Skip to content

AI Governance

Path: /ai-governance

The AI-governance pack brings the three major AI regulatory/management frameworks into the same catalog, crosswalk, and delta machinery as the security frameworks — plus an org-scoped registry of the AI systems those obligations apply to. (EU AI Act high-risk obligations apply from 2 August 2026.)

The three frameworks

All three are first-class frameworks in /api/v1/frameworks and everywhere frameworks are used (assessments, cross-compliance, delta, copilot):

Framework Controls What ships
ISO/IEC 42001:2023 (AI Management System) 38 All Annex A reference controls (A.2–A.10). Control ids carry a 42001- prefix (e.g. 42001-A.5.2) because 42001's Annex A reuses ISO 27001's numbering and bare ids would collide in cross-catalog lookups.
NIST AI RMF 1.0 (NIST AI 100-1) 19 The Core at category level using the framework's own ids (GOVERN 1–6, MAP 1–5, MEASURE 1–4, MANAGE 1–4). The ~72 subcategories are deliberately not enumerated, to avoid paraphrasing drift below category level.
EU AI Act (Regulation (EU) 2024/1689) 19 An article-cited obligation checklist (AIA-9 = Art. 9): prohibited practices, high-risk provider requirements, deployer obligations (incl. FRIA), Art. 50 transparency, GPAI (Art. 53/55), and post-market monitoring / serious-incident reporting.

Crosswalk: AI governance as a delta, not a rebuild

A curated 46-row crosswalk connects the pack to your existing work — ISO 27001 ↔ ISO 42001 (21 rows, mostly partial: the ISMS covers the discipline, 42001 adds the AI subject matter), NIST AI RMF ↔ ISO 42001 (12), and ISO 42001 ↔ EU AI Act (13). Every row is machine-verified to resolve both endpoints against the catalog.

That means the Framework Delta engine works here too: an ISO 27001 shop adopting ISO 42001 sees exactly which management-system work carries over and which AI-specific gaps remain.

AI System Registry

The registry answers the first question every AI framework asks: which AI systems do you actually operate, and at what risk tier?

Each entry records:

  • Name and purpose
  • EU AI Act risk tier — prohibited, high, limited, minimal, gpai, or unclassified
  • Owner — must be an active user of the same organization (cross-tenant owners are rejected)
  • Model provider / model name
  • Linked controls — references into the framework catalog, validated and canonicalized on write (a 422 lists every bad reference; nothing invalid is stored)
  • Notes

API

POST   /api/v1/orgs/{org_id}/ai-systems        # create (org configure permission)
GET    /api/v1/orgs/{org_id}/ai-systems        # list (org read)
GET    /api/v1/orgs/{org_id}/ai-systems/{id}   # detail
PATCH  /api/v1/orgs/{org_id}/ai-systems/{id}   # update
DELETE /api/v1/orgs/{org_id}/ai-systems/{id}   # delete

The registry is fully org-scoped: listing, reading, and mutating are all filtered by organization.

Using the page

  1. Click Add AI System, describe the system, pick its risk tier and owner.
  2. Link the controls (from any framework in the catalog) that govern it — control chips render on the row.
  3. Filter the table by risk tier to see, e.g., every high-tier system at a glance.