No apprenticeship is called AI governance. The funded route is ST0967, the Level 4 Data Protection and Information Governance Practitioner, built on your live cases rather than in a classroom.
Data Protection and Information Governance Apprenticeship (ST0967)
By James Cotton · Last updated · 4 min read
Part of our topic guides on AI Governance & Data Strategy and Government-Funded Data & AI Training.
By James Cotton, Founder, iO-Sphere
The standard at a glance
The standard is the Level 4 Data protection and information governance practitioner, reference ST0967. It belongs to the Business and administration route. It is approved for delivery, with a funding band of £10,000. The standard's details in this section come from the Skills England standard page.
A start now is on version 2.0. That version took effect on 9 September 2026, and Skills England records the change as "Assessment plan revised". Version 1.1 ran from 19 August 2024 to 8 September 2026. Version 1.0 dated from 30 March 2022.
The standard's typical training period is about 18 months before the final assessment; iO-Sphere covers the training in around 15 months, then a three-month assessment. Skills England's own wording is "18 months (this does not include assessment period)". The minimum off-the-job training is 370 hours.
Two professional bodies recognise it. The standard lists the Information and Records Management Society at individual member level and BCS at associate member level, and it names Ofqual for external quality assurance. The government's find apprenticeship training service showed 10 providers offering the course in September 2026.
What the apprentice is trained and assessed to do
The Level 4 standard sets out a list of duties, and the version 2.0 plan assesses the apprentice against five outcomes. Below are six of those duties, placed under the outcome each fits best, with two under risk management. The wording of the duties is the standard's. The grouping is ours.
- Data protection and regulatory compliance. Handling freedom of information, individual-rights, environmental information and data protection requests within their statutory deadlines.
- Information governance and risk management. Undertaking or assisting with data protection impact assessments, and investigating reported personal data breaches to decide whether to escalate to the supervisory authority.
- Data handling and technology operations. Keeping retention schedules and managing the disposal of records.
- Stakeholder engagement and communication. Developing and delivering in-house information governance and data protection training.
- Continuous improvement and horizon scanning. Keeping procedures current as technology, legislation and society change.
None of the duties names AI. That is where iO-Sphere's delivery places it: we teach AI governance within the standard, and the cases are the apprentice's own. Suppose the system behind an impact assessment, a breach or a supplier audit in their job uses AI. That piece of their real work becomes the training case.
How version 2.0 is assessed
Version 2.0 brought in the reformed assessment, which Skills England publishes on the standard's page itself, with no separate plan document. An independent assessment organisation designs it and runs it, so the body that tests your apprentice is not the provider that trained them.
It must include at least one project. Any further method is chosen from interview, professional discussion, question and answer, presentation, an additional project, a written assessment or a portfolio. Each method tests the apprentice against the five outcomes above.
Grades are pass or distinction. Timing is not fixed to the end. The plan says apprentices "may be assessed at any appropriate point during their apprenticeship programme", which leaves room for assessment before the programme's final stretch.
How iO-Sphere delivers ST0967
Of the data and AI apprenticeships we deliver, two run on this Level 4 standard: Data & AI Governance and Data & AI Strategy, both on ST0967. Governance delivers the standard with AI governance taught inside it. Strategy keeps the same standard with a strategy emphasis.
The difference shows in the cases. A Governance apprentice's work leans on requests, impact assessments and breach investigations, while a Strategy apprentice's leans on policy, risk and performance indicators, and horizon scanning. Where several people in one team need this grounding, a cohort trains them side by side.
Who can start, and what the employer pays
English and maths depend on age. For an apprentice who starts aged 16 to 18, Level 2 English and maths is required before the final assessment. For apprentices aged 19 and over it has been optional since 11 February 2025.
Against the £10,000 band, the 2026-27 apprenticeship funding rules leave the employer paying nothing for a start aged 16 to 24, and for an older start £500 where the employer pays no levy or £2,500 where a levy payer's funds are spent.
A start is arranged around someone you already employ. The apprenticeship is laid over the job that person holds, so the apprentice is on your payroll with work that touches the duties above, and we do not match candidates to employers. Entry requirements are set by the provider, with none published by Skills England.
Frequently asked questions
What job titles does the standard point to?
The course listing on find apprenticeship training attaches three: data protection lead, information governance lead and privacy officer. The standard does not use the title data protection officer, and who fills that role stays your organisation's decision.
Can a data protection lead already in post do it?
Yes. Their day job already covers the duties the standard lists, so their existing caseload becomes the material they train on. The provider's entry requirements still apply to them as to anyone else.
Will AI appear in the final assessment?
Not by name, since none of the five outcomes mentions it. The assessment must include at least one project, and that project is on the apprentice's real work. Where that work involves an AI system, it is assessed against the same outcomes as any other case.
Want to own AI governance in your organisation?
Our Level 4 Data & AI Governance programme builds the frameworks that make data trustworthy and AI accountable, funded through the Growth & Skills Levy.