Nine planned domains. Ninety-five courses in curriculum development.
The curriculum is being developed from cited public incident disclosures, standards publications, regulatory materials, and ODA3 framework requirements. Course content is intended to be reviewed when material public evidence or framework requirements change.
Training translates research into role-specific operating capability.
Training translates normative and technical material into role-specific operating capability for security, governance, response, assessment, and standards participants. Curriculum is built by the same researchers who reconstructed the underlying incidents — see the Faculty & Research Team page for the teaching model.
| Domain | Code | Courses | Levels | Public-source cases |
|---|---|---|---|---|
| AI Security: Defensive | ASD | 11 | Foundation · Practitioner · Expert | I-3 · I-4 · I-5 · I-6 |
| AI Security: Offensive & Red Teaming | ASO | 9 | Foundation · Practitioner · Expert | I-2 · I-5 · I-6 |
| AI Foundations & Tooling | AFT | 13 | Foundation · Practitioner · Expert | — |
| Applied AI for Cybersecurity | ACS | 13 | Foundation · Practitioner · Expert | I-1 · I-6 |
| Cybersecurity & DFIR | CDF | 12 | Foundation · Practitioner · Expert | I-5 |
| Governance, Risk & Compliance | GRC | 9 | Foundation · Practitioner · Expert | Highest urgency — Aug 2026 EU AI Act |
| AI Leadership & Strategy | ALS | 10 | Foundation · Practitioner · Expert | — |
| Startup & Founder | SFD | 5 | Foundation · Practitioner | — |
| Industry-Specific AI & Security | ISA | 20 | Foundation · Practitioner · Expert | — |
All courses are planned and in active curriculum development. Courses launch in priority sequence — Priority 1–12 courses are first to market. Enrollment dates are published on course launch.
The EU AI Act high-risk enforcement deadline is the highest-urgency training driver.
Organizations deploying AI systems classified as high-risk under Annex III must have documented risk management systems, human oversight mechanisms, and quality management processes in place before enforcement begins in the amended EU AI Act timetable. The GRC domain's OC-EUAIA course maps directly to Art. 9, 14, and 17.
Two certification tracks — course completion and organizational assurance.
Certification claims require approved scheme rules, competent assessment, marks governance, registry controls, surveillance, and renewal. Publication of a framework alone does not create certification status. ODA3 Institute operates two distinct tracks — do not conflate them.
Course-level progression: Foundation · Practitioner · Expert
Within each of the nine training domains, courses are sequenced across up to three levels. Foundation courses require no prerequisites; Practitioner requires the relevant Foundation course; Expert requires Practitioner-level completion. This is a curriculum progression, not an organizational attestation.
GAISSF™ practitioner credentials
Individual practitioner credentials — GAISSF™ Associate, GAISSF™ Practitioner, and GAISSF™ Lead Auditor — sit above domain course completion and are governed by the GAISSF Ecosystem License (GEL) v1.0. These are distinct from the GAISSF™ organizational attestations (Foundational Attestation, Operational Certification, Optimized Certification), which assess an organization's control implementation, not an individual's training record.
Future pathways may include assessor and lead-auditor routes beyond the three published credentials above, subject to the approved programme structure and GEL v1.0 governance.
Role-based paths across domains.
Most practitioners will draw courses from more than one domain. Two common progressions:
Security practitioner path
AFT Foundation → ASD or ASO Foundation → Practitioner-level domain courses → CDF or ACS for detection and response depth → Expert-level specialization.
Governance & leadership path
ISA Foundation (sector context) → GRC Foundation → GRC Practitioner (OC-EUAIA, OC-ISO42) → ALS for board-level and enterprise strategy courses.
Built by the researchers who analyzed the breaches.
Curriculum is developed by ODA3 Institute's founding faculty cohort — Research Fellows, Standards Contributors, Instructors, and Industry Advisors — using cited public-source research and published ODA3 framework requirements. See the full teaching philosophy, role descriptions, and how to apply.