Ramamurthy (Ram) Rengasamy

The capstone

The question: should Meridian Financial Services approve production deployment of a loan underwriting system that decides 94% of applications automatically?

The system: a third-party credit model (CrediSure Credit Decision Engine v2.3) that auto-approves, auto-denies or routes small-business loan applications to manual review. Ram classified it as a high-risk AI use case (EU AI Act Annex III, credit decisioning) because it affects access to credit.

Ram's role: AI Governance Lead.

The decision Ram defended: Conditional Go. In Ram's words: “Proceed with conditions. Meridian should not approve unrestricted production deployment until fairness testing, proxy-bias review, reason code validation, human oversight triggers, appeal procedures, vendor evidence review, monitoring thresholds, and governance committee approval are completed.”

What Ram produced

• AI governance intake record
• Vendor and model governance review
• AI risk register and mitigation summary (six priority risks, rated and treated)
• Human oversight and appeal procedure
• Production-readiness decision memo
• Incident types, trigger conditions and escalation paths
• Clause-by-clause ISO/IEC 42001 assessment, function-by-function NIST AI RMF assessment, and an EU AI Act fundamental rights impact assessment
• Consolidated portfolio report (PDF)

Skills demonstrated

• Leading an AI governance review of a high-risk use case, from intake to decision
• Documenting an AI system profile, model inventory entry and dataset record
• Assessing fairness, explainability, automation, vendor and human-oversight risk
• Assessing a system against ISO/IEC 42001 clauses 4 to 10 and the four NIST AI RMF functions
• Reviewing a third-party AI model and its vendor
• Designing human oversight, exception review and appeal procedures
• Defining incident types and escalation paths for an AI system
• Writing an executive-ready production-readiness recommendation

How each framework was applied

EU AI Act: high-risk classification (Annex III), fundamental rights impact assessment, human oversight, logging, explanation to affected people, appeal and contestability, deployment conditions.

NIST AI RMF: Govern, Map, Measure and Manage: roles, system context, testing evidence, risk treatment, incident response.

ISO/IEC 42001: clauses 4 to 10: management system scope, roles, risk assessment and treatment, management review, improvement, third-party AI risk.

Tool: VerifyWise (framework setup, use case registration, model inventory, dataset record, risk register, training registry, evidence, vendor management, policy manager, incident management, FRIA).

Verified credential

Certificate of Completion: Becoming an AI Governance, Risk & Compliance Practitioner, an 8-week practitioner program. Issued May 28, 2026 · 20 CPE.

The capstone is a simulated enterprise case built for training, not a review of a real company's system.