title: “Governance Controls” description: “The AIGO Framework governance control model and its connection to risk, evidence, assessment, evaluation, and assurance.”
Governance Controls
AIGO controls provide structured governance mechanisms for managing AI-related risks and translating governance expectations into operational practices. Controls connect governance principles and requirements to accountable activities, implementation evidence, assessment, evaluation, assurance, and continual improvement.Purpose
Controls help organizations establish repeatable mechanisms for addressing AI governance expectations. A control may define or support: * a governance objective * an expected activity * an accountable owner * applicability conditions * implementation expectations * evidence requirements * assessment criteria * monitoring activities * assurance activities * improvement actionsControl lifecycle
AIGO controls should be considered across the AI governance lifecycle, including: * identification and design * applicability determination * implementation * operation * assessment * approval * monitoring * assurance * improvement * retirementControl relationships
Controls are connected to the wider governance model. A typical traceability chain is: governance expectation → risk → control → evidence → assessment → assurance The machine-readable evaluation architecture adds the ability to represent and validate defined governance rules and evaluate applicable conditions: requirement / condition → rule → evaluation → result This creates a foundation for more systematic governance evaluation while retaining the need for organizational judgment and contextual interpretation.Control applicability
Not every control necessarily applies in the same way to every AI system. Applicability can depend on factors such as: * AI system characteristics * classification * risk * lifecycle stage * intended use * deployment context * organizational policy * applicable external requirements Applicability decisions should be documented and traceable.Control evidence
Controls should be supported by evidence appropriate to their implementation and operating context. Evidence can be connected to: * the control * the AI system * relevant risks * assessments * approvals * monitoring * assurance activities This supports both operational governance and later review.Control assessment
Control assessment determines whether controls have been implemented and whether they are operating as intended. Assessment findings can result in: * remediation * additional evidence collection * changes to control implementation * additional monitoring * assurance activity * governance decisions * continual-improvement actionsValidation
The AIGO repository includes validation capabilities that inspect control-related structures, references, coverage, and associated machine-readable governance content. Current repository validation includes dedicated control coverage validation as part of the broader repository-quality validation process. Validation demonstrates the integrity of the repository content within the validation scope. It does not establish legal compliance, certification, accreditation, or regulatory conformity.Source
The canonical control framework is maintained in:framework/07-controls/AIGO-AI-Governance-Controls-v0.1.md
The machine-readable definition is maintained in:
schemas/03-control/03-AIGO-Control-Schema-v0.1.json
The control assessment procedure is maintained in:
guidance/02-procedures/05-AIGO-AI-Control-Assessment-Procedure-v0.1.md