title: “Implementation Guide” description: “A practical guide for organizations implementing the AIGO Framework across their AI governance program and individual AI systems.”
Implementation Guide
The AIGO Implementation Guide explains how an organization can establish, operate, and continuously improve an AI governance capability using the AIGO Framework. This guide is the primary implementation-level entry point after understanding the AIGO framework itself. It connects the conceptual framework with the operational procedures, templates, schemas, evidence, assurance activities, and governance decisions required to implement AIGO in practice.1. What implementation means
Implementing AIGO means establishing a functioning governance capability that can: * identify AI systems within scope * assign governance ownership * understand AI system characteristics * classify AI systems * identify and assess AI-related risks * determine applicable controls * implement and assess controls * maintain governance evidence * make and record governance decisions * approve AI systems where required * monitor systems during operation * manage changes * manage incidents * perform assurance * manage residual risk * continuously improve governance * retire AI systems in a controlled manner AIGO should therefore be implemented as an operational governance system rather than as a collection of documents.2. Implementation principles
Organizations implementing AIGO should consider the following principles.Proportionality
Governance should be proportionate to the characteristics, intended use, impact, risk, and context of the AI system. Not every AI system requires identical governance activities or the same level of documentation.Accountability
Governance decisions should have clearly assigned ownership and decision authority. Responsibilities should be defined before relying on automated workflows or machine-readable governance records.Traceability
Important governance decisions should be traceable to their inputs, assessments, controls, evidence, and approvals. A representative relationship is: AI system → classification → risk → control → evidence → assessment → approval → monitoring → assurance → improvementLifecycle coverage
Governance should address the AI system throughout its lifecycle rather than only at deployment.Evidence-based decisions
Governance decisions should be supported by appropriate evidence.Continual improvement
Governance should evolve in response to monitoring, incidents, changes, assurance results, lessons learned, and changes in applicable requirements.3. The AIGO implementation architecture
AIGO implementation can be understood as several connected layers.Organizational governance
The organization establishes: * governance authority * policies * roles * responsibilities * decision rights * escalation paths * risk acceptance authority * assurance responsibilitiesAI system governance
Individual AI systems are brought into the governance process through: * registration * profiling * classification * risk assessment * control determination * assessment * approval * monitoring * change management * incident management * assurance * retirementGovernance records
Governance activities produce structured records such as: * AI system records * risk records * control records * assessment records * approval records * monitoring records * incident records * change records * assurance records * evidence records * management review records * improvement records * retirement recordsMachine-readable governance
Where appropriate, these records can be represented through AIGO schemas and connected through machine-readable relationships. This enables organizations to progressively move from document-based governance toward integrated governance systems.4. Recommended implementation sequence
AIGO implementation should generally progress through the following stages.5. Phase 1 — Establish organizational AI governance
Before governing individual AI systems, establish the organizational governance capability. Define: * the purpose of AI governance * governance scope * accountable leadership * governance roles * decision authorities * escalation mechanisms * risk acceptance authorities * assurance responsibilities * required policies * record-keeping expectations * governance reporting mechanisms Relevant AIGO material includes: * Governance Implementation * Governance Domains * Governance Roles * Governance Schema The organization should determine which AI systems and AI-related activities fall within the governance scope.6. Phase 2 — Define AI governance scope
Establish what the organization considers an AI system for purposes of its governance program and determine which systems, activities, suppliers, and lifecycle stages are within scope. The scope may include: * internally developed AI systems * externally procured AI systems * third-party AI services * AI-enabled products * embedded AI functionality * generative AI systems * machine learning systems * AI systems operated by suppliers * AI components integrated into larger systems Scope decisions should be documented and governed. The scope should also identify applicable organizational, legal, regulatory, contractual, and policy requirements.7. Phase 3 — Establish the AI system inventory
Identify AI systems within the defined governance scope. The organization should establish an authoritative inventory or equivalent governance mechanism capable of identifying: * system identity * system owner * business owner * technical owner where applicable * purpose * status * deployment context * relevant dependencies * lifecycle stage * classification * governance status The inventory provides the foundation for subsequent governance activities. See: * AI System Registration * AI System Schema * AI System Registration Procedure * AI System Registration Template8. Phase 4 — Profile the AI system
After registration, establish sufficient information about the AI system to support governance decisions. The profile should provide relevant context about: * intended purpose * users * affected parties * inputs * outputs * models * data * integrations * deployment environment * suppliers * operational dependencies * human involvement * lifecycle status The required level of detail should be proportionate to the system. See AI System Profiles.9. Phase 5 — Classify the AI system
Classification determines the governance treatment appropriate to the AI system. Classification should consider relevant system characteristics and governance criteria defined by AIGO and the organization’s applicable requirements. Classification may influence: * risk assessment depth * control requirements * approval authority * evidence requirements * monitoring frequency * assurance requirements * change thresholds * reporting obligations See: * Classification * AI Classification Procedure * AI Classification Template * AI Classification Example10. Phase 6 — Assess AI-related risks
Identify and evaluate risks associated with the AI system. Risk assessment should consider the system’s: * intended use * operating context * affected parties * data * model behavior * dependencies * foreseeable misuse * operational environment * security considerations * privacy considerations * safety considerations * fairness or discrimination considerations where relevant * transparency considerations * human oversight * other organization-specific risk factors Risk assessment should produce documented results that can support control selection and governance decisions. See: * Risk Management * Risk Assessment * Risk Schema * AI Risk Assessment Procedure * AI Risk Assessment Template11. Phase 7 — Determine applicable controls
Controls should be determined based on the AI system’s characteristics, classification, identified risks, applicable requirements, and organizational governance objectives. Control determination should answer: * Which controls apply? * Why do they apply? * Which risks do they address? * Who owns each control? * What implementation is required? * What evidence should be produced? * How will effectiveness be assessed? See: * Controls * Control Schema * Control Assessment12. Phase 8 — Implement controls
Applicable controls should be implemented through the organization’s operational processes, technical systems, policies, procedures, and governance mechanisms. Control implementation may involve: * policy changes * technical safeguards * human oversight * testing * monitoring * access controls * documentation * training * operational procedures * supplier requirements * approval mechanisms The implementation should be documented sufficiently to demonstrate how the control operates.13. Phase 9 — Collect evidence
Evidence should be collected throughout implementation rather than reconstructed only when an audit or assurance activity occurs. Evidence may include: * policies * procedures * system documentation * technical test results * assessments * approvals * monitoring records * incident records * change records * meeting records * training records * logs * assurance reports * other relevant governance records Evidence should be linked to the governance activity, control, assessment, or decision it supports. See: * Evidence Schema * Evidence Record Template14. Phase 10 — Assess controls
Control assessment determines whether applicable controls have been implemented and are operating according to the organization’s defined expectations. Assessment results should identify: * control status * implementation status * evidence * deficiencies * exceptions * findings * remediation requirements * residual risk where relevant Assessment results should feed subsequent governance decisions. See: * Control Assessment * Assessment Schema * Control Assessment Procedure15. Phase 11 — Make governance decisions
Governance decisions should be made by appropriately authorized roles. Depending on the system and organizational model, decisions may include: * approval * conditional approval * rejection * remediation required * risk acceptance * additional assurance required * monitoring requirements * restrictions on deployment * suspension The decision should be supported by the available risk, control, assessment, and evidence information. See Approval.16. Phase 12 — Operate and monitor
Once an AI system is approved for operation, governance does not end. Monitoring should evaluate relevant: * system behavior * operational performance * risk indicators * control indicators * incidents * changes * complaints * exceptions * emerging risks * applicable requirement changes Monitoring results should feed back into governance decisions. See Monitoring.17. Phase 13 — Manage changes
Changes to an AI system can affect its governance status. Examples include changes to: * models * data * intended purpose * users * interfaces * integrations * suppliers * infrastructure * deployment environment * controls * operating conditions The organization should determine whether a change requires: * reassessment * reclassification * additional testing * control changes * approval * monitoring changes * assurance See Change Management.18. Phase 14 — Manage incidents
AI-related incidents should be governed through a defined incident management process. The organization should determine whether an incident requires: * containment * investigation * notification * corrective action * risk reassessment * control reassessment * approval review * monitoring changes * assurance * suspension * other governance action See Incident Management.19. Phase 15 — Perform assurance
Assurance provides additional confidence that governance processes and controls are operating appropriately. Assurance may evaluate: * governance effectiveness * control implementation * control effectiveness * evidence quality * risk management * approval processes * monitoring * incident management * change management * compliance with internal requirements The depth and independence of assurance should be proportionate to the organization’s needs and the system’s risk. See Assurance.20. Phase 16 — Manage residual risk
Not all risks can necessarily be eliminated. Where residual risk remains, the organization should determine whether it is: * acceptable * requires additional treatment * requires escalation * requires additional controls * requires additional assurance * incompatible with continued operation Risk acceptance should be performed by an appropriately authorized decision-maker. See Risk Acceptance.21. Phase 17 — Continuously improve
AIGO implementation should operate as a continual improvement cycle. Improvement inputs may include: * monitoring results * incidents * control findings * assurance findings * changes * emerging risks * management review * lessons learned * changes in applicable requirements * changes in organizational objectives Improvement actions should be tracked to completion and evaluated for effectiveness. See Continuous Improvement.22. Phase 18 — Retire AI systems
AI systems should have a controlled retirement process. Retirement should consider: * cessation of operation * data disposition * model disposition * system dependencies * access removal * contractual obligations * evidence retention * outstanding risks * records * final governance status * lessons learned See Retirement.23. The implementation operating cycle
After initial implementation, AIGO becomes a continuous operating cycle.24. Implementation artifacts
A practical AIGO implementation should establish a controlled set of governance artifacts. Typical artifacts include:
Organizations may implement these artifacts as documents, database records, workflow objects, or other structured governance records.
25. From documents to a governance system
AIGO can initially be implemented using documents and structured templates. As governance maturity increases, organizations can move toward structured and automated governance. A progression may look like:26. Machine-readable implementation
AIGO provides machine-readable capabilities that can support more advanced implementations. These include: * schemas * relationships * rules * evaluation * orchestration * validation The machine-readable layer can support: * automated governance workflows * structured AI inventories * risk and control management * evidence traceability * policy and rule evaluation * governance dashboards * automated validation * assurance support * integration with existing governance systems Automation should support governance decisions rather than obscure accountability. Human accountability and appropriately authorized decisions remain important even where governance activities are automated. See: * Architecture * Schemas Overview * Relationships Overview * Rules Overview * Evaluation Overview * Orchestration Overview27. Implementation by maturity
Organizations do not need to implement the entire AIGO capability at the same time. A practical progression is:Foundation
Establish: * governance ownership * scope * AI inventory * registration * basic classification * basic risk assessmentManaged
Add: * formal controls * evidence * assessments * approval workflows * monitoring * change management * incident managementAssured
Add: * formal assurance * residual risk management * management review * structured improvement * stronger traceabilityIntegrated
Add: * machine-readable governance records * relationships * integrated workflows * automated validation * governance analyticsOptimized
Add: * automated rule evaluation * orchestration * advanced assurance * continuous governance monitoring * integrated cross-framework mappings The AIGO maturity model provides additional guidance for determining an organization’s governance capability level. See Maturity.28. Implementation evidence and traceability
A mature AIGO implementation should be able to answer questions such as: * Which AI systems are governed? * Who owns this AI system? * Why was this system given its classification? * What risks were identified? * Which controls address those risks? * What evidence demonstrates control implementation? * Who assessed the controls? * Who approved the system? * What conditions apply to the approval? * What monitoring is being performed? * What changes have occurred? * What incidents have occurred? * What assurance has been performed? * What residual risks remain? * What improvements have been identified? * Has the system been retired? These questions define the practical value of governance traceability.29. Implementation checklist
An organization implementing AIGO should be able to demonstrate that it has addressed, as applicable: * [ ] Governance ownership established * [ ] AI governance scope defined * [ ] AI systems identified * [ ] AI system registration established * [ ] AI system profiling established * [ ] Classification process established * [ ] Risk assessment process established * [ ] Control determination process established * [ ] Control implementation process established * [ ] Evidence management established * [ ] Control assessment established * [ ] Governance approval established * [ ] Monitoring established * [ ] Change management established * [ ] Incident management established * [ ] Assurance established * [ ] Risk acceptance established where required * [ ] Continuous improvement established * [ ] Retirement process established * [ ] Governance records are traceable * [ ] Applicable external requirements have been considered * [ ] Validation activities are defined where applicable This checklist is a starting point rather than a universal compliance requirement.30. Relationship to Guidance
This guide explains the overall implementation method. Detailed operational instructions are provided in the Guidance section. For each major activity, use the corresponding: Implementation page → Procedure → Template → Example → Schema For example: Risk Assessment → Risk Assessment → Risk Assessment Procedure → Risk Assessment Template → Risk Assessment Example → Risk Schema This relationship should be followed throughout the AIGO implementation documentation.31. Implementation responsibilities
AIGO defines a governance model, but organizations remain responsible for assigning actual responsibilities within their own operating environment. Depending on the organization, responsibilities may be distributed among: * executive leadership * AI governance * AI system owners * business owners * technical teams * risk management * compliance * legal * privacy * security * internal audit * assurance * procurement * operations The Governance Roles material provides the framework-level role model. Organizations should map these roles to their own organizational structure.32. External requirements
AIGO may be used alongside external frameworks, standards, laws, regulations, and contractual requirements. Current mapping material includes: * EU AI Act * ISO/IEC 42001 * NIST AI RMF * cross-framework relationships Mappings should be treated as implementation aids. Organizations remain responsible for determining which external requirements apply to their particular circumstances and for verifying those requirements against current authoritative sources.33. Implementation outcome
A successful AIGO implementation should result in a governance capability where an organization can consistently: 1. identify AI systems within scope 2. understand their characteristics 3. classify them 4. identify and manage risks 5. implement appropriate controls 6. maintain evidence 7. make accountable governance decisions 8. monitor operation 9. respond to changes and incidents 10. perform assurance 11. manage residual risk 12. improve governance 13. retire AI systems appropriately The objective is not simply to produce documentation. The objective is to establish a repeatable, traceable, evidence-based AI governance capability.34. Where to go next
If you are establishing organizational governance, continue with Governance Implementation. If you are governing an individual AI system, continue with AI System Registration. If you want to understand the complete lifecycle, review AI Governance Lifecycle. If you want detailed operational instructions, use the Guidance section. If you want to implement machine-readable governance, continue with Schemas Overview and Architecture. If you need to relate AIGO to external requirements, continue with Mappings Overview.Source
The canonical implementation source is:guidance/01-implementation/01-AIGO-Implementation-Guide-v0.1.md
This documentation page presents the implementation approach in a user-oriented form while preserving the distinction between the canonical AIGO Framework baseline and subsequent implementation capabilities.