title: “Getting Started” description: “Understand AIGO and follow the practical path for implementing it in an organization and across AI systems.”
Getting Started
AIGO is an AI governance framework designed to help organizations establish governance, manage AI-related risks, implement controls, maintain evidence, obtain appropriate approvals, monitor AI systems, perform assurance, and continuously improve governance throughout the AI system lifecycle. AIGO is intended to be both understandable as a governance framework and implementable as an operational system. This page provides the recommended starting point for both.1. What is AIGO?
AIGO provides a structured model for governing AI systems throughout their lifecycle. The framework connects: * governance * AI system registration * AI system profiling * classification * risk management * controls * evidence * assessment * approval * monitoring * incident management * change management * assurance * risk acceptance * continuous improvement * retirement AIGO is organized so that organizations can begin with the conceptual framework and progressively implement operational and machine-readable governance capabilities. The framework should be adapted to the organization’s: * governance structure * AI use cases * risk profile * applicable laws and regulations * contractual obligations * internal policies * assurance requirements * technical environment AIGO does not replace applicable law, regulation, contractual requirements, professional judgment, or organization-specific governance requirements.2. Who should use AIGO?
AIGO can be used by organizations that develop, deploy, operate, procure, integrate, or otherwise govern AI systems. Relevant users may include: * executive leadership * AI governance functions * risk and compliance teams * legal and regulatory teams * information security teams * privacy teams * AI system owners * product teams * engineering teams * data science and machine learning teams * internal audit * assurance functions * procurement teams * AI system operators The level of implementation should be proportionate to the organization’s AI systems, risks, obligations, and governance objectives.3. How AIGO is structured
AIGO documentation is organized into several complementary layers.Framework
The Framework describes what AIGO is. It contains the normative conceptual model, including: * charter * principles * governance domains * governance roles * AI governance lifecycle * risk management * governance controls * maturity * AI system profiles Start here when you need to understand the AIGO governance model.Implementation
The Implementation documentation describes how to apply AIGO. It provides the practical implementation path from establishing governance through AI system retirement.Guidance
The Guidance layer provides detailed procedures, templates, and examples. It answers questions such as: * What should we do? * In what order should we do it? * What should we record? * What does a completed implementation look like?Schemas
The Schemas layer provides machine-readable representations of AIGO governance objects and records. Schemas can be used to support: * structured governance records * governance applications * traceability * automation * validation * integration with other systemsMappings
The Mappings layer describes relationships between AIGO and external frameworks and regulatory requirements, including: * EU AI Act * ISO/IEC 42001 * NIST AI RMF * cross-framework relationships Mappings are implementation aids and should be checked against current authoritative external sources before being used for legal, regulatory, contractual, or certification decisions.Architecture
The Architecture layer explains how AIGO’s internal components relate to each other, including relationships, rules, evaluation, and orchestration.Reference
The Reference layer contains supporting material such as terminology, validation information, versioning, changelog information, and external sources.4. The AIGO implementation model
AIGO implementation can be understood as five connected layers: 1. Governance — establish accountability, authority, policies, roles, and decision mechanisms. 2. AI system lifecycle — govern AI systems from registration through retirement. 3. Risk and controls — identify risks and determine, implement, and assess appropriate controls. 4. Evidence and assurance — maintain evidence supporting governance decisions and perform appropriate assurance. 5. Continuous improvement — use monitoring, incidents, changes, assurance results, and management review to improve the governance system. These layers operate together rather than as independent activities. AIGO therefore should be implemented as a connected governance system rather than as a collection of isolated documents.5. Implement AIGO
The following sequence provides the recommended implementation path for an AI system.Step 1 — Establish AI governance
Define the organization’s AI governance structure before governing individual AI systems. Establish: * governance authority * accountable roles * responsibilities * decision rights * policies * escalation mechanisms * risk acceptance authority * assurance responsibilities * record-keeping expectations Start with: * Governance Implementation * Governance Schema * AI Governance ProcedureStep 2 — Register the AI system
Create a governance record for each AI system that falls within the organization’s AIGO scope. The registration process should establish the system’s identity, ownership, purpose, lifecycle status, and other information required by the organization’s governance model. Start with: * AI System Registration * AI System Schema * AI System Registration Procedure * AI System Registration TemplateStep 3 — Create the AI system profile
Create an appropriate profile describing the AI system and its relevant characteristics. The profile provides the context needed for classification, risk assessment, control selection, and governance decisions. Use the AI System Profiles material together with the corresponding profile template and schema.Step 4 — Classify the AI system
Determine the applicable AIGO classification for the system. Classification should consider the system’s intended purpose, deployment context, impact, risk characteristics, and other relevant factors defined by AIGO and the organization’s governance requirements. Start with: * Classification * AI Classification Procedure * AI Classification Template * AI Classification ExampleStep 5 — Assess AI risks
Identify, analyze, and evaluate risks associated with the AI system. Risk assessment should consider the system’s intended use, affected parties, operational environment, dependencies, foreseeable misuse, and other relevant risk factors. Start with: * Risk Assessment * AI Risk Management * AI Risk Assessment Procedure * AI Risk Assessment Template * AI Risk Assessment ExampleStep 6 — Determine and implement controls
Determine which governance controls are applicable to the identified risks and system characteristics. Controls should be selected and implemented in proportion to the system’s risk, classification, applicable requirements, and organizational context. Start with: * Controls * Control Assessment * Control Schema * Control Implementation Procedure * Control Assessment Template * Control Assessment ExampleStep 7 — Assess controls and collect evidence
Determine whether applicable controls have been appropriately implemented and maintain evidence supporting the assessment. Evidence should be sufficiently specific to support governance decisions and subsequent monitoring or assurance activities. Start with: * Evidence and Traceability * Evidence Schema * Evidence Record TemplateStep 8 — Obtain governance approval
Before deployment or other defined governance milestones, obtain the approvals required by the organization’s governance model. Approval should consider the available risk information, control implementation, evidence, residual risk, and applicable decision authority. Start with: * Approval * Approval Schema * AI Approval Procedure * AI Approval Template * AI Approval ExampleStep 9 — Operate and monitor the AI system
Once approved, operate the AI system according to its approved governance conditions and monitor relevant performance, risk, control, and operational indicators. Monitoring should identify conditions that may require: * investigation * corrective action * change management * incident management * risk reassessment * assurance * suspension or retirement Start with: * Monitoring * Monitoring Procedure * Monitoring Template * Monitoring ExampleStep 10 — Manage changes
AI systems can change after initial approval. Changes may involve: * models * data * system architecture * intended purpose * deployment environment * users * integrations * controls * suppliers * operating conditions Changes should be evaluated according to their significance and potential impact on the existing governance assessment. Start with: * Change Management * Change Management Procedure * Change Management Template * Change Management ExampleStep 11 — Manage incidents
When an AI-related incident occurs, follow the organization’s incident management process and determine whether additional governance action is required. Incident outcomes may require: * containment * investigation * corrective action * risk reassessment * control reassessment * notification * approval changes * monitoring changes * assurance activities Start with: * Incident Management * Incident Management Procedure * Incident Template * Incident ExampleStep 12 — Perform assurance
Perform assurance activities appropriate to the organization’s governance model, risk, classification, and applicable requirements. Assurance may evaluate whether: * governance processes are operating as intended * controls remain effective * evidence is sufficient * risks remain appropriately managed * approvals remain valid * monitoring is operating effectively Start with: * Assurance * Assurance Schema * AI Assurance Procedure * AI Assurance Template * AI Assurance ExampleStep 13 — Manage residual risk
Where risks remain after controls are implemented, determine whether residual risk requires formal acceptance or additional treatment. Risk acceptance should only be performed by an appropriately authorized role according to the organization’s governance model. Start with: * Risk Acceptance * Risk Acceptance Procedure * Risk Acceptance TemplateStep 14 — Continuously improve
AIGO implementation should be treated as a continual governance process. Use information from: * monitoring * incidents * changes * risk assessments * control assessments * assurance * management review * lessons learned * regulatory or organizational changes to improve the governance system and individual AI system controls. Start with: * Continuous Improvement * Continuous Improvement Procedure * Continuous Improvement TemplateStep 15 — Retire the AI system
When an AI system is no longer required, approved for retirement, replaced, or otherwise removed from operation, perform controlled retirement. Retirement should address: * termination of operation * data and model disposition * dependencies * records * evidence retention * outstanding risks * contractual or regulatory requirements * lessons learned * final governance status Start with: * Retirement * Retirement Schema * AI Retirement Procedure * AI Retirement Template6. The implementation relationship
The implementation path can be summarized as: Governance → Registration → Profile → Classification → Risk → Controls → Evidence → Assessment → Approval → Operation → Monitoring → Change / Incident → Assurance → Improvement → Retirement Not every AI system will require identical activities, depth, frequency, or evidence. The appropriate implementation should be determined using the AIGO framework, system characteristics, classification, risk, applicable requirements, and organizational governance decisions.7. Read, perform, record, validate
AIGO documentation is designed to connect conceptual guidance with operational implementation. For each major governance activity, use four stages:Read
Understand the AIGO concept and implementation requirements.Perform
Follow the applicable procedure and perform the governance activity.Record
Use the applicable template or governance system to create the required record and evidence.Validate
Validate the resulting information, relationships, controls, evidence, or machine-readable records where applicable. This creates a repeatable implementation pattern: Read → Perform → Record → Validate8. Procedures, templates, and examples
The Guidance section provides operational material for implementing AIGO.Procedures
Procedures describe how a governance activity should be performed. See Guidance — Procedures.Templates
Templates provide structured starting points for creating governance records. See Guidance — Templates.Examples
Examples demonstrate how AIGO material can be applied in representative situations. See Guidance — Examples. Examples are illustrative and should be adapted to the organization’s: * governance model * AI systems * risk profile * applicable requirements * policies * procedures * evidence practices9. Machine-readable implementation
AIGO includes machine-readable schemas, rules, relationships, evaluation capabilities, and validation tooling. The machine-readable layer can support organizations that want to implement AIGO through: * governance platforms * AI inventories * risk systems * control management systems * evidence repositories * workflow systems * automated validation * governance analytics * assurance tooling The machine-readable layer should support the governance model rather than replace governance accountability or human decision-making.10. Governance traceability
AIGO should maintain traceability between governance objects and decisions. A representative relationship is: AI system → classification → risk → control → evidence → assessment → approval → monitoring → assurance → improvement This relationship allows an organization to understand: * why a control applies * which risk the control addresses * what evidence supports the control * which assessment evaluated it * which approval relied on the assessment * how monitoring validates continued operation * how assurance evaluates the governance process * how findings feed improvement The exact implementation may vary by organization and system.11. Validation and assurance of the AIGO implementation
The repository contains validation capabilities covering multiple layers of framework and implementation integrity. Current validation areas include: * repository references * traceability * control coverage * evidence coverage * framework consistency * document integrity * repository health * rule validation * evaluation validation * orchestration validation A successful validation result provides evidence about the integrity of the validated repository content within the relevant validation scope. Validation does not by itself establish: * legal compliance * regulatory conformity * certification * accreditation * contractual compliance Organizations remain responsible for determining applicable requirements and obtaining appropriate legal, compliance, technical, and assurance judgments.12. Mappings to external frameworks and regulations
AIGO provides mappings to: * EU AI Act Mapping * ISO/IEC 42001 Mapping * NIST AI RMF Mapping * Cross-Framework Mapping Mappings can help organizations use AIGO as part of a broader governance and compliance environment. Mappings are interpretive and implementation-oriented. They should be checked against the current authoritative external source before being used for legal, regulatory, contractual, or certification decisions.13. Repository structure
The major repository areas include: *framework/ — canonical AIGO Framework material
* guidance/ — implementation guidance, procedures, templates, and examples
* schemas/ — machine-readable governance schemas
* rules/ — machine-readable governance rules and evaluation specifications
* relationships/ — machine-readable governance relationships
* validation/ — repository and machine-readable validation
* engine/ — evaluation-engine-related implementation material
* tools/ — governance validation and supporting tools
* mappings/ — external framework and regulatory mappings
* docs/ — published user-facing documentation
The repository structure supports both human-readable implementation and machine-readable governance capabilities.