title: “AI System Schema” description: “Machine-readable representation of governed AI systems within the AIGO Framework.”
AI System Schema
The AI System Schema defines the machine-readable representation of an AI system governed under the AIGO Framework. It provides the structural foundation for registering, identifying, classifying, governing, monitoring, changing, and retiring AI systems while maintaining relationships to the governance records associated with them. The schema should be used together with the AIGO Framework, implementation guidance, procedures, and related schemas.Purpose
The AI System Schema supports consistent representation of information required to govern an AI system. A governed AI system record can provide the central reference point for: * registration * ownership * accountability * intended use * deployment context * classification * risk management * control management * approval * monitoring * incidents * changes * assurance * evidence * improvement * retirement * governance evaluation The schema provides the structure for the record. It does not by itself determine whether the governance activities represented by the record have been adequately performed.AI system as a governed entity
AIGO treats the AI system as a central governed entity. The system record provides the identity and context to which other governance records can be connected. A simplified relationship is: AI System → Risk → Control → Assessment → Evidence → Approval → Monitoring → Assurance → Improvement → Retirement The actual implementation may contain multiple records and relationships at each stage. For example, one AI system may have: * multiple risks * multiple controls * multiple assessments * multiple approvals * multiple monitoring records * multiple incidents * multiple changes * multiple assurance activities * multiple evidence records The schema architecture allows these records to remain separate while retaining their relationship to the governed AI system.What the AI system record represents
An AI system record represents the governed system and its relevant governance context. Depending on the implementation and applicable schema version, information may include:Identity
Information that identifies the AI system within the organization’s governance environment. Examples may include: * system identifier * system name * description * version * statusOwnership and accountability
Information establishing who owns and is accountable for the system. Examples may include: * system owner * accountable authority * responsible teams * governance contactsIntended use
Information describing how the AI system is intended to be used. This may include: * purpose * intended users * intended outputs * operational context * prohibited or restricted uses where applicableDeployment context
Information about where and how the AI system operates. Examples may include: * deployment environment * geographic scope * organizational context * affected stakeholders * interaction with other systems * operational dependenciesLifecycle status
Information describing the current lifecycle state of the AI system. An organization may use lifecycle states corresponding to activities such as: registration → assessment → approval → operation → change → retirement The exact permitted values should follow the canonical schema.Governance context
Information needed to determine how the system is governed. This can include relationships to: * classification * applicable requirements * risks * controls * assessments * approvals * monitoring * assurance * evidenceRegistration
The AI System Schema provides the structural foundation for the AIGO registration process. A typical implementation sequence is:Classification
Classification information may be associated with the AI system record. Classification helps determine the appropriate governance treatment for the system. For example, classification may influence: * risk assessment depth * control requirements * approval authority * monitoring requirements * assurance requirements * evidence requirements Classification is not the same as risk assessment. The system record can therefore maintain classification information while separate risk records capture the risks identified for the system. See AI System Classification for the operational governance process.Relationships to risks
An AI system can be associated with one or more risk records. A simplified relationship is: AI System → Risk The risk record provides the detailed representation of the identified risk, while the AI system record provides the context of the governed system to which the risk applies. This separation allows risk information to be managed independently while remaining traceable to the relevant system. See Risk Schema for the corresponding machine-readable risk structure.Relationships to controls
Risks can be connected to controls intended to prevent, detect, mitigate, or manage those risks. This produces a relationship such as: AI System → Risk → Control Controls may also be associated directly with governance requirements or other governance objects depending on the implementation. See Control Schema for the machine-readable control structure.Relationships to assessments
Assessments provide structured conclusions about governance activities, risks, controls, or other governed conditions. The AI system can therefore be connected to assessment records through the broader governance relationship model. A typical relationship may be: AI System → Risk → Control → Assessment Assessment records should preserve traceability to the object being assessed and the evidence supporting the conclusion. See Assessment Schema.Relationships to approvals
Governance decisions can be associated with the AI system. Examples include: * approval for deployment * approval following remediation * conditional approval * approval following material change * approval for continued operation * approval for retirement A simplified relationship is: AI System → Governance Assessment → Approval Approval records should identify the decision authority, decision, relevant conditions, and supporting governance information according to the applicable schema. See Approval Schema.Relationships to monitoring
Once an AI system is operating, monitoring records can provide ongoing governance information. Monitoring may identify: * performance changes * risk indicators * incidents * control weaknesses * changes in operating conditions * emerging risks * governance exceptions These records can remain linked to the AI system throughout its operational lifecycle. See Monitoring Schema.Relationships to incidents
Incidents may be associated with the AI system that experienced or caused the event. A simplified relationship is: AI System → Incident → Investigation → Corrective Action Significant incidents may subsequently trigger: * risk reassessment * classification review * control changes * approval review * monitoring changes * assurance activity * improvement activity See Incident Schema.Relationships to changes
Material changes should be recorded against the affected AI system. A change record can identify: * what changed * why it changed * who initiated the change * impact assessment * affected risks * affected controls * required approvals * implementation actions * resulting governance decisions A material change may require the AI system’s governance state to be reassessed. See Change Schema.Relationships to assurance
Assurance activities can evaluate whether governance arrangements associated with an AI system are appropriate and operating as intended. The relationship can connect: AI System → Governance Records → Evidence → Assurance Finding Assurance findings can then become inputs to remediation or continuous improvement. See Assurance Schema.Relationships to evidence
Evidence provides support for governance decisions and conclusions. Examples include: * technical documentation * test results * assessment records * monitoring results * approvals * audit records * policies * procedures * incident records * assurance reports Evidence should be traceable to the relevant governance activity or decision. See Evidence Schema.Lifecycle representation
The AI system record remains relevant throughout the governed lifecycle. A simplified representation is:Reclassification and record updates
The AI system record should be updated when material information changes. Potential triggers include: * change in intended use * change in deployment context * significant capability changes * change in ownership * change in affected stakeholders * change in applicable requirements * material risk changes * significant incidents * material technical changes Updates should preserve the appropriate history and traceability required by the organization’s governance and records-management practices.Machine-readable evaluation
The AI system record can provide entity context for the AIGO evaluation layer. The evaluation architecture separates: Governance Records → Rules → Evaluation → Results This means that an AI system record represents the governed entity while separate rules determine which governance conditions are evaluated. For example:Validation
AI system records can be validated against the canonical JSON Schema. Validation can identify structural problems such as: * missing required information * invalid data types * invalid values * malformed structures * invalid relationships * schema violations Validation improves the quality and consistency of machine-readable records. A successful schema validation result does not establish that: * the AI system is safe * the governance process was adequate * controls are effective * risks are acceptable * the organization is legally compliant * regulatory obligations have been satisfied * certification has been achieved Those conclusions require the appropriate governance, legal, technical, assurance, or regulatory processes.Implementation example
An organization implementing AIGO could represent an AI system using a record similar in concept to:Implementation guidance
A practical implementation should connect the schema to the organization’s governance workflow. For example:Canonical source
Machine-readable schema:schemas/01-ai-system/01-AIGO-AI-System-Schema-v0.1.json
Schema documentation:
schemas/01-ai-system/01-AIGO-AI-System-Schema-Documentation-v0.1.md
Framework profile material:
framework/09-profiles/AIGO-AI-System-Profiles-v0.1.md
Operational registration guidance:
docs/ai-system-registration.mdx
Canonical registration procedure:
guidance/02-procedures/02-AIGO-AI-System-Registration-Procedure-v0.1.md