or two-page resume.
That matters in AI governance because the postings ask for years most career changers do not have. Analyst-level postings in our index most often asked for about five years in a related field, which is why the experience bar in junior AI governance postings is the first thing to plan around. Hiring managers who cannot see that experience on paper look for proof you can produce the records instead.
Employers name standards more than credentials. NIST AI RMF and ISO/IEC 42001 were each named in 40% of postings, while only 2% asked for an ISO/IEC 42001 credential by name; see the frameworks and certifications named in AI governance jobs. A register or an impact assessment speaks the language those postings use.
Five Artifacts Mapped to ISO 42001 Clauses and Posting Duties
Each artifact below evidences one part of ISO/IEC 42001 and one duty line that recurs in US postings. Build them in this order, because each one feeds the next.
| Artifact | ISO/IEC 42001 clause it evidences | Posting duty it proves (share of 179 postings) | What a hiring manager checks | Effort (our estimate) |
| 1. AI system register | 4.1 (roles, intended purpose), 4.3 (scope) | Maintain the AI inventory (17%) | Every system has an owner, a purpose, a role and a review date | 4 to 6 hours |
| 2. AI system impact assessment | 6.1.4 and 8.4 | Perform AI, privacy or data protection impact assessments (13%) | Affected people named, harms and mitigations stated, an approval date | 6 to 8 hours |
| 3. Risk register with treatment | 6.1.2 and 6.1.3, then 8.2 and 8.3 | Run AI, model or enterprise risk assessments (46%) | A defined scale, a treatment per risk, a named owner, residual risk accepted by someone | 6 to 8 hours |
| 4. Statement of Applicability extract | 6.1.3 and definition 3.26 | Design, map or test controls across frameworks (32%) | Every row has a decision and a justification tied to a risk | 3 to 4 hours |
| 5a. AI policy | 5.2 | Write and maintain policies, standards and procedures (48%) | Scope you could evidence, an approver, a review date | 3 to 4 hours |
| 5b. Internal audit finding with corrective action | 9.2 and 10.2 | Support audits and evidence (47%); track incidents or remediation (39%) | Requirement, evidence, root cause, correction, corrective action, verification date | 4 to 6 hours |
Sources: clause numbers and definition 3.26 from the official ISO/IEC 42001:2023 preview; duty shares from the AI Training Skool AI Governance Pay Index, 179 US postings. Effort is our estimate for a first attempt.
Pick 5a or 5b: a policy suits roles that write governance, and an audit finding suits audit and GRC roles. The set takes roughly 22 to 32 hours.
These are the same records an auditor asks for first, which is why they persuade. The full list by clause, and what changes between Stage 1 and Stage 2, is in ISO 42001 audit evidence, clause by clause. If you would rather build them from worked examples, an ISO/IEC 42001 Lead Implementer course that produces portfolio-ready work samples includes a case study workbook. It covers the register, impact assessment, risk register and Statement of Applicability. One graduate, A. Shah (Qatar, Trustpilot, July 2026), wrote that the program “goes far beyond exam preparation, with explained artifacts and clear examples.”
The Fictional Company Case Behind Every Artifact
Build all five records on one invented organization, labeled fictional on every page, so an interviewer can follow one thread from register to SoA.
Example (fictional): Larkspur Freight is a 200-person US freight broker. It uses four AI systems: a vendor chatbot that answers shipper questions, a resume screening feature inside its HR software, a demand forecasting model its data team built, and a generative AI writing assistant licensed for staff. The case is invented for practice; any resemblance to a real company is accidental.
The mix gives you a buyer role (three bought systems) and a builder role (the forecasting model), and clause 4.1 asks you to determine those roles. If a target employer uses the NIST vocabulary, add a column mapping each record to the four functions (govern, map, measure and manage) of the NIST AI Risk Management Framework.
Artifact 1, the AI System Register (Clauses 4.1 and 4.3)
The AI system register is the first artifact because every other record points back to a row in it. ISO/IEC 42001 does not name a document called a register, but clause 4.1 asks you to consider the intended purpose of each AI system you develop, provide or use, and clause 4.3 asks you to set the scope.
For Larkspur, make one row per system with owner, intended purpose, your role (for example provider, producer or customer), data used, people affected, risk tier and next review date, plus a note on how you found the systems. The fields an auditor expects, and the triggers for updating them, are in keeping an ISO 42001 AI inventory current.
Artifact 2, the AI System Impact Assessment (Clauses 6.1.4 and 8.4)
The impact assessment looks outward, at the people a system affects, not at risk to the company. ISO/IEC 42001 defines it as a formal, documented process to identify, evaluate and address impacts on individuals, groups and societies (definition 3.24).
Assess Larkspur’s resume screening feature. Name the affected groups (applicants, recruiters), the possible harms (algorithmic bias against protected groups, unexplained rejections), the mitigations (human review of every rejection, vendor bias testing results) and an approval date. Add one real-world constraint: if Larkspur hired in New York City, Local Law 144 would require a bias audit of the tool done no more than one year before its use, and a published summary of the results.
Use ISO/IEC 42005:2025, published in May 2025, as your method reference. It gives guidance for organizations conducting AI system impact assessments. Our step-by-step guide shows how to apply ISO/IEC 42005 for AI impact assessment inside an ISO/IEC 42001 management system.
Artifact 3, the Risk Register With Treatment (Clauses 6.1.2 and 6.1.3)
The risk register is where most interviewers will push, because 46% of US AI governance postings in our index name risk assessment. Clause 6.1.2 asks for an AI risk assessment process and clause 6.1.3 for risk treatment; clauses 8.2 and 8.3 repeat both in operation.
Take Larkspur’s forecasting model and the chatbot. Write six to eight risks, such as model drift, a supplier changing the chatbot’s model without notice, and staff pasting shipper data into the writing assistant. Define your likelihood and impact scale on the page, give each risk a treatment, an owner and a target date, and record who accepted the residual risk. A method that holds up in an audit is set out in scoring and treating AI risks under ISO 42001.
Artifact 4, the Statement of Applicability Extract (Clause 6.1.3)
The Statement of Applicability (SoA) is the record of which controls you apply, which you exclude, and why. Definition 3.26 calls it documentation of all necessary controls and the justification for including or excluding them, and its notes say every identified risk and its controls must be reflected in it.
An extract of eight to ten rows is enough. Pick the controls that answer your top Larkspur risks, mark each applied or excluded, tie each one to a risk in Artifact 3, and say where the evidence would sit. Include one excluded row with a checkable reason and the condition that would reverse it; that single row shows judgment better than twenty applied ones. Field-by-field layouts for this and the other records are in the ISO 42001 template set and its fields.
Artifact 5, an AI Policy or an Audit Finding (Clauses 5.2, 9.2 and 10.2)
The fifth artifact shows you can close the loop. Choose the one that matches the jobs you are applying for.
- AI policy (clause 5.2). One or two pages for Larkspur: purpose, approved and prohibited uses of the writing assistant, who approves new AI tools, and a review date. Write only what Larkspur could evidence; a policy that promises monthly bias testing nobody runs is a finding waiting to happen.
- Internal audit finding with corrective action (clauses 9.2 and 10.2). Audit one requirement, such as “the register is reviewed at the stated frequency”. Record the requirement, the evidence you sampled, the nonconformity, its root cause, the correction, the corrective action and the date you would verify it worked.
Either one maps to the two most common duty lines in US postings: policies (48%) and audit support (47%).
The One-Page Index That Opens the Portfolio
Open the portfolio with a one-page index, so a reviewer can see the whole set, and why it matters for the role, at a glance. List each artifact with one line on what it is, the clause it evidences, the posting duty it proves and the page number. State at the top that Larkspur Freight is fictional and that the work is your own.
Add a short “decisions I made” box: your risk scale, one SoA exclusion and one thing you would change. For implementation roles, a gap analysis against clauses 4 to 10 makes a good appendix.
How to Present the Portfolio in an Interview
Present one artifact per question, not the whole set. When a panel asks about risk, impact or audits, answer with the matching record using a simple sequence: the situation at Larkspur, the clause requirement, the decision you made and why, and what the record shows.
Keep each walkthrough to about three minutes, and expect follow-ups such as “why that risk scale?” or “who would accept this residual risk?”. Those questions let you show judgment, which is the point. Where you are on the ladder decides which artifacts to lead with: register and risk work for analyst roles, SoA and audit work for lead roles; see how AI governance careers progress. If you hold or are working toward the person-level ISO 42001 credential, list it on the index next to the artifacts it trained you to build.
What Never to Put in an AI Governance Portfolio
Never put an employer’s or client’s confidential information in a portfolio, even with names removed. That covers real system names, vendor contract terms, internal risk scores, audit results and any personal data.
Never copy the standard. ISO states that the copyright in its standards is owned by ISO and that copying content in whole or in part requires written permission, according to ISO’s copyright page. Cite clause numbers, paraphrase requirements, and keep any quotation to a short phrase.
Never present the fictional case as real work experience. Label it on every page, and in interviews say plainly that it is a practice case. And do not include anything you cannot explain line by line, whether a template you filled in or text a tool drafted for you.
Where to Host an AI Governance Portfolio
Host the portfolio as a single PDF, with the index first, and put that PDF online so you can link it from your resume and LinkedIn profile. A personal site, a view-only cloud folder or a public repository all work, as long as the link opens without a login.
Keep the PDF as the one version you share, name the file plainly, check that it opens on a phone, and send the link after a screening call so the reader knows what to look for.
Frequently Asked Questions
What Should Be in an AI Governance Portfolio?
A job seeker’s AI governance portfolio should hold five work samples built on ISO/IEC 42001. They are an AI system register, an AI system impact assessment, a risk register with treatment, a Statement of Applicability extract, and an AI policy or an internal audit finding. Open it with a one-page index that maps each artifact to its clause and to a duty in real postings.
How Do I Build an AI Governance Portfolio Without a Job?
Use a fictional company and label it as fictional on every page. Give it three or four AI systems, some bought and some built, and run each record against that case. In our October 2026 data, US postings most often asked for policies, audit support and risk assessments, so make sure those records are in the set.
Can I Use Work From My Current Job in a Portfolio?
Only the method, not the content. Describe what you did in general terms on your resume, and rebuild the record on a fictional company for the portfolio. Never include real system names, vendor terms, risk scores, audit results or personal data from an employer or client, even with names removed.
Is an AI Governance Portfolio the Same as an AI Portfolio Management Framework?
No. Most search results for “AI governance portfolio” describe how organizations govern their portfolio of AI systems. A job seeker’s portfolio is a set of personal work samples, such as a register and a risk assessment, that proves you can do that governance work in an interview.
How Long Does It Take to Build an AI Governance Portfolio?
Plan on 22 to 32 hours for a first version of all five artifacts, by our estimate. That is about 4 to 8 hours each for the register, impact assessment and risk register, and 3 to 6 hours each for the SoA extract and the policy or audit finding. Spread over evenings, that is three to five weeks.
